mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-06-15 06:41:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb/SVG: Respect script element type attribute

Browse source 
Previously, scripts would run regardless of the value of this attribute.
This commit is contained in:
Tim Ledbetter 2025-02-26 12:53:43 +00:00 • committed by Jelle Raaijmakers
parent f4c4d3c780
commit d114f13029
Notes: github-actions[bot] 2025-02-26 15:09:48 +00:00
5 changed files with 654 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Libraries/LibWeb/SVG/SVGScriptElement.cpp
View file

@ -38,7 +38,7 @@ void SVGScriptElement::visit_edges(Cell::Visitor& visitor)
void SVGScriptElement::attribute_changed(FlyString const& name, Optional<String> const& old_value, Optional<String> const& value, Optional<FlyString> const& namespace_)
{
Base::attribute_changed(name, old_value, value, namespace_);
if (name == SVG::AttributeNames::href) {
if (name == SVG::AttributeNames::href || name == SVG::AttributeNames::type) {
process_the_script_element();
}
}
@ -69,6 +69,19 @@ void SVGScriptElement::process_the_script_element()
if (m_already_processed || !in_a_document_tree())
return;
// https://svgwg.org/svg2-draft/interact.html#ScriptElement
// Before attempting to execute the ‘script’ element the resolved media type value for ‘type’ must be inspected.
// If the SVG user agent does not support the scripting language then the ‘script’ element must not be executed.
// FIXME: Support type="module" scripts
auto maybe_script_type = attribute(SVG::AttributeNames::type);
if (maybe_script_type.has_value() && !maybe_script_type->is_empty()) {
auto script_type = MUST(maybe_script_type->to_ascii_lowercase().trim_ascii_whitespace());
if (!MimeSniff::is_javascript_mime_type_essence_match(script_type)) {
dbgln("SVGScriptElement: Unsupported script type: {}", *maybe_script_type);
return;
}
}
IGNORE_USE_IN_ESCAPING_LAMBDA String script_content;
auto script_url = m_document->url();