diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp index 0f6a512b13f..2ce0343d27e 100644 --- a/content/base/src/nsDocument.cpp +++ b/content/base/src/nsDocument.cpp @@ -2643,6 +2643,12 @@ nsDocument::CreateComment(const nsAString& aData, nsIDOMComment** aReturn) { *aReturn = nsnull; + // Make sure the substring "--" is not present in aData. Otherwise + // we'll create a document that can't be serialized. + if (FindInReadable(NS_LITERAL_STRING("--"), aData)) { + return NS_ERROR_DOM_INVALID_CHARACTER_ERR; + } + nsCOMPtr comment; nsresult rv = NS_NewCommentNode(getter_AddRefs(comment), mNodeInfoManager); @@ -2663,11 +2669,7 @@ nsDocument::CreateCDATASection(const nsAString& aData, NS_ENSURE_ARG_POINTER(aReturn); *aReturn = nsnull; - nsReadingIterator begin; - nsReadingIterator end; - aData.BeginReading(begin); - aData.EndReading(end); - if (FindInReadable(NS_LITERAL_STRING("]]>"),begin,end)) + if (FindInReadable(NS_LITERAL_STRING("]]>"), aData)) return NS_ERROR_DOM_INVALID_CHARACTER_ERR; nsCOMPtr content; @@ -2694,6 +2696,10 @@ nsDocument::CreateProcessingInstruction(const nsAString& aTarget, nsresult rv = nsContentUtils::CheckQName(aTarget, PR_FALSE); NS_ENSURE_SUCCESS(rv, rv); + if (FindInReadable(NS_LITERAL_STRING("?>"), aData)) { + return NS_ERROR_DOM_INVALID_CHARACTER_ERR; + } + nsCOMPtr content; rv = NS_NewXMLProcessingInstruction(getter_AddRefs(content), mNodeInfoManager, aTarget, aData); diff --git a/testing/mochitest/tests/index.html b/testing/mochitest/tests/index.html index a8db5a97bab..ac70cd222f5 100644 --- a/testing/mochitest/tests/index.html +++ b/testing/mochitest/tests/index.html @@ -81,6 +81,8 @@ RunSet.runall = function() { 'test_bug345521.html', 'test_bug348497.html', 'test_bug351601.html', + 'test_bug352728.html', + 'test_bug352728.xhtml', 'test_bug355026.html', 'test_bug357509.html', 'test_bug358660.html', diff --git a/testing/mochitest/tests/test_bug352728.html b/testing/mochitest/tests/test_bug352728.html new file mode 100644 index 00000000000..06354fab4cc --- /dev/null +++ b/testing/mochitest/tests/test_bug352728.html @@ -0,0 +1,125 @@ + + + + + Test for Bug 352728 + + + + + +Mozilla Bug 352728 +

+ +
+
+
+ + + diff --git a/testing/mochitest/tests/test_bug352728.xhtml b/testing/mochitest/tests/test_bug352728.xhtml new file mode 100644 index 00000000000..f6676c8af36 --- /dev/null +++ b/testing/mochitest/tests/test_bug352728.xhtml @@ -0,0 +1,195 @@ + + + + Test for Bug 352728 + + + + + +Mozilla Bug 352728 +

+ +
+
+
+
+
+
+
+
+
+
+ + +