Diff
Modified: trunk/LayoutTests/ChangeLog (135597 => 135598)
--- trunk/LayoutTests/ChangeLog 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/LayoutTests/ChangeLog 2012-11-23 13:11:46 UTC (rev 135598)
@@ -1,3 +1,17 @@
+2012-11-23 Kent Tamura <[email protected]>
+
+ Correct input[type=number] value sanitization for user-input
+ https://bugs.webkit.org/show_bug.cgi?id=103018
+
+ Reviewed by Kentaro Hara.
+
+ * fast/forms/number/number-commit-valid-only-expected.txt:
+ * fast/forms/number/number-commit-valid-only.html:
+ Update the expected HTMLInputElement::value results.
+ * fast/forms/number/number-unacceptable-style-expected.txt:
+ * fast/forms/number/number-unacceptable-style.html:
+ Add some checks for HTMLInputElement::value.
+
2012-11-23 Wojciech Bielawski <[email protected]>
[WK2][WKTR] WebKitTestRunner needs eventSender.contextClick()
Modified: trunk/LayoutTests/fast/forms/number/number-commit-valid-only-expected.txt (135597 => 135598)
--- trunk/LayoutTests/fast/forms/number/number-commit-valid-only-expected.txt 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/LayoutTests/fast/forms/number/number-commit-valid-only-expected.txt 2012-11-23 13:11:46 UTC (rev 135598)
@@ -8,7 +8,7 @@
enter "512" for noRange
PASS input.value is "512"
enter "+++" for typeMismatch
-PASS input.value is "512"
+PASS input.value is ""
enter "" for empty
PASS input.value is ""
@@ -28,7 +28,7 @@
enter "200" for rangeOverflow
PASS input.value is "200"
enter "abc" for typeMismatch
-PASS input.value is "200"
+PASS input.value is ""
enter "" for empty
PASS input.value is ""
PASS successfullyParsed is true
Modified: trunk/LayoutTests/fast/forms/number/number-commit-valid-only.html (135597 => 135598)
--- trunk/LayoutTests/fast/forms/number/number-commit-valid-only.html 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/LayoutTests/fast/forms/number/number-commit-valid-only.html 2012-11-23 13:11:46 UTC (rev 135598)
@@ -25,7 +25,7 @@
debug("\nNo restriction");
checkIt('noRange', "512", "512");
-checkIt('typeMismatch', "+++", "512");
+checkIt('typeMismatch', "+++", "");
checkIt('empty', "", "");
debug("\nmin/max/step");
@@ -39,7 +39,7 @@
checkIt("stepMismatch", "10.5", "10.5");
checkIt("maximum", "100", "100");
checkIt("rangeOverflow", "200", "200");
-checkIt("typeMismatch", "abc", "200");
+checkIt("typeMismatch", "abc", "");
checkIt("empty", "", ""); // empty
</script>
Modified: trunk/LayoutTests/fast/forms/number/number-unacceptable-style-expected.txt (135597 => 135598)
--- trunk/LayoutTests/fast/forms/number/number-unacceptable-style-expected.txt 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/LayoutTests/fast/forms/number/number-unacceptable-style-expected.txt 2012-11-23 13:11:46 UTC (rev 135598)
@@ -8,13 +8,17 @@
Type '-'. The renderer value becomes unacceptable.
PASS colorOf(number) is invalidStyleColor
PASS number.validity.valid is true
+PASS number.value is ""
Type '1' additionally. The renderer value becomes acceptable.
PASS colorOf(number) != invalidStyleColor is true
+PASS number.value is "-1"
Type 'a' additionally. The renderer value becomes unacceptable again.
PASS colorOf(number) is invalidStyleColor
+PASS number.value is ""
The element losts focus. The unacceptable value should be purged and the style should be normal.
PASS colorOf(number) != invalidStyleColor is true
-PASS document.getSelection().toString() is "-1"
+PASS document.getSelection().toString() is ""
+PASS number.value is ""
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/fast/forms/number/number-unacceptable-style.html (135597 => 135598)
--- trunk/LayoutTests/fast/forms/number/number-unacceptable-style.html 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/LayoutTests/fast/forms/number/number-unacceptable-style.html 2012-11-23 13:11:46 UTC (rev 135598)
@@ -32,14 +32,17 @@
document.execCommand('InsertText', false, '-');
shouldBe('colorOf(number)', 'invalidStyleColor');
shouldBeTrue('number.validity.valid');
+shouldBeEqualToString('number.value', '');
debug("Type '1' additionally. The renderer value becomes acceptable.");
document.execCommand('InsertText', false, '1');
shouldBeTrue('colorOf(number) != invalidStyleColor');
+shouldBeEqualToString('number.value', '-1');
debug("Type 'a' additionally. The renderer value becomes unacceptable again.");
document.execCommand('InsertText', false, 'a');
shouldBe('colorOf(number)', 'invalidStyleColor');
+shouldBeEqualToString('number.value', '');
debug("The element losts focus. The unacceptable value should be purged and the style should be normal.");
document.getElementById('another').focus();
@@ -47,7 +50,8 @@
// Visiblue value is not '-1a'.
number.focus();
document.execCommand('SelectAll');
-shouldBe('document.getSelection().toString()', '"-1"');
+shouldBeEqualToString('document.getSelection().toString()', '');
+shouldBeEqualToString('number.value', '');
document.getElementById('parent').innerHTML = '';
</script>
Modified: trunk/Source/WebCore/ChangeLog (135597 => 135598)
--- trunk/Source/WebCore/ChangeLog 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/ChangeLog 2012-11-23 13:11:46 UTC (rev 135598)
@@ -1,3 +1,38 @@
+2012-11-23 Kent Tamura <[email protected]>
+
+ Correct input[type=number] value sanitization for user-input
+ https://bugs.webkit.org/show_bug.cgi?id=103018
+
+ Reviewed by Kentaro Hara.
+
+ If a number field has non-number string, HTMLInputElement::value is not
+ updated and returns the past valid value. It doesn't match to the value
+ sanitization algorithm defined by the HTML standard [1], and Opera's
+ behavior. We should sanitize non-number strings to "".
+
+ [1] http://www.whatwg.org/specs/web-apps/current-work/multipage/states-of-the-type-attribute.html#number-state-(type=number)
+ > The value sanitization algorithm is as follows: If the value of the
+ > element is not a valid floating-point number, then set it to the empty
+ > string instead.
+
+ No new tests. Update existing tests;
+ fast/forms/number/number-commit-valid-only.html and
+ fast/forms/number/number-unacceptable-style.html
+
+ * html/HTMLInputElement.cpp:
+ (WebCore::HTMLInputElement::subtreeHasChanged):
+ Remove isAcceptableValue check.
+
+ * html/HTMLInputElement.h:
+ (HTMLInputElement): isAcceptableValue is no longer needed.
+ * html/InputType.cpp: Remove isAcceptableValue.
+ * html/InputType.h: Ditto.
+ * html/NumberInputType.cpp: Ditto.
+ (WebCore::NumberInputType::hasUnacceptableValue):
+ Fold the isAcceptableValue content into this.
+ * html/NumberInputType.h:
+ (NumberInputType): Remove isAcceptableValue.
+
2012-11-23 Sheriff Bot <[email protected]>
Unreviewed, rolling out r135592.
Modified: trunk/Source/WebCore/html/HTMLInputElement.cpp (135597 => 135598)
--- trunk/Source/WebCore/html/HTMLInputElement.cpp 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/html/HTMLInputElement.cpp 2012-11-23 13:11:46 UTC (rev 135598)
@@ -555,9 +555,7 @@
// HTMLInputElement::handleBeforeTextInsertedEvent() has already called
// sanitizeUserInputValue().
// sanitizeValue() is needed because IME input doesn't dispatch BeforeTextInsertedEvent.
- String value = innerTextValue();
- if (isAcceptableValue(value))
- setValueFromRenderer(sanitizeValue(convertFromVisibleValue(value)));
+ setValueFromRenderer(sanitizeValue(convertFromVisibleValue(innerTextValue())));
updatePlaceholderVisibility(false);
// Recalc for :invalid and hasUnacceptableValue() change.
setNeedsStyleRecalc();
@@ -1411,11 +1409,6 @@
return m_inputType->convertFromVisibleValue(visibleValue);
}
-bool HTMLInputElement::isAcceptableValue(const String& proposedValue) const
-{
- return m_inputType->isAcceptableValue(proposedValue);
-}
-
String HTMLInputElement::sanitizeValue(const String& proposedValue) const
{
if (proposedValue.isNull())
Modified: trunk/Source/WebCore/html/HTMLInputElement.h (135597 => 135598)
--- trunk/Source/WebCore/html/HTMLInputElement.h 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/html/HTMLInputElement.h 2012-11-23 13:11:46 UTC (rev 135598)
@@ -164,8 +164,6 @@
// The value which is drawn by a renderer.
String visibleValue() const;
String convertFromVisibleValue(const String&) const;
- // Returns true if the specified string can be set as the value of HTMLInputElement.
- bool isAcceptableValue(const String&) const;
const String& suggestedValue() const;
void setSuggestedValue(const String&);
Modified: trunk/Source/WebCore/html/InputType.cpp (135597 => 135598)
--- trunk/Source/WebCore/html/InputType.cpp 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/html/InputType.cpp 2012-11-23 13:11:46 UTC (rev 135598)
@@ -689,11 +689,6 @@
return visibleValue;
}
-bool InputType::isAcceptableValue(const String&)
-{
- return true;
-}
-
String InputType::sanitizeValue(const String& proposedValue) const
{
return proposedValue;
Modified: trunk/Source/WebCore/html/InputType.h (135597 => 135598)
--- trunk/Source/WebCore/html/InputType.h 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/html/InputType.h 2012-11-23 13:11:46 UTC (rev 135598)
@@ -176,7 +176,6 @@
virtual String localizeValue(const String&) const;
virtual String visibleValue() const;
virtual String convertFromVisibleValue(const String&) const;
- virtual bool isAcceptableValue(const String&);
// Returing the null string means "use the default value."
// This function must be called only by HTMLInputElement::sanitizeValue().
virtual String sanitizeValue(const String&) const;
Modified: trunk/Source/WebCore/html/NumberInputType.cpp (135597 => 135598)
--- trunk/Source/WebCore/html/NumberInputType.cpp 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/html/NumberInputType.cpp 2012-11-23 13:11:46 UTC (rev 135598)
@@ -253,12 +253,6 @@
return element()->locale().convertFromLocalizedNumber(visibleValue);
}
-bool NumberInputType::isAcceptableValue(const String& proposedValue)
-{
- String standardValue = convertFromVisibleValue(proposedValue);
- return standardValue.isEmpty() || isfinite(parseToDoubleForNumberType(standardValue));
-}
-
String NumberInputType::sanitizeValue(const String& proposedValue) const
{
if (proposedValue.isEmpty())
@@ -268,7 +262,10 @@
bool NumberInputType::hasUnacceptableValue()
{
- return element()->renderer() && !isAcceptableValue(element()->innerTextValue());
+ if (!element()->renderer())
+ return false;
+ String standardValue = convertFromVisibleValue(element()->innerTextValue());
+ return !standardValue.isEmpty() && !isfinite(parseToDoubleForNumberType(standardValue));
}
bool NumberInputType::shouldRespectSpeechAttribute()
Modified: trunk/Source/WebCore/html/NumberInputType.h (135597 => 135598)
--- trunk/Source/WebCore/html/NumberInputType.h 2012-11-23 13:11:28 UTC (rev 135597)
+++ trunk/Source/WebCore/html/NumberInputType.h 2012-11-23 13:11:46 UTC (rev 135598)
@@ -57,7 +57,6 @@
virtual String localizeValue(const String&) const OVERRIDE;
virtual String visibleValue() const OVERRIDE;
virtual String convertFromVisibleValue(const String&) const OVERRIDE;
- virtual bool isAcceptableValue(const String&) OVERRIDE;
virtual String sanitizeValue(const String&) const OVERRIDE;
virtual bool hasUnacceptableValue() OVERRIDE;
virtual bool shouldRespectSpeechAttribute() OVERRIDE;
