From cfb9c5bb0e24a23b9df1b2e8040ca4193d2c79c6 Mon Sep 17 00:00:00 2001
From: MacDue <macdue@dueutil.tech>
Date: Sun, 18 Feb 2024 00:14:27 +0000
Subject: [PATCH] LibWeb: Fix checks for elements in XMLDocumentBuilder

Previously, this just checked the tag names. For elements that exist in
different namespaces (like HTMLScriptElement vs SVGScriptElement) this
could lead to invalid casts, as the namespace was not checked.

This switches to using the safer helpers on the DOM::Node.
---
 Userland/Libraries/LibWeb/XML/XMLDocumentBuilder.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Userland/Libraries/LibWeb/XML/XMLDocumentBuilder.cpp b/Userland/Libraries/LibWeb/XML/XMLDocumentBuilder.cpp
index 3d170b80bd..27788b9854 100644
--- a/Userland/Libraries/LibWeb/XML/XMLDocumentBuilder.cpp
+++ b/Userland/Libraries/LibWeb/XML/XMLDocumentBuilder.cpp
@@ -74,12 +74,12 @@ void XMLDocumentBuilder::element_start(const XML::Name& name, HashMap<XML::Name,
     // When an XML parser with XML scripting support enabled creates a script element,
     // it must have its parser document set and its "force async" flag must be unset.
     // FIXME: If the parser was created as part of the XML fragment parsing algorithm, then the element must be marked as "already started" also.
-    if (m_scripting_support == XMLScriptingSupport::Enabled && HTML::TagNames::script.to_deprecated_fly_string() == name) {
+    if (m_scripting_support == XMLScriptingSupport::Enabled && node->is_html_script_element()) {
         auto& script_element = static_cast<HTML::HTMLScriptElement&>(*node);
         script_element.set_parser_document(Badge<XMLDocumentBuilder> {}, m_document);
         script_element.set_force_async(Badge<XMLDocumentBuilder> {}, false);
     }
-    if (HTML::TagNames::template_.to_deprecated_fly_string() == m_current_node->node_name().to_deprecated_fly_string()) {
+    if (m_current_node->is_html_template_element()) {
         // When an XML parser would append a node to a template element, it must instead append it to the template element's template contents (a DocumentFragment node).
         MUST(static_cast<HTML::HTMLTemplateElement&>(*m_current_node).content()->append_child(node));
     } else {
@@ -104,7 +104,7 @@ void XMLDocumentBuilder::element_end(const XML::Name& name)
     VERIFY(m_current_node->node_name().equals_ignoring_ascii_case(name));
     // When an XML parser with XML scripting support enabled creates a script element, [...]
     // When the element's end tag is subsequently parsed,
-    if (m_scripting_support == XMLScriptingSupport::Enabled && HTML::TagNames::script.to_deprecated_fly_string() == name) {
+    if (m_scripting_support == XMLScriptingSupport::Enabled && m_current_node->is_html_script_element()) {
         // the user agent must perform a microtask checkpoint,
         HTML::perform_a_microtask_checkpoint();
         // and then prepare the script element.