firefox/CVE-2020-15676.patch

24 lines
936 B
Diff

# HG changeset patch
# User Kagami Sascha Rosylight <krosylight@mozilla.com>
# Date 1599489912 0
# Mon Sep 07 14:45:12 2020 +0000
# Node ID 67c242c00ce3e796dafb7e98bbbf025e29cc1c67
# Parent 749fda4e5eb11918833fa57e25adc77e4ed1db95
Bug 1646140 - Fire SVG onload only when scripting is enabled r=hsivonen
Differential Revision: https://phabricator.services.mozilla.com/D89218
diff -r 749fda4e5eb1 -r 67c242c00ce3 parser/html/nsHtml5TreeBuilderCppSupplement.h
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h Mon Sep 07 13:35:31 2020 +0000
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h Mon Sep 07 14:45:12 2020 +0000
@@ -1072,6 +1072,9 @@
}
if (aNamespace == kNameSpaceID_SVG) {
if (aName == nsGkAtoms::svg) {
+ if (!scriptingEnabled || mPreventScriptExecution) {
+ return;
+ }
if (mBuilder) {
nsHtml5TreeOperation::SvgLoad(static_cast<nsIContent*>(aElement));
return;