Title: [245927] branches/safari-607-branch
- Revision
- 245927
- Author
- [email protected]
- Date
- 2019-05-30 17:30:20 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r245664. rdar://problem/51264774
Subselectors not searched when determining property whitelist for selector
https://bugs.webkit.org/show_bug.cgi?id=198147
<rdar://problem/50405208>
Reviewed by Zalan Bujtas.
Source/WebCore:
This can cause marker elements get style they shouldn't.
Test: fast/lists/marker-style-subselector-whitelist.html
* css/RuleSet.cpp:
(WebCore::determinePropertyWhitelistType):
Check subselectors too.
LayoutTests:
* fast/lists/marker-style-subselector-whitelist-expected.txt: Added.
* fast/lists/marker-style-subselector-whitelist.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/LayoutTests/ChangeLog (245926 => 245927)
--- branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:17 UTC (rev 245926)
+++ branches/safari-607-branch/LayoutTests/ChangeLog 2019-05-31 00:30:20 UTC (rev 245927)
@@ -1,5 +1,46 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245664. rdar://problem/51264774
+
+ Subselectors not searched when determining property whitelist for selector
+ https://bugs.webkit.org/show_bug.cgi?id=198147
+ <rdar://problem/50405208>
+
+ Reviewed by Zalan Bujtas.
+
+ Source/WebCore:
+
+ This can cause marker elements get style they shouldn't.
+
+ Test: fast/lists/marker-style-subselector-whitelist.html
+
+ * css/RuleSet.cpp:
+ (WebCore::determinePropertyWhitelistType):
+
+ Check subselectors too.
+
+ LayoutTests:
+
+ * fast/lists/marker-style-subselector-whitelist-expected.txt: Added.
+ * fast/lists/marker-style-subselector-whitelist.html: Added.
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-22 Antti Koivisto <[email protected]>
+
+ Subselectors not searched when determining property whitelist for selector
+ https://bugs.webkit.org/show_bug.cgi?id=198147
+ <rdar://problem/50405208>
+
+ Reviewed by Zalan Bujtas.
+
+ * fast/lists/marker-style-subselector-whitelist-expected.txt: Added.
+ * fast/lists/marker-style-subselector-whitelist.html: Added.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245538. rdar://problem/50753927
Fix security check in ScriptController::canAccessFromCurrentOrigin()
Added: branches/safari-607-branch/LayoutTests/fast/lists/marker-style-subselector-whitelist-expected.txt (0 => 245927)
--- branches/safari-607-branch/LayoutTests/fast/lists/marker-style-subselector-whitelist-expected.txt (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/lists/marker-style-subselector-whitelist-expected.txt 2019-05-31 00:30:20 UTC (rev 245927)
@@ -0,0 +1 @@
+List item marker should not be blockified. This test passes if it doesn't assert.
Added: branches/safari-607-branch/LayoutTests/fast/lists/marker-style-subselector-whitelist.html (0 => 245927)
--- branches/safari-607-branch/LayoutTests/fast/lists/marker-style-subselector-whitelist.html (rev 0)
+++ branches/safari-607-branch/LayoutTests/fast/lists/marker-style-subselector-whitelist.html 2019-05-31 00:30:20 UTC (rev 245927)
@@ -0,0 +1,16 @@
+<li><span>List item marker should not be blockified. This test passes if it doesn't assert.</span></li>
+<script>
+if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.waitUntilDone();
+}
+setTimeout(function() {
+ let css = document.createElement("style");
+ css.type = 'text/css';
+ css.appendChild(document.createTextNode(":matches(::marker) { display: block; }"));
+ document.getElementsByTagName("head")[0].appendChild(css);
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }, 0);
+</script>
Modified: branches/safari-607-branch/Source/WebCore/ChangeLog (245926 => 245927)
--- branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:17 UTC (rev 245926)
+++ branches/safari-607-branch/Source/WebCore/ChangeLog 2019-05-31 00:30:20 UTC (rev 245927)
@@ -1,5 +1,52 @@
2019-05-30 Kocsen Chung <[email protected]>
+ Cherry-pick r245664. rdar://problem/51264774
+
+ Subselectors not searched when determining property whitelist for selector
+ https://bugs.webkit.org/show_bug.cgi?id=198147
+ <rdar://problem/50405208>
+
+ Reviewed by Zalan Bujtas.
+
+ Source/WebCore:
+
+ This can cause marker elements get style they shouldn't.
+
+ Test: fast/lists/marker-style-subselector-whitelist.html
+
+ * css/RuleSet.cpp:
+ (WebCore::determinePropertyWhitelistType):
+
+ Check subselectors too.
+
+ LayoutTests:
+
+ * fast/lists/marker-style-subselector-whitelist-expected.txt: Added.
+ * fast/lists/marker-style-subselector-whitelist.html: Added.
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245664 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-05-22 Antti Koivisto <[email protected]>
+
+ Subselectors not searched when determining property whitelist for selector
+ https://bugs.webkit.org/show_bug.cgi?id=198147
+ <rdar://problem/50405208>
+
+ Reviewed by Zalan Bujtas.
+
+ This can cause marker elements get style they shouldn't.
+
+ Test: fast/lists/marker-style-subselector-whitelist.html
+
+ * css/RuleSet.cpp:
+ (WebCore::determinePropertyWhitelistType):
+
+ Check subselectors too.
+
+2019-05-30 Kocsen Chung <[email protected]>
+
Cherry-pick r245538. rdar://problem/50753927
Fix security check in ScriptController::canAccessFromCurrentOrigin()
Modified: branches/safari-607-branch/Source/WebCore/css/RuleSet.cpp (245926 => 245927)
--- branches/safari-607-branch/Source/WebCore/css/RuleSet.cpp 2019-05-31 00:30:17 UTC (rev 245926)
+++ branches/safari-607-branch/Source/WebCore/css/RuleSet.cpp 2019-05-31 00:30:20 UTC (rev 245927)
@@ -144,6 +144,14 @@
#endif
if (component->match() == CSSSelector::PseudoElement && component->pseudoElementType() == CSSSelector::PseudoElementMarker)
return PropertyWhitelistMarker;
+
+ if (const auto* selectorList = selector->selectorList()) {
+ for (const auto* subSelector = selectorList->first(); subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+ auto whitelistType = determinePropertyWhitelistType(subSelector);
+ if (whitelistType != PropertyWhitelistNone)
+ return whitelistType;
+ }
+ }
}
return PropertyWhitelistNone;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
