Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 293347: Disable document.write during xslt processing. r=peterv sr=jst

Browse Source 
git-svn-id: svn://10.0.0.236/trunk@259001 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
jonas%sicking.cc
2009-11-17 02:55:18 +00:00
parent 081923060a
commit 0f4f44ed97
8 changed files with 94 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
mozilla/content/html/document/src/nsHTMLDocument.cpp
View File

@@ -458,10 +458,11 @@ NS_IMPL_RELEASE_INHERITED(nsHTMLDocument, nsDocument)
// QueryInterface implementation for nsHTMLDocument
NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsHTMLDocument)
NS_INTERFACE_TABLE_INHERITED3(nsHTMLDocument,
NS_INTERFACE_TABLE_INHERITED4(nsHTMLDocument,
nsIHTMLDocument,
nsIDOMHTMLDocument,
nsIDOMNSHTMLDocument)
nsIDOMNSHTMLDocument,
nsIHTMLDocument_1_9_1_BRANCH)
NS_INTERFACE_TABLE_TO_MAP_SEGUE
NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(HTMLDocument)
NS_INTERFACE_MAP_END_INHERITING(nsDocument)
@@ -2081,7 +2082,7 @@ nsHTMLDocument::SetCookie(const nsAString& aCookie)
nsresult
nsHTMLDocument::OpenCommon(const nsACString& aContentType, PRBool aReplace)
{
if (IsXHTML()) {
if (IsXHTML() || mDisableDocWrite) {
// No calling document.open() on XHTML
return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
@@ -2460,7 +2461,7 @@ nsHTMLDocument::WriteCommon(const nsAString& aText,
(mWriteLevel > NS_MAX_DOCUMENT_WRITE_DEPTH || mTooDeepWriteRecursion);
NS_ENSURE_STATE(!mTooDeepWriteRecursion);
if (IsXHTML()) {
if (IsXHTML() || mDisableDocWrite) {
// No calling document.write*() on XHTML!
return NS_ERROR_DOM_NOT_SUPPORTED_ERR;

8
mozilla/content/html/document/src/nsHTMLDocument.h
View File

@@ -68,7 +68,7 @@ class nsIDocumentCharsetInfo;
class nsICacheEntryDescriptor;
class nsHTMLDocument : public nsDocument,
public nsIHTMLDocument,
public nsIHTMLDocument_1_9_1_BRANCH,
public nsIDOMHTMLDocument,
public nsIDOMNSHTMLDocument
{
@@ -193,6 +193,10 @@ public:
{
return mDefaultNamespaceID == kNameSpaceID_XHTML;
}
virtual void SetDocWriteDisabled(PRBool aDisabled)
{
mDisableDocWrite = aDisabled;
}
#ifdef DEBUG
virtual nsresult CreateElem(nsIAtom *aName, nsIAtom *aPrefix,
@@ -344,6 +348,8 @@ protected:
PRPackedBool mTooDeepWriteRecursion;
PRPackedBool mDisableDocWrite;
PRBool IdTableIsLive() const {
// live if we've had over 63 misses
return (mIdMissCount & 0x40) != 0;

16
mozilla/content/html/document/src/nsIHTMLDocument.h
View File

@@ -194,4 +194,20 @@ public:
NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLDocument, NS_IHTMLDOCUMENT_IID)
// 498ec6d4-a724-4779-9ede-9c71923c2da6
#define NS_IHTMLDOCUMENT_1_9_1_BRANCH_IID \
{ 0x498ec6d4, 0xa724, 0x4779, \
{ 0x9e, 0xde, 0x9c, 0x71, 0x92, 0x3c, 0x2d, 0xa6 } }
class nsIHTMLDocument_1_9_1_BRANCH : public nsIHTMLDocument
{
public:
NS_DECLARE_STATIC_IID_ACCESSOR(NS_IHTMLDOCUMENT_1_9_1_BRANCH_IID)
virtual void SetDocWriteDisabled(PRBool aDisabled) = 0;
};
NS_DEFINE_STATIC_IID_ACCESSOR(nsIHTMLDocument_1_9_1_BRANCH,
NS_IHTMLDOCUMENT_1_9_1_BRANCH_IID)
#endif /* nsIHTMLDocument_h___ */

11
mozilla/content/xml/document/src/nsXMLContentSink.cpp
View File

@@ -96,6 +96,7 @@
#include "nsIDOMProcessingInstruction.h"
#include "nsNodeUtils.h"
#include "nsIScriptGlobalObject.h"
#include "nsIHTMLDocument.h"
#include "nsEventDispatcher.h"
#include "mozAutoDocUpdate.h"
@@ -392,6 +393,12 @@ nsXMLContentSink::OnDocumentCreated(nsIDocument* aResultDocument)
{
NS_ENSURE_ARG(aResultDocument);
nsCOMPtr<nsIHTMLDocument_1_9_1_BRANCH> htmlDoc =
do_QueryInterface(aResultDocument);
if (htmlDoc) {
htmlDoc->SetDocWriteDisabled(PR_TRUE);
}
nsCOMPtr<nsIContentViewer> contentViewer;
mDocShell->GetContentViewer(getter_AddRefs(contentViewer));
if (contentViewer) {
@@ -433,6 +440,10 @@ nsXMLContentSink::OnTransformDone(nsresult aResult,
// Transform succeeded or it failed and we have an error
// document to display.
mDocument = aResultDocument;
nsCOMPtr<nsIHTMLDocument_1_9_1_BRANCH> htmlDoc = do_QueryInterface(mDocument);
if (htmlDoc) {
htmlDoc->SetDocWriteDisabled(PR_FALSE);
}
}
originalDocument->ScriptLoader()->RemoveObserver(this);

3
mozilla/content/xml/document/test/Makefile.in
View File

@@ -49,6 +49,9 @@ _TEST_FILES = test_bug232004.xhtml \
test_bug355213.xhtml \
test_bug392338.html \
test_bug399502.xhtml \
test_bug293347.html \
file_bug293347.xml \
file_bug293347xslt.xml \
$(NULL)
libs:: $(_TEST_FILES)

2
mozilla/content/xml/document/test/file_bug293347.xml Normal file
View File

@@ -0,0 +1,2 @@
<?xml-stylesheet type="text/xsl" href="file_bug293347xslt.xml"?>
<doc/>

19
mozilla/content/xml/document/test/file_bug293347xslt.xml Normal file
View File

@@ -0,0 +1,19 @@
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/doc">
<html>
<body>
<div></div>
<div>
<script>
didThrow = false;
try {
document.write("shrimp");
} catch (e) {
didThrow = true;
}
</script>
</div>
</body>
</html>
</xsl:template>
</xsl:stylesheet>

31
mozilla/content/xml/document/test/test_bug293347.html Normal file
View File

@@ -0,0 +1,31 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=293347
-->
<head>
<title>Test for Bug 293347</title>
<script type="text/javascript" src="/MochiKit/packed.js"></script>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=293347">Mozilla Bug 293347</a>
<p id="display"></p>
<iframe src="file_bug293347.xml" onload="done(this)"></iframe>
<pre id="test">
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
function done(iframe) {
win = iframe.contentWindow;
is(win.document.getElementsByTagName("div").length, 2, "doc still intact");
is(win.didThrow, true, "doc.write throwing");
SimpleTest.finish();
}
</script>
</pre>
</body>
</html>