2051256 - setHTMLUnsafe: Observable difference between sanitizer and the optimized no sanitizer path

Status: ASSIGNED

(Core :: DOM: Security, defect)

Description

[Tom Schuster]

nsContentUtils::SetHTMLUnsafe has an optimization that bypasses the Sanitizer and inert document creation path: https://searchfox.org/firefox-main/rev/0c4c351481d11be32f41af409dbc59122bef80a2/dom/base/nsContentUtils.cpp#6608-6635

This optimization is observable with the following test case:

document.body.setHTMLUnsafe("<div><template shadowrootmode='open'></template></div>",  { sanitizer: {} } )
document.body.setHTMLUnsafe("<div><template shadowrootmode='open'></template></div>" )

The first invocation creates the tree: div> > <template>
The second one creates <div> with a #shadow-root.

I actually think the second one makes more sense. Otherwise it seems impossible to ever create a shadow root at all? I need to investigate where this difference comes from, but my hunch is the inert document we use for parsing in the Sanitizer case.

Comment 1

[BugBot [:suhaib / :marco]]

The severity field is not set for this bug.
:freddy, could you have a look please?

For more information, please visit BugBot documentation.

Comment 2

[Tom Schuster]

I think with the sanitize while parsing change we would not have different parser code paths anymore and this difference should go away automatically. This is probably missing a test that we should write.

Comment 3

[Tom Schuster]

There seems to be a difference on how we set aAllowDeclarativeShadowRoots for ParseFragment depending on the code path.

https://searchfox.org/firefox-main/rev/572cbc53633d3ed8a0b1390828611752f0317938/dom/base/nsContentUtils.cpp#7057
https://searchfox.org/firefox-main/rev/572cbc53633d3ed8a0b1390828611752f0317938/dom/base/nsContentUtils.cpp#7181

Comment 4

[Keith Cirkel [:keithamus]]

Attachment: Bug 2051256 - Route setHTMLUnsafe() without a sanitizer through SetAndFilterHTML r?tschuster

setHTMLUnsafe() had a separate fast path when no sanitizer was passed, and
it parsed differently from default path; the latter disallowed declarative
shadow roots, ignored the document's quirks mode.

This change deletes the fast path; SetAndFilterHTML now takes nullable sanitizer
options where null is the spec's permissive default. This "fast path" should
no longer matter now we're sanitizing while parsing.