0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibWeb: Fix crash when setting innerHTML inside iframe srcdoc document

Browse source 
In particular, there was an assertion failure due to the temporary
parser document's "about base URL" being empty when trying to "parse a
URL" during parsing.

We fix this by copying the context element's document's about base URL
to the temporary parsing document while parsing a fragment.

This fixes a crash when loading search results on https://amazon.com/
This commit is contained in:
Andreas Kling 2024-08-28 16:22:44 +02:00 • committed by Andreas Kling
parent 782926601d
commit b64df59cc6
Notes: github-actions[bot] 2024-08-29 04:25:08 +00:00
3 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Tests/LibWeb/Text/expected/HTML/set-innerHTML-inside-iframe-srcdoc-document.txt Normal file
View file

@ -0,0 +1 @@
PASS (Didn't crash)

14
Tests/LibWeb/Text/input/HTML/set-innerHTML-inside-iframe-srcdoc-document.html Normal file
View file

@ -0,0 +1,14 @@
<iframe id="ifr" srcdoc=""></iframe>
<script src="../include.js"></script>
<script>
test(() => {
ifr.contentDocument.body.innerHTML = "<a href='foo.html'>foo</a>";
let href = ifr.contentDocument.body.querySelector("a").href;
if (href.endsWith("foo.html")) {
println("PASS (Didn't crash)");
} else {
println("FAIL");
}
ifr.remove();
});
</script>

4
Userland/Libraries/LibWeb/HTML/Parser/HTMLParser.cpp
View file

@ -4273,6 +4273,10 @@ Vector<JS::Handle<DOM::Node>> HTMLParser::parse_html_fragment(DOM::Element& cont
auto temp_document = DOM::Document::create_for_fragment_parsing(context_element.realm());
temp_document->set_document_type(DOM::Document::Type::HTML);
// AD-HOC: We set the about base URL of the document to the same as the context element's document.
// This is required for Document::parse_url() to work inside iframe srcdoc documents.
temp_document->set_about_base_url(context_element.document().about_base_url());
// 2. If the node document of the context element is in quirks mode, then let the Document be in quirks mode.
// Otherwise, the node document of the context element is in limited-quirks mode, then let the Document be in limited-quirks mode.
// Otherwise, leave the Document in no-quirks mode.