mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 19:37:35 +00:00
LibWeb: Avoid UAF in query_selector{,_all}()
This fixes a bug that caused the selector to be dumped. It would relase the RefPtr into a dump function, and then use it.
This commit is contained in:
parent
86c6e68431
commit
459aa44f6b
1 changed files with 4 additions and 4 deletions
|
@ -17,11 +17,11 @@ RefPtr<Element> ParentNode::query_selector(const StringView& selector_text)
|
|||
if (!selector)
|
||||
return {};
|
||||
|
||||
dump_selector(selector.release_nonnull());
|
||||
dump_selector(*selector);
|
||||
|
||||
RefPtr<Element> result;
|
||||
for_each_in_inclusive_subtree_of_type<Element>([&](auto& element) {
|
||||
if (SelectorEngine::matches(selector.release_nonnull(), element)) {
|
||||
if (SelectorEngine::matches(*selector, element)) {
|
||||
result = element;
|
||||
return IterationDecision::Break;
|
||||
}
|
||||
|
@ -37,11 +37,11 @@ NonnullRefPtrVector<Element> ParentNode::query_selector_all(const StringView& se
|
|||
if (!selector)
|
||||
return {};
|
||||
|
||||
dump_selector(selector.release_nonnull());
|
||||
dump_selector(*selector);
|
||||
|
||||
NonnullRefPtrVector<Element> elements;
|
||||
for_each_in_inclusive_subtree_of_type<Element>([&](auto& element) {
|
||||
if (SelectorEngine::matches(selector.release_nonnull(), element)) {
|
||||
if (SelectorEngine::matches(*selector, element)) {
|
||||
elements.append(element);
|
||||
}
|
||||
return IterationDecision::Continue;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue