2027045 - Sanitizer: Prevent the creation of custom elements using is= (in the default config)

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Tom Schuster [PTO]]

The is "attribute" can be used to make something a custom element. The default Sanitizer config does not allow any custom tag names like <custom-element> and there was actually no intention to allow something like <div is="custom-div"> either. While we are still discussing how users should be able to opt-in or opt-out the is "attribute" with a custom config, it's pretty obvious that we should remove support for this from the default config ASAP.

Comment 1

[Tom Schuster [PTO]]

Attachment: Bug 2027045 - Sanitizer: Prevent the creation of custom elements using is= (in the default config). r?emilio

Comment 2

[Tom Schuster [PTO]]

Keith, I would love to have some feedback if this approach makes sense. Is there any other data that might need to be adjusted when removing custom elements data for an element like maybe for children or something?

Comment 3

[Keith Cirkel [:keithamus]]

Left comments in review.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/3c4908151d3c
https://hg.mozilla.org/integration/autoland/rev/c92564aaa32c
Sanitizer: Prevent the creation of custom elements using is= (in the default config). r=emilio

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/2ee80164535e
https://hg.mozilla.org/integration/autoland/rev/e43c25038272
Revert "Bug 2027045 - Sanitizer: Prevent the creation of custom elements using is= (in the default config). r=emilio" for causing build bustages @Sanitizer.cpp.

Comment 6

[agoloman]

Backed out for causing build bustages @Sanitizer.cpp.

• Backout link
• Push with failures
• Failure Log

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/c802e213bdc2
https://hg.mozilla.org/integration/autoland/rev/fd491ecef60b
Sanitizer: Prevent the creation of custom elements using is= (in the default config). r=emilio

Comment 8

[Norisz Fay [:noriszfay]]

https://hg.mozilla.org/mozilla-central/rev/fd491ecef60b

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/59183 for changes under testing/web-platform/tests

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot