Prevent recursive call of Document::execCommand() to protect from attack code

Source/core/editing/CompositeEditCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 138 matching lines @@
 CompositeEditCommand::CompositeEditCommand(Document& document)
     : EditCommand(document)
 {
 }
 
 CompositeEditCommand::~CompositeEditCommand()
 {
     ASSERT(isTopLevelCommand() || !m_composition);
 }
 
+static int applyNestingCounter;
+
 void CompositeEditCommand::apply()
 {
+    if (applyNestingCounter)
+        return;
+
     if (!endingSelection().isContentRichlyEditable()) {
         switch (editingAction()) {
         case EditActionTyping:
         case EditActionPaste:
         case EditActionDrag:
         case EditActionSetWritingDirection:
         case EditActionCut:
         case EditActionUnspecified:
             break;
         default:
             ASSERT_NOT_REACHED();
             return;
         }
     }
     ensureComposition();
 
     // Changes to the document may have been made since the last editing operation that require a layout, as in <rdar://problem/5658603>.
     // Low level operations, like RemoveNodeCommand, don't require a layout because the high level operations that use them perform one
     // if one is necessary (like for the creation of VisiblePositions).
     document().updateLayoutIgnorePendingStylesheets();
 
     Frame* frame = document().frame();
     ASSERT(frame);
     {
         EventQueueScope scope;
+        ++applyNestingCounter;

[leviw_travelin_and_unemployed, 2013/11/13 21:16:18]

I like the idea... Can we make this RAII instead?

         doApply();
+        --applyNestingCounter;
     }
 
     // Only need to call appliedEditing for top-level commands,
     // and TypingCommands do it on their own (see TypingCommand::typingAddedToOpenCommand).
     if (!isTypingCommand())
         frame->editor().appliedEditing(this);
     setShouldRetainAutocorrectionIndicator(false);
 }
 
 EditCommandComposition* CompositeEditCommand::ensureComposition()
@@ skipping 1266 matching lines @@
     return node.release();
 }
 
 PassRefPtr<Element> createBlockPlaceholderElement(Document& document)
 {
     RefPtr<Element> breakNode = document.createElement(brTag, false);
     return breakNode.release();
 }
 
 } // namespace WebCore