mirror of
https://github.com/RGBCube/serenity
synced 2025-05-20 17:45:07 +00:00
LibWeb: Check if scripting is disabled before running script
This is not a full check, it's just enough to prevent script execution in DOMParser.
This commit is contained in:
parent
ce314c54bd
commit
0ea50d44bf
3 changed files with 13 additions and 1 deletions
|
@ -637,4 +637,11 @@ void Node::serialize_tree_as_json(JsonObjectSerializer<StringBuilder>& object) c
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// https://html.spec.whatwg.org/multipage/webappapis.html#concept-n-noscript
|
||||||
|
bool Node::is_scripting_disabled() const
|
||||||
|
{
|
||||||
|
// FIXME: or when scripting is disabled for its relevant settings object.
|
||||||
|
return !document().browsing_context();
|
||||||
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -163,6 +163,8 @@ public:
|
||||||
|
|
||||||
bool is_host_including_inclusive_ancestor_of(const Node&) const;
|
bool is_host_including_inclusive_ancestor_of(const Node&) const;
|
||||||
|
|
||||||
|
bool is_scripting_disabled() const;
|
||||||
|
|
||||||
// Used for dumping the DOM Tree
|
// Used for dumping the DOM Tree
|
||||||
void serialize_tree_as_json(JsonObjectSerializer<StringBuilder>&) const;
|
void serialize_tree_as_json(JsonObjectSerializer<StringBuilder>&) const;
|
||||||
|
|
||||||
|
|
|
@ -153,7 +153,10 @@ void HTMLScriptElement::prepare_script()
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
// FIXME: Check if scripting is disabled, if so return
|
if (is_scripting_disabled()) {
|
||||||
|
dbgln("HTMLScriptElement: Refusing to run script because scripting is disabled.");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
if (m_script_type == ScriptType::Classic && has_attribute(HTML::AttributeNames::nomodule)) {
|
if (m_script_type == ScriptType::Classic && has_attribute(HTML::AttributeNames::nomodule)) {
|
||||||
dbgln("HTMLScriptElement: Refusing to run classic script because it has the nomodule attribute.");
|
dbgln("HTMLScriptElement: Refusing to run classic script because it has the nomodule attribute.");
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue