Allow attachShadow only for elements in the safelist

third_party/WebKit/Source/core/dom/Element.cpp

Index: third_party/WebKit/Source/core/dom/Element.cpp
diff --git a/third_party/WebKit/Source/core/dom/Element.cpp b/third_party/WebKit/Source/core/dom/Element.cpp
index 0a11d478cbcf30c71db9e5a9fcda4d510565e784..60c32e64ee104c6820c6dee9d64bd1bfdbc161a6 100644
--- a/third_party/WebKit/Source/core/dom/Element.cpp
+++ b/third_party/WebKit/Source/core/dom/Element.cpp
@@ -1913,6 +1913,30 @@ PassRefPtrWillBeRawPtr<ShadowRoot> Element::attachShadow(const ScriptState* scri
 
     OriginsUsingFeatures::countMainWorldOnly(scriptState, document(), OriginsUsingFeatures::Feature::ElementAttachShadow);
 
+    const AtomicString& tagName = localName();
+    bool tagNameIsSupported = isCustomElement()

[kochi, 2016/02/16 06:56:13]

Is isCustomElement() guaranteed to work when attachShadow() is used in
createdCallback?

[kochi, 2016/02/16 06:56:13]

Can you add a reference URL as a comment?

[hayato, 2016/02/16 07:11:13]

I do not think we need to refer it.
It is obvious that this safelist is defined in the spec of Element.attachShadow
from the name of Element::attachShadow.

[hayato, 2016/02/16 07:11:13]

Could you elaborate the case? I do not understand the point.

[kochi, 2016/02/16 07:28:15]

I thought a real custom element is an element which is already upgraded.
Do we allow attaching a shadow on arbitrary element with name consisting '-'
but which is not really a custom element yet?

Mentioning createdCallback was confusing.
I should have meant "a element without document.registerElement (or
defineElement)".

I guess it's safe to allow for such elements who are waiting for upgrade, but I
may
miss something if we allow attaching a shadow before upgrading, so I wanted to
make
sure we are safe to allow attaching shadow for those elements.

[kochi, 2016/02/16 07:28:15]

Acknowledged.

+        || tagName == HTMLNames::articleTag
+        || tagName == HTMLNames::asideTag
+        || tagName == HTMLNames::blockquoteTag
+        || tagName == HTMLNames::bodyTag
+        || tagName == HTMLNames::divTag
+        || tagName == HTMLNames::footerTag
+        || tagName == HTMLNames::h1Tag
+        || tagName == HTMLNames::h2Tag
+        || tagName == HTMLNames::h3Tag
+        || tagName == HTMLNames::h4Tag
+        || tagName == HTMLNames::h5Tag
+        || tagName == HTMLNames::h6Tag
+        || tagName == HTMLNames::headerTag
+        || tagName == HTMLNames::navTag
+        || tagName == HTMLNames::pTag
+        || tagName == HTMLNames::sectionTag
+        || tagName == HTMLNames::spanTag;
+    if (!tagNameIsSupported) {
+        exceptionState.throwDOMException(NotSupportedError, "This element does not support attachShadow");
+        return nullptr;
+    }
+
     if (shadowRootInitDict.hasMode() && shadowRoot()) {
         exceptionState.throwDOMException(InvalidStateError, "Shadow root cannot be created on a host which already hosts a shadow tree.");
         return nullptr;