From 19f97472eb92bee738e6f7d87000c8bce1525aa4 Mon Sep 17 00:00:00 2001 From: Psychpsyo Date: Thu, 9 Jan 2025 21:36:40 +0100 Subject: [PATCH] LibWeb: Verify element namespace in DOM::create_element() --- Libraries/LibWeb/DOM/ElementFactory.cpp | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/Libraries/LibWeb/DOM/ElementFactory.cpp b/Libraries/LibWeb/DOM/ElementFactory.cpp index 7cb9b79f692..8d3047a5e56 100644 --- a/Libraries/LibWeb/DOM/ElementFactory.cpp +++ b/Libraries/LibWeb/DOM/ElementFactory.cpp @@ -576,16 +576,18 @@ WebIDL::ExceptionOr> create_element(Document& document, FlyStri // 2. Set result to the result of constructing C, with no arguments. auto result = TRY(WebIDL::construct(constructor)); - // FIXME: 3. Assert: result’s custom element state and custom element definition are initialized. - // FIXME: 4. Assert: result’s namespace is the HTML namespace. - // Spec Note: IDL enforces that result is an HTMLElement object, which all use the HTML namespace. - // IDL does not currently convert the object for us, so we will have to do it here. - + // NOTE: IDL does not currently convert the object for us, so we will have to do it here. if (!result.has_value() || !result->is_object() || !is(result->as_object())) return vm.throw_completion(JS::ErrorType::NotAnObjectOfType, "HTMLElement"sv); GC::Ref element = verify_cast(result->as_object()); + // FIXME: 3. Assert: result’s custom element state and custom element definition are initialized. + + // 4. Assert: result’s namespace is the HTML namespace. + // Spec Note: IDL enforces that result is an HTMLElement object, which all use the HTML namespace. + VERIFY(element->namespace_uri() == Namespace::HTML); + // 5. If result’s attribute list is not empty, then throw a "NotSupportedError" DOMException. if (element->has_attributes()) return JS::throw_completion(WebIDL::NotSupportedError::create(realm, "Synchronously created custom element cannot have attributes"_string));