Prevent recursive call of Document::execCommand() to protect from attack code

Source/core/editing/CompositeEditCommand.cpp

Index: Source/core/editing/CompositeEditCommand.cpp
diff --git a/Source/core/editing/CompositeEditCommand.cpp b/Source/core/editing/CompositeEditCommand.cpp
index 4db2fe86342c16860200307aa8539f6c2eb0c379..905354fe98d7d8979a7214b76ed1567773a85b25 100644
--- a/Source/core/editing/CompositeEditCommand.cpp
+++ b/Source/core/editing/CompositeEditCommand.cpp
@@ -73,6 +73,24 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+namespace {
+class PreventRecursiveApply {

[Hajime Morrita, 2013/11/14 07:00:24]

Nit: Let's name more noun-like

+public:
+    static bool isRecursiveCall() { return s_nestingCounter; }
+
+    class Scope {
+    public:
+        Scope() { ++s_nestingCounter; }
+        ~Scope() { --s_nestingCounter; }
+    };
+    friend class Scope;
+
+private:
+    static int s_nestingCounter;
+};
+int PreventRecursiveApply::s_nestingCounter;
+}
+
 PassRefPtr<EditCommandComposition> EditCommandComposition::create(Document* document,
     const VisibleSelection& startingSelection, const VisibleSelection& endingSelection, EditAction editAction)
 {
@@ -158,6 +176,14 @@ CompositeEditCommand::~CompositeEditCommand()
 
 void CompositeEditCommand::apply()
 {
+    // We don't allow recusrive |apply()| to protect against attack code.
+    // Recursive call of |apply()| could be happened by moving iframe
+    // with script triggered by insertion, e.g. <iframe src="javascript:...">
+    // <iframe onload="...">. This usage is valid as of the specification
+    // although, it isn't common use case, rather it is used as attack code.
+    if (PreventRecursiveApply::isRecursiveCall())
+        return;
+
     if (!endingSelection().isContentRichlyEditable()) {
         switch (editingAction()) {
         case EditActionTyping:
@@ -182,7 +208,8 @@ void CompositeEditCommand::apply()
     Frame* frame = document().frame();
     ASSERT(frame);
     {
-        EventQueueScope scope;
+        EventQueueScope eventQueueScope;
+        PreventRecursiveApply::Scope preventRecursiveApplyScope;
         doApply();
     }