Bug 572642 - Part 1: Allow comments, and disallow styles when pasting CF_HTML content; r=roc

content/html/document/src/nsHTMLFragmentContentSink.cpp

@@ -801,6 +801,7 @@ public:
 
   // nsIParanoidFragmentContentSink
   virtual void AllowStyles();
+  virtual void AllowComments();
 
 protected:
   nsresult NameFromType(const nsHTMLTag aTag,
@@ -814,6 +815,7 @@ protected:
   PRPackedBool mSkip; // used when we descend into <style> or <script>
   PRPackedBool mProcessStyle; // used when style is explicitly white-listed
   PRPackedBool mInStyle; // whether we're inside a style element
+  PRPackedBool mProcessComments; // used when comments are allowed
 
   // Use nsTHashTable as a hash set for our whitelists
   static nsTHashtable<nsISupportsHashKey>* sAllowedTags;
@@ -825,7 +827,7 @@ nsTHashtable<nsISupportsHashKey>* nsHTMLParanoidFragmentSink::sAllowedAttributes
 
 nsHTMLParanoidFragmentSink::nsHTMLParanoidFragmentSink(PRBool aAllContent):
   nsHTMLFragmentContentSink(aAllContent), mSkip(PR_FALSE),
-  mProcessStyle(PR_FALSE), mInStyle(PR_FALSE)
+  mProcessStyle(PR_FALSE), mInStyle(PR_FALSE), mProcessComments(PR_FALSE)
 {
 }
 
@@ -959,6 +961,12 @@ nsHTMLParanoidFragmentSink::AllowStyles()
   mProcessStyle = PR_TRUE;
 }
 
+void
+nsHTMLParanoidFragmentSink::AllowComments()
+{
+  mProcessComments = PR_TRUE;
+}
+
 // nsHTMLFragmentContentSink
 
 nsresult
@@ -1251,6 +1259,8 @@ nsHTMLParanoidFragmentSink::AddLeaf(const nsIParserNode& aNode)
 NS_IMETHODIMP
 nsHTMLParanoidFragmentSink::AddComment(const nsIParserNode& aNode)
 {
+  if (mProcessComments)
+    return nsHTMLFragmentContentSink::AddComment(aNode);
   // no comments
   return NS_OK;
 }

editor/libeditor/html/nsHTMLDataTransfer.cpp

@@ -2705,10 +2705,15 @@ nsresult nsHTMLEditor::ParseFragment(const nsAString & aFragStr,
   nsCOMPtr<nsIFragmentContentSink> fragSink(do_QueryInterface(sink));
   NS_ENSURE_TRUE(fragSink, NS_ERROR_FAILURE);
 
-  // Allow style elements and attributes
   nsCOMPtr<nsIParanoidFragmentContentSink> paranoidSink(do_QueryInterface(sink));
   NS_ASSERTION(paranoidSink, "Our content sink is paranoid");
-  paranoidSink->AllowStyles();
+  if (bContext) {
+    // Allow comemnts for the context to catch our placeholder cookie
+    paranoidSink->AllowComments();
+  } else {
+    // Allow style elements and attributes for the actual content
+    paranoidSink->AllowStyles();
+  }
 
   fragSink->SetTargetDocument(aTargetDocument);
 

parser/htmlparser/public/nsIFragmentContentSink.h

@@ -47,7 +47,7 @@ class nsIDocument;
     { 0xa4, 0xf4, 0xec, 0xbc, 0x03, 0x52, 0x9a, 0x7e } }
 
 #define NS_I_PARANOID_FRAGMENT_CONTENT_SINK_IID \
-  { 0x59ec77f5, 0x9e9b, 0x4040, \
+  { 0x69ec77f5, 0x9e9b, 0x4040, \
     { 0xbd, 0xe7, 0x4e, 0xd0, 0x13, 0xa6, 0x21, 0x74 } }
 
 /**
@@ -117,6 +117,11 @@ public:
    * Allow the content sink to accept style elements and attributes.
    */
   virtual void AllowStyles() = 0;
+
+  /**
+   * Allow the content sink to accept comments.
+   */
+  virtual void AllowComments() = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIParanoidFragmentContentSink,