1691621 - Bad cast introduced in bug 1690984

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Emilio Cobos Álvarez (:emilio)]

https://searchfox.org/mozilla-central/rev/7067bbd8194f4346ec59d77c33cd88f06763e090/dom/base/nsTreeSanitizer.cpp#1352 only checks for the node name, not the namespace, so if I have an <svg:template> element or something the sanitizer will get confused.

I think this might only be an issue for the "only conditional CSS" flag which TB uses, as I assume otherwise MustPrune gets rid of these?

Probably the right fix is to remove the !mOnlyConditionalCSS from before MustPrune and move it into the if, ensuring we continue.

For safety probably that cast should use HTMLTemplateElement::FromNode, or at least assert.

Comment 1

[Frederik Braun [:freddy]]

Well spotted.

Comment 2

[Frederik Braun [:freddy]]

Attachment: Bug 1691621 - fix bad cast r?emilio

Comment 3

[Frederik Braun [:freddy]]

TBH, I'm not 100% sure I understand the logic change with mOnlyConditionalCSS. My proposed patch tests for the right namespace and uses HTMLTemplateElement::FromNode instead now..

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1690984

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/396c4eb0222a
fix bad cast r=emilio

Comment 6

[Bogdan Tara[:bogdan_tara | bogdant]]

https://hg.mozilla.org/mozilla-central/rev/396c4eb0222a