Allow attachShadow only for elements in the safelist

third_party/WebKit/Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1895 matching lines @@
     }
     return createShadowRootInternal(ShadowRootType::V0, exceptionState);
 }
 
 PassRefPtrWillBeRawPtr<ShadowRoot> Element::attachShadow(const ScriptState* scriptState, const ShadowRootInit& shadowRootInitDict, ExceptionState& exceptionState)
 {
     ASSERT(RuntimeEnabledFeatures::shadowDOMV1Enabled());
 
     OriginsUsingFeatures::countMainWorldOnly(scriptState, document(), OriginsUsingFeatures::Feature::ElementAttachShadow);
 
+    const AtomicString& tagName = localName();
+    bool tagNameIsSupported = isCustomElement()

[kochi, 2016/02/16 06:56:13]

Is isCustomElement() guaranteed to work when attachShadow() is used in
createdCallback?

[kochi, 2016/02/16 06:56:13]

Can you add a reference URL as a comment?

[hayato, 2016/02/16 07:11:13]

I do not think we need to refer it.
It is obvious that this safelist is defined in the spec of Element.attachShadow
from the name of Element::attachShadow.

[hayato, 2016/02/16 07:11:13]

Could you elaborate the case? I do not understand the point.

[kochi, 2016/02/16 07:28:15]

I thought a real custom element is an element which is already upgraded.
Do we allow attaching a shadow on arbitrary element with name consisting '-'
but which is not really a custom element yet?

Mentioning createdCallback was confusing.
I should have meant "a element without document.registerElement (or
defineElement)".

I guess it's safe to allow for such elements who are waiting for upgrade, but I
may
miss something if we allow attaching a shadow before upgrading, so I wanted to
make
sure we are safe to allow attaching shadow for those elements.

[kochi, 2016/02/16 07:28:15]

Acknowledged.

+        || tagName == HTMLNames::articleTag
+        || tagName == HTMLNames::asideTag
+        || tagName == HTMLNames::blockquoteTag
+        || tagName == HTMLNames::bodyTag
+        || tagName == HTMLNames::divTag
+        || tagName == HTMLNames::footerTag
+        || tagName == HTMLNames::h1Tag
+        || tagName == HTMLNames::h2Tag
+        || tagName == HTMLNames::h3Tag
+        || tagName == HTMLNames::h4Tag
+        || tagName == HTMLNames::h5Tag
+        || tagName == HTMLNames::h6Tag
+        || tagName == HTMLNames::headerTag
+        || tagName == HTMLNames::navTag
+        || tagName == HTMLNames::pTag
+        || tagName == HTMLNames::sectionTag
+        || tagName == HTMLNames::spanTag;
+    if (!tagNameIsSupported) {
+        exceptionState.throwDOMException(NotSupportedError, "This element does not support attachShadow");
+        return nullptr;
+    }
+
     if (shadowRootInitDict.hasMode() && shadowRoot()) {
         exceptionState.throwDOMException(InvalidStateError, "Shadow root cannot be created on a host which already hosts a shadow tree.");
         return nullptr;
     }
 
     ShadowRootType type = ShadowRootType::V0;
     if (shadowRootInitDict.hasMode())
         type = shadowRootInitDict.mode() == "open" ? ShadowRootType::Open : ShadowRootType::Closed;
 
     if (type == ShadowRootType::Closed)
@@ skipping 1689 matching lines @@
 {
 #if ENABLE(OILPAN)
     if (hasRareData())
         visitor->trace(elementRareData());
     visitor->trace(m_elementData);
 #endif
     ContainerNode::trace(visitor);
 }
 
 } // namespace blink