Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-09 11:25:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 414178 - Do not allow to inject a list outside of the active editing host; r=roc

Browse Source
This commit is contained in:
Ehsan Akhgari 2011-09-13 11:39:40 -04:00
parent 59938b9537
commit 501895f6d6
3 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
editor/libeditor/html/crashtests/414178-1.html Normal file
View File

@ -0,0 +1,22 @@
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function boom()
{
var table = document.createElement("table");
document.body.appendChild(table);
table.contentEditable = "true";
table.focus();
try {
// This will throw, since it's attempting to inject a list inside a table
document.execCommand("insertunorderedlist", false, null);
} catch (e) {}
}
</script>
</head>
<body onload="boom();"></body>
</html>

1
editor/libeditor/html/crashtests/crashtests.list
View File

@ -2,6 +2,7 @@ load 336081-1.xhtml
load 382778-1.html load 382778-1.html
load 407074-1.html load 407074-1.html
load 407277-1.html load 407277-1.html
load 414178-1.html
load 418923-1.html load 418923-1.html
asserts(0-16) load 420439.html # Bug 439258 asserts(0-16) load 420439.html # Bug 439258
load 428489-1.html load 428489-1.html

7
editor/libeditor/html/nsHTMLEditRules.cpp
View File

@ -7335,6 +7335,13 @@ nsHTMLEditRules::SplitAsNeeded(const nsAString *aTag,
// sniffing up the parent tree until we find // sniffing up the parent tree until we find
// a legal place for the block // a legal place for the block
if (!parent) break; if (!parent) break;
// Don't leave the active editing host
if (!mHTMLEditor->IsNodeInActiveEditor(parent)) {
nsCOMPtr<nsIContent> parentContent = do_QueryInterface(parent);
if (parentContent != mHTMLEditor->GetActiveEditingHost()) {
break;
}
}
if (mHTMLEditor->CanContainTag(parent, *aTag)) if (mHTMLEditor->CanContainTag(parent, *aTag))
{ {
tagParent = parent; tagParent = parent;