Kaynağa Gözat

LibWeb: Check if scripting is disabled before running script

This is not a full check, it's just enough to prevent script execution
in DOMParser.
Luke 4 yıl önce
ebeveyn
işleme
0ea50d44bf

+ 7 - 0
Userland/Libraries/LibWeb/DOM/Node.cpp

@@ -637,4 +637,11 @@ void Node::serialize_tree_as_json(JsonObjectSerializer<StringBuilder>& object) c
     }
 }
 
+// https://html.spec.whatwg.org/multipage/webappapis.html#concept-n-noscript
+bool Node::is_scripting_disabled() const
+{
+    // FIXME: or when scripting is disabled for its relevant settings object.
+    return !document().browsing_context();
+}
+
 }

+ 2 - 0
Userland/Libraries/LibWeb/DOM/Node.h

@@ -163,6 +163,8 @@ public:
 
     bool is_host_including_inclusive_ancestor_of(const Node&) const;
 
+    bool is_scripting_disabled() const;
+
     // Used for dumping the DOM Tree
     void serialize_tree_as_json(JsonObjectSerializer<StringBuilder>&) const;
 

+ 4 - 1
Userland/Libraries/LibWeb/HTML/HTMLScriptElement.cpp

@@ -153,7 +153,10 @@ void HTMLScriptElement::prepare_script()
         return;
     }
 
-    // FIXME: Check if scripting is disabled, if so return
+    if (is_scripting_disabled()) {
+        dbgln("HTMLScriptElement: Refusing to run script because scripting is disabled.");
+        return;
+    }
 
     if (m_script_type == ScriptType::Classic && has_attribute(HTML::AttributeNames::nomodule)) {
         dbgln("HTMLScriptElement: Refusing to run classic script because it has the nomodule attribute.");