Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-20 16:55:40 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

limit the number of columns spanned, as a protection against suspicous html code, bug 86293, r=karnaze, sr=bzbarksy

Browse Source
This commit is contained in:
bernd.mielke%snafu.de 2002-11-19 15:43:22 +00:00
parent 3d0e97ae5b
commit 72edc1148f
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
content/html/content/src/nsHTMLTableColElement.cpp
View File

@ -47,6 +47,10 @@
#include "nsIPresContext.h"
#include "nsRuleNode.h"
// use the same protection as ancient code did
// http://lxr.mozilla.org/classic/source/lib/layout/laytable.c#46
#define MAX_COLSPAN 1000
class nsHTMLTableColElement : public nsGenericHTMLContainerElement,
public nsIDOMHTMLTableColElement,
public nsIHTMLTableColElement
@ -186,7 +190,8 @@ nsHTMLTableColElement::StringToAttribute(nsIAtom* aAttribute,
}
}
else if (aAttribute == nsHTMLAtoms::span) {
if (ParseValue(aValue, 1, aResult, eHTMLUnit_Integer)) {
/* protection from unrealistic large colspan values */
if (ParseValue(aValue, 1, MAX_COLSPAN, aResult, eHTMLUnit_Integer)) {
return NS_CONTENT_ATTR_HAS_VALUE;
}
}