Bug 1871112 - Specialize AddAttributes for <html>/<body>. r=hsivonen

Differential Revision: https://phabricator.services.mozilla.com/D201562
2024-02-14 12:55:42 +00:00 · 2024-02-14 12:55:42 +00:00 · 4b2ca116dd
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@ -393,6 +393,8 @@ nsresult nsHtml5TreeOperation::FosterParent(nsIContent* aNode,
 nsresult nsHtml5TreeOperation::AddAttributes(nsIContent* aNode,
                                             nsHtml5HtmlAttributes* aAttributes,
                                             nsHtml5DocumentBuilder* aBuilder) {
+  MOZ_ASSERT(aNode->IsAnyOfHTMLElements(nsGkAtoms::body, nsGkAtoms::html));
+
  Element* node = aNode->AsElement();
  nsHtml5OtherDocUpdate update(node->OwnerDoc(), aBuilder->GetDocument());

@ -401,7 +403,8 @@ nsresult nsHtml5TreeOperation::AddAttributes(nsIContent* aNode,
    --i;
    nsAtom* localName = aAttributes->getLocalNameNoBoundsCheck(i);
    int32_t nsuri = aAttributes->getURINoBoundsCheck(i);
-    if (!node->HasAttr(nsuri, localName)) {
+    if (!node->HasAttr(nsuri, localName) &&
+        !(nsuri == kNameSpaceID_None && localName == nsGkAtoms::nonce)) {
      nsString value;  // Not Auto, because using it to hold nsStringBuffer*
      aAttributes->getValueNoBoundsCheck(i).ToString(value);
      node->SetAttr(nsuri, localName, aAttributes->getPrefixNoBoundsCheck(i),
--- a/testing/web-platform/meta/content-security-policy/nonce-hiding/dangling-html-or-body.tentative.html.ini
+++ b/testing/web-platform/meta/content-security-policy/nonce-hiding/dangling-html-or-body.tentative.html.ini
@ -1,6 +0,0 @@
-[dangling-html-or-body.tentative.html]
-  [Nonces don't leak via CSS side-channels when a dangling body is injected.]
-    expected: FAIL
-
-  [Nonces don't leak via CSS side-channels when a dangling html is injected.]
-    expected: FAIL