RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-10 11:47:35 +00:00
Code Issues Activity Actions

LibWeb: Add <input> value sanitiztion algorithm

Browse source 
The value sanitiztion algorithm is defined for some states of the type
attribute, and sanitizes the value of the 'value' attribute
This commit is contained in:
Adam Hodgen 2022-02-17 23:05:46 +00:00 • committed by Andreas Kling
parent 240068a48c
commit aa70422b4d
2 changed files with 90 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

61
Userland/Libraries/LibWeb/HTML/HTMLInputElement.cpp
View file

@ -152,11 +152,13 @@ String HTMLInputElement::value() const
void HTMLInputElement::set_value(String value) void HTMLInputElement::set_value(String value)
{ {
auto sanitised_value = value_sanitization_algorithm(move(value));
if (m_text_node) { if (m_text_node) {
m_text_node->set_data(move(value)); m_text_node->set_data(sanitised_value);
return; return;
} }
set_attribute(HTML::AttributeNames::value, move(value)); set_attribute(HTML::AttributeNames::value, sanitised_value);
} }
void HTMLInputElement::create_shadow_tree_if_needed() void HTMLInputElement::create_shadow_tree_if_needed()
@ -232,8 +234,8 @@ String HTMLInputElement::type() const
{ {
auto value = attribute(HTML::AttributeNames::type); auto value = attribute(HTML::AttributeNames::type);
#define __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(keyword) \ #define __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(keyword, _) \
if (value.equals_ignoring_case(#keyword)) \ if (value.equals_ignoring_case(#keyword)) \
return #keyword; return #keyword;
ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTES ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTES
#undef __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE #undef __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE
@ -244,9 +246,60 @@ String HTMLInputElement::type() const
return "text"; return "text";
} }
HTMLInputElement::TypeAttributeState HTMLInputElement::type_state() const
{
auto value = attribute(HTML::AttributeNames::type);
#define __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(keyword, state) \
if (value.equals_ignoring_case(#keyword)) \
return HTMLInputElement::TypeAttributeState::state;
ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTES
#undef __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE
// The missing value default and the invalid value default are the Text state.
// https://html.spec.whatwg.org/multipage/input.html#the-input-element:missing-value-default
// https://html.spec.whatwg.org/multipage/input.html#the-input-element:invalid-value-default
return HTMLInputElement::TypeAttributeState::Text;
}
void HTMLInputElement::set_type(String const& type) void HTMLInputElement::set_type(String const& type)
{ {
set_attribute(HTML::AttributeNames::type, type); set_attribute(HTML::AttributeNames::type, type);
} }
// https://html.spec.whatwg.org/multipage/input.html#value-sanitization-algorithm
String HTMLInputElement::value_sanitization_algorithm(String value) const
{
if (type_state() == HTMLInputElement::TypeAttributeState::Text || type_state() == HTMLInputElement::TypeAttributeState::Search || type_state() == HTMLInputElement::TypeAttributeState::Telephone || type_state() == HTMLInputElement::TypeAttributeState::Password) {
// Strip newlines from the value.
if (value.contains('\r') || value.contains('\n')) {
StringBuilder builder;
for (auto c : value) {
if (!(c == '\r' || c == '\n'))
builder.append(c);
}
return builder.to_string();
}
} else if (type_state() == HTMLInputElement::TypeAttributeState::URL) {
// Strip newlines from the value, then strip leading and trailing ASCII whitespace from the value.
if (value.contains('\r') || value.contains('\n')) {
StringBuilder builder;
for (auto c : value) {
if (!(c == '\r' || c == '\n'))
builder.append(c);
}
return builder.to_string().trim_whitespace();
}
} else if (type_state() == HTMLInputElement::TypeAttributeState::Number) {
// If the value of the element is not a valid floating-point number, then set it to the empty string instead.
char* end_ptr;
auto val = strtod(value.characters(), &end_ptr);
if (!isfinite(val) || *end_ptr)
return "";
}
// FIXME: Implement remaining value sanitation algorithms
return value;
}
} }

56
Userland/Libraries/LibWeb/HTML/HTMLInputElement.h
View file

@ -13,29 +13,29 @@
namespace Web::HTML { namespace Web::HTML {
// https://html.spec.whatwg.org/multipage/input.html#attr-input-type // https://html.spec.whatwg.org/multipage/input.html#attr-input-type
#define ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTES \ #define ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTES \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(hidden) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(hidden, Hidden) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(text) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(text, Text) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(search) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(search, Search) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(tel) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(tel, Telephone) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(url) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(url, URL) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(email) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(email, Email) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(password) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(password, Password) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(date) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(date, Date) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(month) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(month, Month) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(week) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(week, Week) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(time) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(time, Time) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE("datetime-local") \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE("datetime-local", LocalDateAndTime) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(number) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(number, Number) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(range) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(range, Range) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(color) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(color, Color) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(checkbox) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(checkbox, Checkbox) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(radio) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(radio, RadioButton) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(file) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(file, FileUpload) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(submit) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(submit, SubmitButton) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(image) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(image, ImageButton) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(reset) \ __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(reset, ResetButton) \
__ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(button) __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(button, Button)
class HTMLInputElement final : public FormAssociatedElement { class HTMLInputElement final : public FormAssociatedElement {
public: public:
@ -46,7 +46,14 @@ public:
virtual RefPtr<Layout::Node> create_layout_node(NonnullRefPtr<CSS::StyleProperties>) override; virtual RefPtr<Layout::Node> create_layout_node(NonnullRefPtr<CSS::StyleProperties>) override;
enum TypeAttributeState {
#define __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE(_, state) state,
ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTES
#undef __ENUMERATE_HTML_INPUT_TYPE_ATTRIBUTE
};
String type() const; String type() const;
TypeAttributeState type_state() const;
void set_type(String const&); void set_type(String const&);
String default_value() const { return attribute(HTML::AttributeNames::value); } String default_value() const { return attribute(HTML::AttributeNames::value); }
@ -90,6 +97,9 @@ private:
void create_shadow_tree_if_needed(); void create_shadow_tree_if_needed();
void run_input_activation_behavior(); void run_input_activation_behavior();
// https://html.spec.whatwg.org/multipage/input.html#value-sanitization-algorithm
String value_sanitization_algorithm(String) const;
RefPtr<DOM::Text> m_text_node; RefPtr<DOM::Text> m_text_node;
bool m_checked { false }; bool m_checked { false };