Skip to content

Commit 39f24fc

Browse files
Check HTMLness of <select> and <selectedcontent> in BrowserTreeBuilder
The other tree builder subclasses (DOMTreeBuilder, XOMTreeBuilder, SAXTreeBuilder) all verify that <select> and <selectedcontent> elements are in the HTML namespace before performing <option> cloning. Without that check, SVG elements with the same local names could incorrectly trigger the cloning logic.
1 parent 8ad0683 commit 39f24fc

1 file changed

Lines changed: 15 additions & 6 deletions

File tree

gwt-src/nu/validator/htmlparser/gwt/BrowserTreeBuilder.java

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -485,6 +485,11 @@ private static native String getLocalName(
485485
return node.localName;
486486
}-*/;
487487

488+
private static native String getNamespaceURI(
489+
JavaScriptObject node) /*-{
490+
return node.namespaceURI;
491+
}-*/;
492+
488493
private static native boolean hasAttribute(
489494
JavaScriptObject node, String name) /*-{
490495
return node.hasAttribute(name);
@@ -500,7 +505,9 @@ protected void optionElementPopped(JavaScriptObject option)
500505
JavaScriptObject ancestor = getParentNode(option);
501506
JavaScriptObject select = null;
502507
while (ancestor != null && getNodeType(ancestor) == 1) {
503-
if ("select".equals(getLocalName(ancestor))) {
508+
if ("select".equals(getLocalName(ancestor))
509+
&& "http://www.w3.org/1999/xhtml".equals(
510+
getNamespaceURI(ancestor))) {
504511
select = ancestor;
505512
break;
506513
}
@@ -514,8 +521,8 @@ protected void optionElementPopped(JavaScriptObject option)
514521
}
515522

516523
// Find the first <selectedcontent> descendant of <select>
517-
JavaScriptObject selectedContent = findDescendantByLocalName(
518-
select, "selectedcontent");
524+
JavaScriptObject selectedContent = findSelectedContent(
525+
select);
519526
if (selectedContent == null) {
520527
return;
521528
}
@@ -540,16 +547,18 @@ protected void optionElementPopped(JavaScriptObject option)
540547
}
541548
}
542549

543-
private JavaScriptObject findDescendantByLocalName(
544-
JavaScriptObject root, String localName) {
550+
private JavaScriptObject findSelectedContent(
551+
JavaScriptObject root) {
545552
JavaScriptObject current = getFirstChild(root);
546553
if (current == null) {
547554
return null;
548555
}
549556
JavaScriptObject next;
550557
for (;;) {
551558
if (getNodeType(current) == 1
552-
&& localName.equals(getLocalName(current))) {
559+
&& "selectedcontent".equals(getLocalName(current))
560+
&& "http://www.w3.org/1999/xhtml".equals(
561+
getNamespaceURI(current))) {
553562
return current;
554563
}
555564
if ((next = getFirstChild(current)) != null) {

0 commit comments

Comments
 (0)