firefox/CVE-2020-26956-2.patch

# HG changeset patch
# User Henri Sivonen <hsivonen@hsivonen.fi>
# Date 1603457332 0
#      Fri Oct 23 12:48:52 2020 +0000
# Node ID b067b0d3670b37daad95505b87bddca6bb113d11
# Parent  3476387362fb15c82f133f390afef719ad36de0a
Bug 1666300 part 2 - Parse into an inert document. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D93478

diff -r 3476387362fb -r b067b0d3670b dom/base/nsContentUtils.cpp
--- a/dom/base/nsContentUtils.cpp	Fri Oct 23 12:48:49 2020 +0000
+++ b/dom/base/nsContentUtils.cpp	Fri Oct 23 12:48:52 2020 +0000
@@ -4968,17 +4968,12 @@
                                             nsAString& aResultBuffer,
                                             uint32_t aFlags,
                                             uint32_t aWrapCol) {
-  nsCOMPtr<nsIURI> uri;
-  NS_NewURI(getter_AddRefs(uri), "about:blank");
-  nsCOMPtr<nsIPrincipal> principal =
-      NullPrincipal::CreateWithoutOriginAttributes();
-  RefPtr<Document> document;
-  nsresult rv = NS_NewDOMDocument(getter_AddRefs(document), EmptyString(),
-                                  EmptyString(), nullptr, uri, uri, principal,
-                                  true, nullptr, DocumentFlavorHTML);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = nsContentUtils::ParseDocumentHTML(
+  RefPtr<Document> document = nsContentUtils::CreateInertHTMLDocument(nullptr);
+  if (!document) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsresult rv = nsContentUtils::ParseDocumentHTML(
       aSourceBuffer, document,
       !(aFlags & nsIDocumentEncoder::OutputNoScriptContent));
   NS_ENSURE_SUCCESS(rv, rv);
@@ -4994,6 +4989,58 @@
 }
 
 /* static */
+already_AddRefed<Document> nsContentUtils::CreateInertXMLDocument(
+    const Document* aTemplate) {
+  return nsContentUtils::CreateInertDocument(aTemplate, DocumentFlavorXML);
+}
+
+/* static */
+already_AddRefed<Document> nsContentUtils::CreateInertHTMLDocument(
+    const Document* aTemplate) {
+  return nsContentUtils::CreateInertDocument(aTemplate, DocumentFlavorHTML);
+}
+
+/* static */
+already_AddRefed<Document> nsContentUtils::CreateInertDocument(
+    const Document* aTemplate, DocumentFlavor aFlavor) {
+  if (aTemplate) {
+    bool hasHad = true;
+    nsIScriptGlobalObject* sgo = aTemplate->GetScriptHandlingObject(hasHad);
+    NS_ENSURE_TRUE(sgo || !hasHad, nullptr);
+
+    nsCOMPtr<Document> doc;
+    nsresult rv = NS_NewDOMDocument(
+        getter_AddRefs(doc), NS_LITERAL_STRING(""), NS_LITERAL_STRING(""), nullptr,
+        aTemplate->GetDocumentURI(), aTemplate->GetDocBaseURI(),
+        aTemplate->NodePrincipal(), true, sgo, aFlavor);
+    if (NS_FAILED(rv)) {
+      return nullptr;
+    }
+    return doc.forget();
+  }
+  nsCOMPtr<nsIURI> uri;
+  NS_NewURI(getter_AddRefs(uri), NS_LITERAL_CSTRING("about:blank"));
+  if (!uri) {
+    return nullptr;
+  }
+
+  RefPtr<NullPrincipal> nullPrincipal =
+      NullPrincipal::CreateWithoutOriginAttributes();
+  if (!nullPrincipal) {
+    return nullptr;
+  }
+
+  nsCOMPtr<Document> doc;
+  nsresult rv =
+      NS_NewDOMDocument(getter_AddRefs(doc), NS_LITERAL_STRING(""), NS_LITERAL_STRING(""), nullptr, uri, uri,
+                        nullPrincipal, true, nullptr, aFlavor);
+  if (NS_FAILED(rv)) {
+    return nullptr;
+  }
+  return doc.forget();
+}
+
+/* static */
 nsresult nsContentUtils::SetNodeTextContent(nsIContent* aContent,
                                             const nsAString& aValue,
                                             bool aTryReuse) {
diff -r 3476387362fb -r b067b0d3670b dom/base/nsContentUtils.h
--- a/dom/base/nsContentUtils.h	Fri Oct 23 12:48:49 2020 +0000
+++ b/dom/base/nsContentUtils.h	Fri Oct 23 12:48:52 2020 +0000
@@ -1831,6 +1831,25 @@
                                      uint32_t aWrapCol);
 
   /**
+   * Creates a 'loaded-as-data' HTML document that takes that principal,
+   * script global, and URL from the argument, which may be null.
+   */
+  static already_AddRefed<Document> CreateInertHTMLDocument(
+      const Document* aTemplate);
+
+  /**
+   * Creates a 'loaded-as-data' XML document that takes that principal,
+   * script global, and URL from the argument, which may be null.
+   */
+  static already_AddRefed<Document> CreateInertXMLDocument(
+      const Document* aTemplate);
+
+ private:
+  static already_AddRefed<Document> CreateInertDocument(
+      const Document* aTemplate, DocumentFlavor aFlavor);
+
+ public:
+  /**
    * Sets the text contents of a node by replacing all existing children
    * with a single text child.
    *
diff -r 3476387362fb -r b067b0d3670b editor/libeditor/HTMLEditorDataTransfer.cpp
--- a/editor/libeditor/HTMLEditorDataTransfer.cpp	Fri Oct 23 12:48:49 2020 +0000
+++ b/editor/libeditor/HTMLEditorDataTransfer.cpp	Fri Oct 23 12:48:52 2020 +0000
@@ -3039,8 +3039,13 @@
                                    bool aTrustedInput) {
   nsAutoScriptBlockerSuppressNodeRemoved autoBlocker;
 
-  RefPtr<DocumentFragment> fragment = new (aTargetDocument->NodeInfoManager())
-      DocumentFragment(aTargetDocument->NodeInfoManager());
+  nsCOMPtr<Document> doc =
+      nsContentUtils::CreateInertHTMLDocument(aTargetDocument);
+  if (!doc) {
+    return NS_ERROR_FAILURE;
+  }
+  RefPtr<DocumentFragment> fragment =
+      new (doc->NodeInfoManager()) DocumentFragment(doc->NodeInfoManager());
   nsresult rv = nsContentUtils::ParseFragmentHTML(
       aFragStr, fragment,
       aContextLocalName ? aContextLocalName : nsGkAtoms::body,
diff -r 3476387362fb -r b067b0d3670b parser/html/nsParserUtils.cpp
--- a/parser/html/nsParserUtils.cpp	Fri Oct 23 12:48:49 2020 +0000
+++ b/parser/html/nsParserUtils.cpp	Fri Oct 23 12:48:52 2020 +0000
@@ -45,17 +45,13 @@
 NS_IMETHODIMP
 nsParserUtils::Sanitize(const nsAString& aFromStr, uint32_t aFlags,
                         nsAString& aToStr) {
-  nsCOMPtr<nsIURI> uri;
-  NS_NewURI(getter_AddRefs(uri), "about:blank");
-  nsCOMPtr<nsIPrincipal> principal =
-      mozilla::NullPrincipal::CreateWithoutOriginAttributes();
-  RefPtr<Document> document;
-  nsresult rv = NS_NewDOMDocument(getter_AddRefs(document), EmptyString(),
-                                  EmptyString(), nullptr, uri, uri, principal,
-                                  true, nullptr, DocumentFlavorHTML);
-  NS_ENSURE_SUCCESS(rv, rv);
+  RefPtr<Document> document = nsContentUtils::CreateInertHTMLDocument(nullptr);
 
-  rv = nsContentUtils::ParseDocumentHTML(aFromStr, document, false);
+  if (!document) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsresult rv = nsContentUtils::ParseDocumentHTML(aFromStr, document, false);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsTreeSanitizer sanitizer(aFlags);