Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: a3a6a4976b58db93b275c8062c9ad9295f3a0021
https://github.com/WebKit/WebKit/commit/a3a6a4976b58db93b275c8062c9ad9295f3a0021
Author: Ahmad Saleem <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/editing/pasteboard/paste-strips-svg-style-element-expected.txt
A LayoutTests/editing/pasteboard/paste-strips-svg-style-element.html
M Source/WebCore/editing/ReplaceSelectionCommand.cpp
Log Message:
-----------
Strip SVGStyleElement in ReplaceSelectionCommand
https://bugs.webkit.org/show_bug.cgi?id=318119
rdar://180944892
Reviewed by Chris Dumez.
Merge: https://chromium-review.googlesource.com/c/chromium/src/+/1931412
ReplacementFragment::removeContentsWithSideEffects() sanitizes fragments
inserted by paste, drop, and InsertHTML. It strips script elements and
HTMLStyleElement (along with base/link/meta/title), but it never checked
for SVGStyleElement, so an SVG <style> element survived sanitization and
its stylesheet could be applied to the destination document.
On Cocoa the paste path masks this because incoming markup is run through
sanitizeMarkup() first, but InsertHTML (execCommand) reaches
removeContentsWithSideEffects() directly with no other sanitizer in front
of it, leaving the loophole web-reachable.
Add SVGStyleElement to the set of elements removed by
removeContentsWithSideEffects().
Test: editing/pasteboard/paste-strips-svg-style-element.html
* LayoutTests/editing/pasteboard/paste-strips-svg-style-element-expected.txt:
Added.
* LayoutTests/editing/pasteboard/paste-strips-svg-style-element.html: Added.
* Source/WebCore/editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplacementFragment::removeContentsWithSideEffects):
Canonical link: https://commits.webkit.org/316236@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
