Chromium Code Reviews
Help | Chromium Project | Gerrit Changes | Sign in
(1)

Issue 2625103002: Teach the background parser to ignore certain elements inside '<select>'. (Closed)

Can't Edit
Can't Publish+Mail
Start Review
Created:
4 months, 2 weeks ago by Mike West
Modified:
4 months, 1 week ago
CC:
blink-reviews, blink-reviews-html_chromium.org, chromium-reviews, dglazkov+blink, kinuko+watch, kouhei (on way to MUC), loading-reviews+parser_chromium.org
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Teach the background parser to ignore certain elements inside '<select>'. 'HTMLTreeBuilderSimulator' doesn't currently understand that we shouldn't hop into PLAINTEXTState or RAWTEXTState inside '<select>' elements. This has the unfortunate side-effect of enabling dangling markup injection attacks that exfiltrate data via '<select><option><plaintext>' and etc. This patch ensures that `<select>` behaves as specified, matching Safari, Firefox, and Edge's behavior. Thanks to @zcorpan for pointing out Blink's error in the thread ad https://github.com/whatwg/html/issues/2252. BUG=680072 Review-Url: https://codereview.chromium.org/2625103002 Cr-Commit-Position: refs/heads/master@{#443573} Committed: https://chromium.googlesource.com/chromium/src/+/8150200aff6ad60b092fd2ddb7eddcb6d0cc13df

Patch Set 1 #

Patch Set 2 : Test. #

Total comments: 6
Unified diffs Side-by-side diffs Delta from patch set Stats (+149 lines, -13 lines) Patch
A third_party/WebKit/LayoutTests/fast/parser/inselect-tokenization.html View 1 1 chunk +106 lines, -0 lines 0 comments Download
M third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.h View 1 chunk +1 line, -0 lines 0 comments Download
M third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp View 1 3 chunks +42 lines, -13 lines 6 comments Download
Trybot results:  win_chromium_rel_ng   chromium_presubmit   win_clang   win_chromium_x64_rel_ng   win_chromium_compile_dbg_ng   win_chromium_rel_ng   mac_chromium_compile_dbg_ng   mac_chromium_rel_ng   ios-simulator-xcode-clang   ios-device-xcode-clang   ios-simulator   linux_android_rel_ng   cast_shell_android   ios-device   android_n5x_swarming_rel   android_cronet   android_compile_dbg   android_clang_dbg_recipe   android_arm64_dbg_recipe   linux_chromium_rel_ng   linux_chromium_compile_dbg_ng   linux_chromium_chromeos_rel_ng   linux_chromium_chromeos_ozone_rel_ng   linux_chromium_asan_rel_ng   chromium_presubmit   chromeos_amd64-generic_chromium_compile_only_ng   chromeos_daisy_chromium_compile_only_ng   cast_shell_linux   mac_chromium_rel_ng   win_clang   win_chromium_x64_rel_ng   win_chromium_rel_ng   mac_chromium_rel_ng   win_chromium_compile_dbg_ng   mac_chromium_compile_dbg_ng   ios-simulator-xcode-clang   ios-simulator   ios-device-xcode-clang   ios-device   cast_shell_android   linux_android_rel_ng   android_n5x_swarming_rel   android_cronet   android_compile_dbg   android_clang_dbg_recipe   android_arm64_dbg_recipe   linux_chromium_rel_ng   linux_chromium_compile_dbg_ng   linux_chromium_chromeos_rel_ng   linux_chromium_chromeos_ozone_rel_ng   chromium_presubmit   linux_chromium_asan_rel_ng   chromeos_daisy_chromium_compile_only_ng   chromeos_amd64-generic_chromium_compile_only_ng   cast_shell_linux 
Commit queue not available (can’t edit this change).

Messages

Total messages: 26 (14 generated)
Mike West
Yoav, WDYT of this change to the background parser? The new test passes in Firefox... ...
4 months, 2 weeks ago (2017-01-11 12:29:59 UTC) #4
Mike West
+csharrison@ as well, as I worry that correctness might have performance implications.
4 months, 2 weeks ago (2017-01-11 12:43:55 UTC) #6
Charlie Harrison
I don't see anything wrong with this perf wise. One more threadSafeMatch seems ok. +kouhei ...
4 months, 2 weeks ago (2017-01-11 13:09:22 UTC) #7
Mike West
On 2017/01/11 at 13:09:22, csharrison wrote: > I don't see anything wrong with this perf ...
4 months, 2 weeks ago (2017-01-11 14:12:25 UTC) #8
Mike West
yoav@: Friendly ping. If you're busy, I'd be equally happy for csharrison@ or kouhei@ to ...
4 months, 2 weeks ago (2017-01-12 12:00:27 UTC) #13
Yoav Weiss
https://codereview.chromium.org/2625103002/diff/20001/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp File third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp (right): https://codereview.chromium.org/2625103002/diff/20001/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp#newcode159 third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp:159: !m_inSelectInsertionMode) { I'm most probably missing something, but I ...
4 months, 1 week ago (2017-01-12 13:45:44 UTC) #14
Mike West
https://codereview.chromium.org/2625103002/diff/20001/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp File third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp (right): https://codereview.chromium.org/2625103002/diff/20001/third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp#newcode159 third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp:159: !m_inSelectInsertionMode) { On 2017/01/12 at 13:45:44, Yoav Weiss wrote: ...
4 months, 1 week ago (2017-01-12 14:44:51 UTC) #15
Mike West
yoav: Ping? :)
4 months, 1 week ago (2017-01-13 12:35:31 UTC) #16
Yoav Weiss
LGTM We probably want to align the code with the spec, but doesn't have to ...
4 months, 1 week ago (2017-01-13 14:13:20 UTC) #19
Mike West
Merci!
4 months, 1 week ago (2017-01-13 14:31:05 UTC) #22
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2625103002/20001
4 months, 1 week ago (2017-01-13 14:31:08 UTC) #23
commit-bot: I haz the power
4 months, 1 week ago (2017-01-13 16:34:06 UTC) #26
Message was sent while issue was closed.
Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/8150200aff6ad60b092fd2ddb7ed...
Sign in to reply to this message.

Powered by Google App Engine
RSS Feeds Recent Issues | This issue
This is Rietveld 650457f06