2092436 - [wpt-sync] Sync PR 64574 - [CE] Reset inherited SVG marker properties in AdjustStyle()

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 64574 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/64574
Details from upstream follow.

Ravjit Uppal <[e-mail]> wrote:

[CE] Reset inherited SVG marker properties in AdjustStyle()

SVG marker properties (marker-start, marker-mid, marker-end) are
inherited CSS properties by default. If an ancestor sets these
properties pointing to an arbitrary \<marker> element, the internal SVG
paths of the permission element's icon can inherit them and render
attacker-controlled spoofed icon.

Explicitly reset MarkerStartResource, MarkerMidResource, and
MarkerEndResource to nullptr in
HTMLCapabilityElementBase::AdjustStyle().

Bug: 563013992
Change-Id: I8271eb953a43990b24e6b5c34eefa97f6fc49551
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8692128
Commit-Queue: Joey Arhar \<[e-mail]>
Auto-Submit: Ravjit Uppal \<[e-mail]>
Reviewed-by: Joey Arhar \<[e-mail]>
Cr-Commit-Position: refs/heads/main@{#1733193}

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/jobs?repo=try&landoInstance=lando-prod-2025&landoCommitID=119251

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 7 tests and 28 subtests

Status Summary

Firefox

OK : 5
PASS: 1[GitHub] 12[Gecko-windows11-32-25h2-debug, Gecko-windows11-32-25h2-opt] 14[Gecko-android-em-14-x86_64-debug-geckoview, Gecko-android-em-14-x86_64-lite-opt-geckoview, Gecko-android-em-14-x86_64-opt-geckoview, Gecko-linux2404-64-debug, Gecko-linux2404-64-opt, Gecko-windows11-64-25h2-debug, Gecko-windows11-64-25h2-opt]
FAIL: 22

Chrome

FAIL: 1

Safari

PASS: 1

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

• /html/semantics/permission-element/camera/camera-element-use-cases.https.html [wpt.fyi]
  • A camera element with video constraints requests camera permission and yields single video capture stream on user click: FAIL
• /html/semantics/permission-element/camera/camera-error-scenarios.https.html [wpt.fyi]
  • Denying camera permission prompt triggers oncancel event and sets NotAllowedError: FAIL
  • Untrusted click on camera element fails with InvalidStateError: FAIL
• /html/semantics/permission-element/camera/camera-set-constraints.https.html [wpt.fyi]
  • HTMLCameraElement initializes video track and never audio track: FAIL
  • HTMLCameraElement setConstraints sanitization strips complex ranges without crashing: FAIL
• /html/semantics/permission-element/camera/camera-track-attribute.https.html [wpt.fyi]
  • HTMLCameraElement has track attribute and ontrack event handler: FAIL
• /html/semantics/permission-element/camera/idlharness.window.html [wpt.fyi]
  • HTMLCameraElement interface: existence and properties of interface object: FAIL
  • HTMLCameraElement interface object length: FAIL
  • HTMLCameraElement interface object name: FAIL
  • HTMLCameraElement interface: existence and properties of interface prototype object: FAIL
  • HTMLCameraElement interface: existence and properties of interface prototype object's "constructor" property: FAIL
  • HTMLCameraElement interface: existence and properties of interface prototype object's @@unscopables property: FAIL
  • HTMLCameraElement interface: attribute track: FAIL
  • HTMLCameraElement interface: attribute error: FAIL
  • HTMLCameraElement interface: attribute ontrack: FAIL
  • HTMLCameraElement interface: attribute oncancel: FAIL
  • HTMLCameraElement interface: attribute onerror: FAIL
  • HTMLCameraElement must be primary interface of document.createElement('camera'): FAIL
  • Stringification of document.createElement('camera'): FAIL
  • HTMLCameraElement interface: document.createElement('camera') must inherit property "track" with the proper type: FAIL
  • HTMLCameraElement interface: document.createElement('camera') must inherit property "error" with the proper type: FAIL
  • HTMLCameraElement interface: document.createElement('camera') must inherit property "ontrack" with the proper type: FAIL

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/ea7e2802993b
https://hg.mozilla.org/integration/autoland/rev/47e43aba5c89
[wpt PR 64574] - [CE] Reset inherited SVG marker properties in AdjustStyle(), a=testonly

Comment 4

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/47e43aba5c89