Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 542a224086b9fb0e0ec89ffb7ba02ea2dfbb8194
https://github.com/WebKit/WebKit/commit/542a224086b9fb0e0ec89ffb7ba02ea2dfbb8194
Author: Chris Dumez <[email protected]>
Date: 2026-08-26 (Wed, 26 Aug 2026)
Changed paths:
M
LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled-expected.txt
M
LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled.html
M Source/WebCore/dom/ScriptElement.h
M Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
Log Message:
-----------
DOMParser-parsed XML script elements execute after being cloned
https://bugs.webkit.org/show_bug.cgi?id=322474
Reviewed by Anne van Kesteren.
DOMParser.parseFromString() must parse XML with XML scripting support disabled,
so the resulting script elements have to stay inert. They did, but only by
accident: the XML parser creates them with createdByParser = true, which makes
them parser-inserted, and ScriptElement::postConnectionSteps() skips
parser-inserted scripts. Their "already started" flag was never set, because
XMLDocumentParser::endElementNs() returns early -- before prepareScript() --
when the document has no frame view.
Cloning drops parser-insertedness but copies "already started", so
document.importNode() of an XML-parsed script produced a script element with
neither flag set. Appending it to a live document ran it.
The HTML side doesn't have this problem: the HTML parser calls prepareScript(),
which sets "already started" before bailing out at the "no frame" check, so
HTML DOMParser documents already hand out inert clones.
Set "already started" on script elements in the XML parser path that never
prepares them, matching what HTMLConstructionSite does for the HTML fragment
parser. This keys off isScriptElement() rather than a QualifiedName comparison,
so prefixed script elements (<xx:script>) are covered too, and it honours
ParserContentPolicy::DoNotMarkAlreadyStarted so createContextualFragment()
keeps executing its scripts.
This also covers XML fragment parsing (XHTML innerHTML), whose scripts were
likewise only inert by virtue of being parser-inserted, as well as
XMLHttpRequest.responseXML and XSLT result documents -- every XML parse where
WebKit does not run scripts.
Firefox marks these already started via nsXMLContentSink calling
AttemptToExecute(); Chromium recently did the same in its XML parser, scoped to
DOMParser documents. Also resyncs the test from upstream, which grew a subtest
covering the prefixed form.
*
LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled-expected.txt:
*
LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-scripting-support-disabled.html:
* Source/WebCore/dom/ScriptElement.h:
(WebCore::ScriptElement::markAlreadyStarted):
* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::endElementNs):
Canonical link: https://commits.webkit.org/319922@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
