Teach the background parser to ignore certain elements inside '<select>'.

third_party/WebKit/Source/core/html/parser/HTMLTreeBuilderSimulator.cpp

 /*
  * Copyright (C) 2013 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 74 matching lines @@
   // FIXME: This is copied from HTMLElementStack::isMathMLTextIntegrationPoint
   // and changed to use threadSafeMatch.
   const String& tagName = token.data();
   return threadSafeMatch(tagName, MathMLNames::miTag) ||
          threadSafeMatch(tagName, MathMLNames::moTag) ||
          threadSafeMatch(tagName, MathMLNames::mnTag) ||
          threadSafeMatch(tagName, MathMLNames::msTag) ||
          threadSafeMatch(tagName, MathMLNames::mtextTag);
 }
 
+static bool tokenExitsInSelect(const CompactHTMLToken& token) {
+  // https://html.spec.whatwg.org/#parsing-main-inselect
+  const String& tagName = token.data();
+  return threadSafeMatch(tagName, inputTag) ||
+         threadSafeMatch(tagName, keygenTag) ||
+         threadSafeMatch(tagName, textareaTag);
+}
+
 HTMLTreeBuilderSimulator::HTMLTreeBuilderSimulator(
     const HTMLParserOptions& options)
-    : m_options(options) {
+    : m_options(options), m_inSelectInsertionMode(false) {
   m_namespaceStack.push_back(HTML);
 }
 
 HTMLTreeBuilderSimulator::State HTMLTreeBuilderSimulator::stateFor(
     HTMLTreeBuilder* treeBuilder) {
   ASSERT(isMainThread());
   State namespaceStack;
   for (HTMLElementStack::ElementRecord* record =
            treeBuilder->openElements()->topRecord();
        record; record = record->next()) {
@@ skipping 25 matching lines @@
       m_namespaceStack.pop_back();
     if ((m_namespaceStack.back() == SVG && tokenExitsSVG(token)) ||
         (m_namespaceStack.back() == MathML && tokenExitsMath(token)))
       m_namespaceStack.push_back(HTML);
     if (!inForeignContent()) {
       // FIXME: This is just a copy of Tokenizer::updateStateFor which uses
       // threadSafeMatches.
       if (threadSafeMatch(tagName, textareaTag) ||
           threadSafeMatch(tagName, titleTag)) {
         tokenizer->setState(HTMLTokenizer::RCDATAState);
-      } else if (threadSafeMatch(tagName, plaintextTag)) {
-        tokenizer->setState(HTMLTokenizer::PLAINTEXTState);
       } else if (threadSafeMatch(tagName, scriptTag)) {
         tokenizer->setState(HTMLTokenizer::ScriptDataState);
         simulatedToken = ScriptStart;
-      } else if (threadSafeMatch(tagName, styleTag) ||
-                 threadSafeMatch(tagName, iframeTag) ||
-                 threadSafeMatch(tagName, xmpTag) ||
-                 (threadSafeMatch(tagName, noembedTag) &&
-                  m_options.pluginsEnabled) ||
-                 threadSafeMatch(tagName, noframesTag) ||
-                 (threadSafeMatch(tagName, noscriptTag) &&
-                  m_options.scriptEnabled)) {
-        tokenizer->setState(HTMLTokenizer::RAWTEXTState);
+      } else if (!m_inSelectInsertionMode) {
+        // If we're in the "in select" insertion mode, all of these tags are
+        // ignored, so we shouldn't change the tokenizer state:
+        // https://html.spec.whatwg.org/#parsing-main-inselect
+        if (threadSafeMatch(tagName, plaintextTag) &&
+            !m_inSelectInsertionMode) {

[Yoav Weiss, 2017/01/12 13:45:44]

I'm most probably missing something, but I don't see such a condition in the
HTML spec. What I do see is that moving the tokenizer to the PLAINTEXTState is
defined to only happen when parsing *in body*
https://html.spec.whatwg.org/#parsing-main-inbody

So IIUC (and it's fairly possible that this is not the case) this should be
blocked on in-body insertion, not just banned inside select.

[Mike West, 2017/01/12 14:44:51]

Sure. However, we have no idea what mode we're in in this simulated tree
builder. I agree with you that this patch leaves correctness problems with
regard to switching into plaintext or rawtext tokenizing. From my perspective, I
don't particularly care about those correctness problems, because they don't
also turn into security problems.

Following those rules in a reasonable way almost certainly boils down to
implementing all the logic in HTMLTreeBuilder about insertion mode state
transitions that we're leaving out. I'd be thrilled if y'all would take that on,
because the disconnect between the tokenizer state and the insertion mode seems
very strange to me, and there are probably other problems that it causes. I'm
not signing up to do that work, though. :)

[Yoav Weiss, 2017/01/13 14:13:19]

makes sense :)

+          tokenizer->setState(HTMLTokenizer::PLAINTEXTState);
+        } else if (threadSafeMatch(tagName, styleTag) ||
+                   threadSafeMatch(tagName, iframeTag) ||
+                   threadSafeMatch(tagName, xmpTag) ||
+                   (threadSafeMatch(tagName, noembedTag) &&
+                    m_options.pluginsEnabled) ||
+                   threadSafeMatch(tagName, noframesTag) ||
+                   (threadSafeMatch(tagName, noscriptTag) &&
+                    m_options.scriptEnabled)) {

[Yoav Weiss, 2017/01/12 13:45:44]

Here we're basically blocking anything not mentioned in the "in select insertion
mode" rather than allowing what's there? Is there a particular reason for that?
Can we inverse it to make it easier to correlate the spec to the code and vice
versa?

[Mike West, 2017/01/12 14:44:51]

No? This basically just moves the existing code (from line 143 and line 148)
into an `if (!m_inSelectInsertionMode)` block, ensuring that we don't transition
the tokenizer state into PLAINTEXTState or RAWTEXTState if we're in "in select"
insertion mode.

Again, the actual work on the tokens (e.g. whether or not the `<plaintext>`
start tag is ignored or not) is handled in HTMLTreeBuilder. That's where the
insertion mode matters and is stored. I'm only porting over the smallest piece
necessary to teach this simulated treebuilder enough to stop it from changing
the tokenizer state in this particular case with security implications. :)

[Yoav Weiss, 2017/01/13 14:13:19]

fair enough :)

+          tokenizer->setState(HTMLTokenizer::RAWTEXTState);
+        }
+      }
+
+      // We need to track whether we're in the "in select" insertion mode
+      // in order to determine whether '<plaintext>' will put the tokenizer
+      // into PLAINTEXTState, and whether '<xmp>' and others will consume
+      // textual content.
+      //
+      // https://html.spec.whatwg.org/#parsing-main-inselect
+      if (threadSafeMatch(tagName, selectTag)) {
+        m_inSelectInsertionMode = true;
+      } else if (m_inSelectInsertionMode && tokenExitsInSelect(token)) {
+        m_inSelectInsertionMode = false;
       }
     }
   }
 
   if (token.type() == HTMLToken::EndTag ||
       (token.type() == HTMLToken::StartTag && token.selfClosing() &&
        inForeignContent())) {
     const String& tagName = token.data();
     if ((m_namespaceStack.back() == SVG &&
          threadSafeMatch(tagName, SVGNames::svgTag)) ||
         (m_namespaceStack.back() == MathML &&
          threadSafeMatch(tagName, MathMLNames::mathTag)) ||
         (m_namespaceStack.contains(SVG) && m_namespaceStack.back() == HTML &&
          tokenExitsSVG(token)) ||
         (m_namespaceStack.contains(MathML) && m_namespaceStack.back() == HTML &&
-         tokenExitsMath(token)))
+         tokenExitsMath(token))) {
       m_namespaceStack.pop_back();
+    }
     if (threadSafeMatch(tagName, scriptTag)) {
       if (!inForeignContent())
         tokenizer->setState(HTMLTokenizer::DataState);
       return ScriptEnd;
+    } else if (threadSafeMatch(tagName, selectTag)) {
+      m_inSelectInsertionMode = false;
     }
   }
 
   // FIXME: Also setForceNullCharacterReplacement when in text mode.
   tokenizer->setForceNullCharacterReplacement(inForeignContent());
   tokenizer->setShouldAllowCDATA(inForeignContent());
   return simulatedToken;
 }
 
 }  // namespace blink