Bug 1383780 - Avoid adding anonymous editor element into non-HTML element. r?masayuki draft
authorXidorn Quan <me@upsuper.org>
Thu, 03 Aug 2017 14:23:38 +1000
changeset 620209 957cd53e885c986c6de808cf741ae8cbed42296d
parent 620083 8f4d1916f25057f237df0ef44f00444d9f7cc88c
child 620210 a66ab3aec373debe6667081639d53354131e4d13
push id71968
push userxquan@mozilla.com
push dateThu, 03 Aug 2017 08:27:02 +0000
reviewersmasayuki
bugs1383780
milestone57.0a1
Bug 1383780 - Avoid adding anonymous editor element into non-HTML element. r?masayuki It is mainly for avoiding other anonymous element being inserted into <svg:use>, but in general we probably don't want to insert some random HTML anonymous element into a non-HTML element. MozReview-Commit-ID: J5kCUzA7K90
editor/libeditor/HTMLAnonymousNodeEditor.cpp
--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -171,16 +171,24 @@ HTMLEditor::CreateAnonymousElement(nsIAt
     return nullptr;
   }
 
   nsCOMPtr<nsIContent> parentContent = do_QueryInterface(aParentNode);
   if (NS_WARN_IF(!parentContent)) {
     return nullptr;
   }
 
+  // Don't put anonymous editor element into non-HTML element.
+  // It is mainly for avoiding other anonymous element being inserted
+  // into <svg:use>, but in general we probably don't want to insert
+  // some random HTML anonymous element into a non-HTML element.
+  if (!parentContent->IsHTMLElement()) {
+    return nullptr;
+  }
+
   nsCOMPtr<nsIDocument> doc = GetDocument();
   if (NS_WARN_IF(!doc)) {
     return nullptr;
   }
 
   // Get the pres shell
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   if (NS_WARN_IF(!ps)) {