Don't preload scripts with invalid type/language attributes

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

Index: third_party/WebKit/Source/core/dom/ScriptLoader.cpp
diff --git a/third_party/WebKit/Source/core/dom/ScriptLoader.cpp b/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
index a8337a8df390e92e0f5c4ad23955a52e56086473..1b7c06fd9d951fd46c947de5d57d6aaacb1e81cb 100644
--- a/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
+++ b/third_party/WebKit/Source/core/dom/ScriptLoader.cpp
@@ -131,24 +131,18 @@ static bool isLegacySupportedJavaScriptLanguage(const String& language)
     // We want to accept all the values that either of these browsers accept, but not other values.
 
     // FIXME: This function is not HTML5 compliant. These belong in the MIME registry as "text/javascript<version>" entries.
-    typedef HashSet<String, CaseFoldingHash> LanguageSet;
-    DEFINE_STATIC_LOCAL(LanguageSet, languages, ());
-    if (languages.isEmpty()) {
-        languages.add("javascript");
-        languages.add("javascript1.0");
-        languages.add("javascript1.1");
-        languages.add("javascript1.2");
-        languages.add("javascript1.3");
-        languages.add("javascript1.4");
-        languages.add("javascript1.5");
-        languages.add("javascript1.6");
-        languages.add("javascript1.7");
-        languages.add("livescript");
-        languages.add("ecmascript");
-        languages.add("jscript");
-    }
-
-    return languages.contains(language);
+    return equalIgnoringCase(language, "javascript")
+        || equalIgnoringCase(language, "javascript1.0")
+        || equalIgnoringCase(language, "javascript1.1")
+        || equalIgnoringCase(language, "javascript1.2")
+        || equalIgnoringCase(language, "javascript1.3")
+        || equalIgnoringCase(language, "javascript1.4")
+        || equalIgnoringCase(language, "javascript1.5")
+        || equalIgnoringCase(language, "javascript1.6")
+        || equalIgnoringCase(language, "javascript1.7")
+        || equalIgnoringCase(language, "livescript")
+        || equalIgnoringCase(language, "ecmascript")
+        || equalIgnoringCase(language, "jscript");
 }
 
 void ScriptLoader::dispatchErrorEvent()
@@ -163,20 +157,15 @@ void ScriptLoader::dispatchLoadEvent()
     setHaveFiredLoadEvent(true);
 }
 
-bool ScriptLoader::isScriptTypeSupported(LegacyTypeSupport supportLegacyTypes) const
+bool ScriptLoader::isValidScriptTypeAndLanguage(const String& type, const String& language, LegacyTypeSupport supportLegacyTypes)
 {
     // FIXME: isLegacySupportedJavaScriptLanguage() is not valid HTML5. It is used here to maintain backwards compatibility with existing layout tests. The specific violations are:
     // - Allowing type=javascript. type= should only support MIME types, such as text/javascript.
     // - Allowing a different set of languages for language= and type=. language= supports Javascript 1.1 and 1.4-1.6, but type= does not.
-
-    String type = client()->typeAttributeValue();
-    String language = client()->languageAttributeValue();
-    if (type.isEmpty() && language.isEmpty())
-        return true; // Assume text/javascript.
     if (type.isEmpty()) {
-        type = "text/" + language.lower();
-        if (MIMETypeRegistry::isSupportedJavaScriptMIMEType(type) || isLegacySupportedJavaScriptLanguage(language))
-            return true;
+        return language.isEmpty() // assume text/javascript.
+            || MIMETypeRegistry::isSupportedJavaScriptMIMEType("text/" + language.lower())

[Yoav Weiss, 2016/06/30 09:37:50]

Since we're already lowering, can we lower() once into a var and pass that to
the legacy check as well? That way we could directly compare there instead of
equalIgnoringCase()

[Charlie Harrison, 2016/06/30 12:47:12]

Done.

+            || isLegacySupportedJavaScriptLanguage(language);
     } else if (RuntimeEnabledFeatures::moduleScriptsEnabled() && type == "module") {
         return true;
     } else if (MIMETypeRegistry::isSupportedJavaScriptMIMEType(type.stripWhiteSpace()) || (supportLegacyTypes == AllowLegacyTypeInTypeAttribute && isLegacySupportedJavaScriptLanguage(type))) {
@@ -186,6 +175,11 @@ bool ScriptLoader::isScriptTypeSupported(LegacyTypeSupport supportLegacyTypes) c
     return false;
 }
 
+bool ScriptLoader::isScriptTypeSupported(LegacyTypeSupport supportLegacyTypes) const
+{
+    return isValidScriptTypeAndLanguage(client()->typeAttributeValue(), client()->languageAttributeValue(), supportLegacyTypes);
+}
+
 // http://dev.w3.org/html5/spec/Overview.html#prepare-a-script
 bool ScriptLoader::prepareScript(const TextPosition& scriptStartPosition, LegacyTypeSupport supportLegacyTypes)
 {