Bug 45565 – URIs in styles created via innerHTML are not resolved against the document's base URI

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Mihai Parparita]

URIs in styles created via innerHTML are not resolved against the document's base URI

[Mihai Parparita]

Created attachment 67241 [details]
Patch

[Mihai Parparita]

Note that this only affects Chromium right now since GoogleURL canonicalizes after resolving (previously against an empty URL), while KURL leaves the partial URL alone, so it would get re-resolved correctly once the nodes were moved from the fragment's dummy document into the real document.

[Mihai Parparita]

Adam, can you review this?

[Adam Barth]

Comment on attachment 67241 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=67241&action=prettypatch

> WebCore/html/parser/HTMLTreeBuilder.cpp:405
> -    : m_dummyDocumentForFragmentParsing(HTMLDocument::create(0, KURL()))
> +    : m_dummyDocumentForFragmentParsing(HTMLDocument::create(0, fragment->document()->baseURI()))
You don't want to set the URL of the dummy document to the baseURL.  That's a potential security vulnerability (since the base URL can be anything the document wants).  It's probably harmless right now, but it's pretty dangerous.  Instead, we want set the baseURL of the m_dummyDocumentForFragmentParsing after we construct it.

[Mihai Parparita]

Created attachment 67256 [details]
Patch

[Mihai Parparita]

(In reply to comment #4)
> You don't want to set the URL of the dummy document to the baseURL.  That's a potential security vulnerability (since the base URL can be anything the document wants).  It's probably harmless right now, but it's pretty dangerous.  Instead, we want set the baseURL of the m_dummyDocumentForFragmentParsing after we construct it.

As discussed over IRC, no setter for the baseURI is exposed (and we probably don't want to have one). Added a basURI constructor parameter to (HTML)Document instead.

[Adam Barth]

Comment on attachment 67256 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=67256&action=prettypatch

> WebCore/html/HTMLElement.cpp:-272
> -static bool useLegacyTreeBuilder(Document*)
> -{
> -    return false;
> -}
This patch is good, but it should be separate.

[WebKit Commit Bot]

Comment on attachment 67256 [details]
Patch

Clearing flags on attachment: 67256

Committed r67292: <http://trac.webkit.org/changeset/67292>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.