Changeset 197528 in webkit


Ignore:
Timestamp:
Mar 3, 2016 4:28:44 PM (8 years ago)
Author:
rniwa@webkit.org
Message:

Source/WebCore:
Disallow custom elements inside a window-less documents
​https://bugs.webkit.org/show_bug.cgi?id=154944
<rdar://problem/24944875>

Reviewed by Antti Koivisto.

Disallow custom elements inside a window-less documents such as the shared inert document of template elements
and the ones created by DOMImplementation.createDocument and DOMImplementation.createHTMLDocument.

Throw NotSupportedError in defineCustomElement when it's called in such a document as discussed in:
​https://github.com/w3c/webcomponents/issues/369

Tests: fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html

fast/custom-elements/parser/parser-uses-registry-of-owner-document.html

  • bindings/js/JSDOMBinding.cpp:

(WebCore::throwNotSupportedError): Added.

  • bindings/js/JSDOMBinding.h:
  • bindings/js/JSDocumentCustom.cpp:

(WebCore::JSDocument::defineCustomElement): Throw NotSupportedError when the context object's document doesn't
have a browsing context (i.e. window-less).

  • html/parser/HTMLDocumentParser.cpp:

(WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Replaced a FIXME with an assertion now that we
disallow instantiation of custom elements inside a template element.

LayoutTests:
Disallow custom elements inside template elements and share the registry for windowless documents
​https://bugs.webkit.org/show_bug.cgi?id=154944
<rdar://problem/24944875>

Reviewed by Antti Koivisto.

Added various tests to ensure the custom elements registry is not shared between documents with
distinct browsing context (e.g. iframes) but shared among the ones that share a single browsing context
(e.g. documents created by DOMImplementation).

Also added a test case for defineCustomElement to ensure it throws NotSupportedError when it's called on
a template element's inert owner document as well as a basic test case for document.write.

  • fast/custom-elements/Document-defineCustomElement-expected.txt:
  • fast/custom-elements/Document-defineCustomElement.html: Added a new test case.
  • fast/custom-elements/parser/parser-constructs-custom-element-in-document-write-expected.txt: Added.
  • fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html: Added.
  • fast/custom-elements/parser/parser-uses-registry-of-owner-document-expected.txt: Added.
  • fast/custom-elements/parser/parser-uses-registry-of-owner-document.html: Added.
Location:
trunk
Files:
4 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r197524 r197528  
     12016-03-02  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        Disallow custom elements inside template elements and share the registry for windowless documents
     4        https://bugs.webkit.org/show_bug.cgi?id=154944
     5        <rdar://problem/24944875>
     6
     7        Reviewed by Antti Koivisto.
     8
     9        Added various tests to ensure the custom elements registry is not shared between documents with
     10        distinct browsing context (e.g. iframes) but shared among the ones that share a single browsing context
     11        (e.g. documents created by DOMImplementation).
     12
     13        Also added a test case for defineCustomElement to ensure it throws NotSupportedError when it's called on
     14        a template element's inert owner document as well as a basic test case for document.write.
     15
     16        * fast/custom-elements/Document-defineCustomElement-expected.txt:
     17        * fast/custom-elements/Document-defineCustomElement.html: Added a new test case.
     18        * fast/custom-elements/parser/parser-constructs-custom-element-in-document-write-expected.txt: Added.
     19        * fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html: Added.
     20        * fast/custom-elements/parser/parser-uses-registry-of-owner-document-expected.txt: Added.
     21        * fast/custom-elements/parser/parser-uses-registry-of-owner-document.html: Added.
     22
    1232016-03-03  Zalan Bujtas  <zalan@apple.com>
    224

  • trunk/LayoutTests/fast/custom-elements/Document-defineCustomElement-expected.txt

    r195087 r197528  
    33PASS document.defineCustomElement should throw with an invalid name
    44PASS document.defineCustomElement should throw with a duplicate name
     5PASS document.defineCustomElement must throw a NotSupportedError when the context object is an associated inert template document
     6PASS document.defineCustomElement must throw a NotSupportedError when the context object is created by DOMImplementation.createHTMLDocument
     7PASS document.defineCustomElement must throw a NotSupportedError when the context object is created by DOMImplementation.createDocument
    58PASS document.defineCustomElement should throw when the element interface is not a constructor
    69PASS document.defineCustomElement should define an instantiatable custom element

  • trunk/LayoutTests/fast/custom-elements/Document-defineCustomElement.html

    r195087 r197528  
    5959
    6060test(function () {
     61    class SomeCustomElement extends HTMLElement {};
     62
     63    var templateContentOwnerDocument = document.createElement('template').content.ownerDocument;
     64    assert_throws({'name': 'NotSupportedError'}, function () {
     65        templateContentOwnerDocument.defineCustomElement('some-custom-element', SomeCustomElement);
     66    });
     67
     68}, 'document.defineCustomElement must throw a NotSupportedError when the context object is an associated inert template document');
     69
     70test(function () {
     71    class SomeCustomElement extends HTMLElement {};
     72
     73    var windowlessDocument = document.implementation.createHTMLDocument();
     74    assert_throws({'name': 'NotSupportedError'}, function () {
     75        windowlessDocument.defineCustomElement('some-custom-element', SomeCustomElement);
     76    });
     77
     78}, 'document.defineCustomElement must throw a NotSupportedError when the context object is created by DOMImplementation.createHTMLDocument');
     79
     80test(function () {
     81    class SomeCustomElement extends HTMLElement {};
     82
     83    var windowlessDocument = document.implementation.createDocument('http://www.w3.org/1999/xhtml', 'html', null)
     84    assert_throws({'name': 'NotSupportedError'}, function () {
     85        windowlessDocument.defineCustomElement('some-custom-element', SomeCustomElement);
     86    });
     87
     88}, 'document.defineCustomElement must throw a NotSupportedError when the context object is created by DOMImplementation.createDocument');
     89
     90test(function () {
    6191    assert_throws({'name': 'TypeError'}, function () { document.defineCustomElement('invalid-element', 1); },
    6292        'document.defineCustomElement must throw a TypeError when the element interface is a number');

  • trunk/Source/WebCore/ChangeLog

    r197527 r197528  
     12016-03-03  Ryosuke Niwa  <rniwa@webkit.org>
     2
     3        Disallow custom elements inside a window-less documents
     4        https://bugs.webkit.org/show_bug.cgi?id=154944
     5        <rdar://problem/24944875>
     6
     7        Reviewed by Antti Koivisto.
     8
     9        Disallow custom elements inside a window-less documents such as the shared inert document of template elements
     10        and the ones created by DOMImplementation.createDocument and DOMImplementation.createHTMLDocument.
     11
     12        Throw NotSupportedError in defineCustomElement when it's called in such a document as discussed in:
     13        https://github.com/w3c/webcomponents/issues/369
     14
     15        Tests: fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html
     16               fast/custom-elements/parser/parser-uses-registry-of-owner-document.html
     17
     18        * bindings/js/JSDOMBinding.cpp:
     19        (WebCore::throwNotSupportedError): Added.
     20        * bindings/js/JSDOMBinding.h:
     21        * bindings/js/JSDocumentCustom.cpp:
     22        (WebCore::JSDocument::defineCustomElement): Throw NotSupportedError when the context object's document doesn't
     23        have a browsing context (i.e. window-less).
     24        * html/parser/HTMLDocumentParser.cpp:
     25        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Replaced a FIXME with an assertion now that we
     26        disallow instantiation of custom elements inside a template element.
     27
    1282016-03-03  Alex Christensen  <achristensen@webkit.org>
    229

  • trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp

    r197353 r197528  
    636636}
    637637
     638void throwNotSupportedError(JSC::ExecState& state, const char* message)
     639{
     640    ASSERT(!state.hadException());
     641    String messageString(message);
     642    state.vm().throwException(&state, createDOMException(&state, NOT_SUPPORTED_ERR, &messageString));
     643}
     644
    638645JSC::EncodedJSValue throwArgumentMustBeEnumError(JSC::ExecState& state, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedValues)
    639646{

  • trunk/Source/WebCore/bindings/js/JSDOMBinding.h

    r197353 r197528  
    8585WEBCORE_EXPORT void reportDeprecatedSetterError(JSC::ExecState&, const char* interfaceName, const char* attributeName);
    8686
     87void throwNotSupportedError(JSC::ExecState&, const char* message);
    8788void throwArrayElementTypeError(JSC::ExecState&);
    8889void throwAttributeTypeError(JSC::ExecState&, const char* interfaceName, const char* attributeName, const char* expectedType);

  • trunk/Source/WebCore/bindings/js/JSDocumentCustom.cpp

    r195520 r197528  
    148148
    149149    Document& document = wrapped();
     150    if (!document.domWindow()) {
     151        throwNotSupportedError(state, "Cannot define a custom element in a docuemnt without a browsing context");
     152        return jsUndefined();
     153    }
     154
    150155    switch (CustomElementDefinitions::checkName(tagName)) {
    151156    case CustomElementDefinitions::NameStatus::Valid:
    … …  
    162167    auto& definitions = document.ensureCustomElementDefinitions();
    163168    if (definitions.findInterface(tagName)) {
    164         ExceptionCodeWithMessage ec;
    165         ec.code = NOT_SUPPORTED_ERR;
    166         ec.message = "Cannot define multiple custom elements with the same tag name";
    167         setDOMException(&state, ec);
     169        throwNotSupportedError(state, "Cannot define multiple custom elements with the same tag name");
    168170        return jsUndefined();
    169171    }

  • trunk/Source/WebCore/html/parser/HTMLDocumentParser.cpp

    r197463 r197528  
    197197        RefPtr<Element> newElement = constructionData->interface->constructElement(constructionData->name, JSCustomElementInterface::ShouldClearException::Clear);
    198198        if (!newElement) {
    199             // FIXME: This call to docuemnt() is wrong for elements inside a template element.
     199            ASSERT(!m_treeBuilder->isParsingTemplateContents());
    200200            newElement = HTMLUnknownElement::create(QualifiedName(nullAtom, constructionData->name, xhtmlNamespaceURI), *document());
    201201        }

  • trunk/Source/WebCore/html/parser/HTMLTreeBuilder.h

    r197463 r197528  
    6262    void constructTree(AtomicHTMLToken&);
    6363
     64    bool isParsingTemplateContents() const;
    6465    bool hasParserBlockingScriptWork() const;
    6566
    … …  
    108109    };
    109110
    110     bool isParsingTemplateContents() const;
    111111    bool isParsingFragmentOrTemplateContents() const;
    112112
Note: See TracChangeset for help on using the changeset viewer.