From aa3d33ef4e2c992a4f955157d07831abb0d783a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
Date: Tue, 27 Nov 2018 18:02:17 +0000
Subject: [PATCH] Bug 1509989 - Make sure that CutContents doesn't remove nodes
 that isn't supposed to remove. r=mats

Depends on D13071

Differential Revision: https://phabricator.services.mozilla.com/D13072

--HG--
extra : moz-landing-system : lando
---
 dom/base/nsRange.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dom/base/nsRange.cpp b/dom/base/nsRange.cpp
index 1db4012f4ad6..290afacdfe77 100644
--- a/dom/base/nsRange.cpp
+++ b/dom/base/nsRange.cpp
@@ -1977,6 +1977,10 @@ nsRange::CutContents(DocumentFragment** aFragment)
     *aFragment = nullptr;
   }
 
+  if (!CanAccess(*mStart.Container()) || !CanAccess(*mEnd.Container())) {
+    return NS_ERROR_DOM_SECURITY_ERR;
+  }
+
   nsCOMPtr<nsIDocument> doc = mStart.Container()->OwnerDoc();
 
   ErrorResult res;