URIs in styles created via innerHTML are not resolved against the document's base URI
Created attachment 67241 [details] Patch
Note that this only affects Chromium right now since GoogleURL canonicalizes after resolving (previously against an empty URL), while KURL leaves the partial URL alone, so it would get re-resolved correctly once the nodes were moved from the fragment's dummy document into the real document.
Adam, can you review this?
Comment on attachment 67241 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=67241&action=prettypatch > WebCore/html/parser/HTMLTreeBuilder.cpp:405 > - : m_dummyDocumentForFragmentParsing(HTMLDocument::create(0, KURL())) > + : m_dummyDocumentForFragmentParsing(HTMLDocument::create(0, fragment->document()->baseURI())) You don't want to set the URL of the dummy document to the baseURL. That's a potential security vulnerability (since the base URL can be anything the document wants). It's probably harmless right now, but it's pretty dangerous. Instead, we want set the baseURL of the m_dummyDocumentForFragmentParsing after we construct it.
Created attachment 67256 [details] Patch
(In reply to comment #4) > You don't want to set the URL of the dummy document to the baseURL. That's a potential security vulnerability (since the base URL can be anything the document wants). It's probably harmless right now, but it's pretty dangerous. Instead, we want set the baseURL of the m_dummyDocumentForFragmentParsing after we construct it. As discussed over IRC, no setter for the baseURI is exposed (and we probably don't want to have one). Added a basURI constructor parameter to (HTML)Document instead.
Comment on attachment 67256 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=67256&action=prettypatch > WebCore/html/HTMLElement.cpp:-272 > -static bool useLegacyTreeBuilder(Document*) > -{ > - return false; > -} This patch is good, but it should be separate.
Comment on attachment 67256 [details] Patch Clearing flags on attachment: 67256 Committed r67292: <http://trac.webkit.org/changeset/67292>
All reviewed patches have been landed. Closing bug.