Title: [216376] releases/WebKitGTK/webkit-2.16
Revision
216376
Author
carlo...@webkit.org
Date
2017-05-08 03:17:12 -0700 (Mon, 08 May 2017)

Log Message

Merge r215648 - Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
https://bugs.webkit.org/show_bug.cgi?id=171132
<rdar://problem/31426752>

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Re-sync web-platform-tests/domparsing from upstream.

* web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
* web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
* web-platform-tests/domparsing/createContextualFragment.html:
* web-platform-tests/domparsing/innerhtml-01.xhtml:
* web-platform-tests/domparsing/innerhtml-03.xhtml:
* web-platform-tests/domparsing/innerhtml-04.html:
* web-platform-tests/domparsing/innerhtml-05.xhtml:
* web-platform-tests/domparsing/innerhtml-06.html:
* web-platform-tests/domparsing/innerhtml-07.html:
* web-platform-tests/domparsing/insert-adjacent.html:
* web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
* web-platform-tests/domparsing/insert_adjacent_html.html:
* web-platform-tests/domparsing/outerhtml-01.html:
* web-platform-tests/domparsing/outerhtml-02.html:
* web-platform-tests/domparsing/style_attribute_html.html:
* web-platform-tests/domparsing/w3c-import.log:
* web-platform-tests/domparsing/xml-serialization.xhtml:

Source/WebCore:

Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
is called on a Node, we want XML serialization, even if the node comes from an HTML document.

[1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization

Test: fast/dom/XMLSerializer-serializeToString-entities.html

* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendAttributeValue):
(WebCore::MarkupAccumulator::appendAttribute):
* editing/MarkupAccumulator.h:

LayoutTests:

Add layout test coverage. This test is passing in both Firefox and Chrome.

* fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
* fast/dom/XMLSerializer-serializeToString-entities.html: Added.

Modified Paths

Added Paths

Diff

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/ChangeLog	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,3 +1,16 @@
+2017-04-21  Chris Dumez  <cdu...@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add layout test coverage. This test is passing in both Firefox and Chrome.
+
+        * fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
+        * fast/dom/XMLSerializer-serializeToString-entities.html: Added.
+
 2017-04-21  Per Arne Vollan  <pvol...@apple.com>
 
         Validate vImage arguments

Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt (0 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt	2017-05-08 10:17:12 UTC (rev 216376)
@@ -0,0 +1,10 @@
+Tests that XMLSerializer.serializeToString() properly encodes entities in attribute values when the Element's associated document is an HTMLDocument.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS (new XMLSerializer()).serializeToString(node) is "<test xmlns=\"http://www.w3.org/1999/xhtml\" a=\"&lt;potato/&gt;\"></test>"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

Added: releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html (0 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html	                        (rev 0)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src=""
+<script>
+description("Tests that XMLSerializer.serializeToString() properly encodes entities in attribute values when the Element's associated document is an HTMLDocument.");
+const node = document.createElement("test");
+node.setAttribute("a", "<potato/>");
+shouldBeEqualToString('(new XMLSerializer()).serializeToString(node)', '<test xmlns="http://www.w3.org/1999/xhtml" a="&lt;potato/&gt;"></test>');
+</script>
+<script src=""
+</body>
+</html>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/ChangeLog (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/ChangeLog	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/ChangeLog	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,3 +1,33 @@
+2017-04-21  Chris Dumez  <cdu...@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Re-sync web-platform-tests/domparsing from upstream.
+
+        * web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
+        * web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
+        * web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
+        * web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
+        * web-platform-tests/domparsing/createContextualFragment.html:
+        * web-platform-tests/domparsing/innerhtml-01.xhtml:
+        * web-platform-tests/domparsing/innerhtml-03.xhtml:
+        * web-platform-tests/domparsing/innerhtml-04.html:
+        * web-platform-tests/domparsing/innerhtml-05.xhtml:
+        * web-platform-tests/domparsing/innerhtml-06.html:
+        * web-platform-tests/domparsing/innerhtml-07.html:
+        * web-platform-tests/domparsing/insert-adjacent.html:
+        * web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
+        * web-platform-tests/domparsing/insert_adjacent_html.html:
+        * web-platform-tests/domparsing/outerhtml-01.html:
+        * web-platform-tests/domparsing/outerhtml-02.html:
+        * web-platform-tests/domparsing/style_attribute_html.html:
+        * web-platform-tests/domparsing/w3c-import.log:
+        * web-platform-tests/domparsing/xml-serialization.xhtml:
+
 2017-04-07  Ryan Haddad  <ryanhad...@apple.com>
 
         Rebaseline another test after r215096.

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,7 +1,7 @@
 <!doctype html>
 <title>DOMParser basic test of HTML parsing</title>
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <script>
 // |expected| should be an object indicating the expected type of node.
 function assert_node(actual, expected) {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <meta charset=utf-8>
 <title>HTML entities for various XHTML Doctype variants</title>
 <link rel=help href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <div id="log"></div>
 <script>
   test(function () {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,8 +1,8 @@
 <!DOCTYPE html>
 <title>DOMParser</title>
 <link rel="author" title="Ms2ger" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <div id="log"></div>
 <script>
 function checkMetadata(doc, contentType) {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -3,8 +3,8 @@
 <html>
  <head>
   <title>domparsing Test: XMLSerializer.serializeToString</title>
-  <script src=""
-  <script src=""
+  <script src=""
+  <script src=""
  </head>
  <body>
     <h1>domparsing_XMLSerializer_serializeToString</h1>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,8 +1,8 @@
 <!doctype html>
 <title>createContextualFragment() tests</title>
 <div id=log></div>
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <script>
 // We are not testing XML documents here, because apparently it's not clear
 // what we want to happen there.  We also aren't testing the HTML parser in any

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml	2017-05-08 10:17:12 UTC (rev 216376)
@@ -5,8 +5,8 @@
 <link rel="help" href=""
 <link rel="help" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 </head>
 <body>
 <div id="log"></div>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml	2017-05-08 10:17:12 UTC (rev 216376)
@@ -5,8 +5,8 @@
 <link rel="author" title="Ms2ger" href=""
 <link rel="help" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 </head>
 <body>
 <div id="log"></div>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <title>innerHTML in HTML</title>
 <link rel="author" title="Ms2ger" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <div id="log"></div>
 <script>
 function testIsChild(p, c) {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml	2017-05-08 10:17:12 UTC (rev 216376)
@@ -5,8 +5,8 @@
 <link rel="author" title="Ms2ger" href=""
 <link rel="help" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 </head>
 <body>
 <div id="log"></div>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <html>
 <head>
 <title>math in html: innerHTML</title>
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 </head>
 <body>
 <h1>math in html: innerHTML</h1>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <title>innerHTML and string conversion</title>
 <link rel="author" title="Ms2ger" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <div id="log"></div>
 <script>
 test(function() {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,7 +1,7 @@
 <!doctype html>
 <title>insertAdjacentHTML</title>
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <style>
 #element {
   display: none;

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,8 +1,8 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
   <title>insertAdjacentHTML in HTML</title>
-  <script src=""
-  <script src=""
+  <script src=""
+  <script src=""
   <script src=""
 </head>
 <body>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <html>
 <head>
   <title>insertAdjacentHTML in HTML</title>
-  <script src=""
-  <script src=""
+  <script src=""
+  <script src=""
   <script src=""
 </head>
 <body>

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <title>outerHTML: child of #document</title>
 <link rel="author" title="Ms2ger" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <div id="log"></div>
 <script>
 test(function() {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -2,8 +2,8 @@
 <title>outerHTML and string conversion</title>
 <link rel="author" title="Ms2ger" href=""
 <link rel="help" href=""
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <div id="log"></div>
 <script>
 test(function() {

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,8 +1,8 @@
 <!doctype html>
 <meta charset=utf-8>
 <title>Style attribute in HTML</title>
-<script src=""
-<script src=""
+<script src=""
+<script src=""
 <script>
 
 var div;

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log	2017-05-08 10:17:12 UTC (rev 216376)
@@ -16,7 +16,10 @@
 ------------------------------------------------------------------------
 List of files:
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/OWNERS
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
@@ -25,8 +28,10 @@
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.js
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
 /LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml

Modified: releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,8 +1,8 @@
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
   <title>XML serialization</title>
-  <script src=""
-  <script src=""
+  <script src=""
+  <script src=""
 </head>
 <body>
 <div id="log"></div>

Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/ChangeLog	2017-05-08 10:17:12 UTC (rev 216376)
@@ -1,3 +1,24 @@
+2017-04-21  Chris Dumez  <cdu...@apple.com>
+
+        Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+        https://bugs.webkit.org/show_bug.cgi?id=171132
+        <rdar://problem/31426752>
+
+        Reviewed by Ryosuke Niwa.
+
+        Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
+        returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
+        is called on a Node, we want XML serialization, even if the node comes from an HTML document.
+
+        [1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization
+
+        Test: fast/dom/XMLSerializer-serializeToString-entities.html
+
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::appendAttributeValue):
+        (WebCore::MarkupAccumulator::appendAttribute):
+        * editing/MarkupAccumulator.h:
+
 2017-04-21  Per Arne Vollan  <pvol...@apple.com>
 
         Validate vImage arguments

Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/MarkupAccumulator.cpp (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/MarkupAccumulator.cpp	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/MarkupAccumulator.cpp	2017-05-08 10:17:12 UTC (rev 216376)
@@ -214,10 +214,10 @@
     result.append(m_markup);
 }
 
-void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool documentIsHTML)
+void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool isSerializingHTML)
 {
     appendCharactersReplacingEntities(result, attribute, 0, attribute.length(),
-        documentIsHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
+        isSerializingHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
 }
 
 void MarkupAccumulator::appendCustomAttributes(StringBuilder&, const Element&, Namespaces*)
@@ -489,12 +489,12 @@
 
 void MarkupAccumulator::appendAttribute(StringBuilder& result, const Element& element, const Attribute& attribute, Namespaces* namespaces)
 {
-    bool documentIsHTML = element.document().isHTMLDocument();
+    bool isSerializingHTML = element.document().isHTMLDocument() && !inXMLFragmentSerialization();
 
     result.append(' ');
 
     QualifiedName prefixedName = attribute.name();
-    if (documentIsHTML && !attributeIsInSerializedNamespace(attribute))
+    if (isSerializingHTML && !attributeIsInSerializedNamespace(attribute))
         result.append(attribute.name().localName());
     else {
         if (!attribute.namespaceURI().isEmpty()) {
@@ -524,11 +524,11 @@
         appendQuotedURLAttributeValue(result, element, attribute);
     else {
         result.append('"');
-        appendAttributeValue(result, attribute.value(), documentIsHTML);
+        appendAttributeValue(result, attribute.value(), isSerializingHTML);
         result.append('"');
     }
 
-    if ((inXMLFragmentSerialization() || !documentIsHTML) && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
+    if (!isSerializingHTML && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
         appendNamespace(result, prefixedName.prefix(), prefixedName.namespaceURI(), *namespaces);
 }
 

Modified: releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/MarkupAccumulator.h (216375 => 216376)


--- releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/MarkupAccumulator.h	2017-05-08 10:11:39 UTC (rev 216375)
+++ releases/WebKitGTK/webkit-2.16/Source/WebCore/editing/MarkupAccumulator.h	2017-05-08 10:17:12 UTC (rev 216376)
@@ -92,7 +92,7 @@
     void appendStartMarkup(StringBuilder&, const Node&, Namespaces*);
     void appendEndMarkup(StringBuilder&, const Element&);
 
-    void appendAttributeValue(StringBuilder&, const String&, bool);
+    void appendAttributeValue(StringBuilder&, const String&, bool isSerializingHTML);
     void appendNamespace(StringBuilder&, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces&, bool allowEmptyDefaultNS = false);
     void appendXMLDeclaration(StringBuilder&, const Document&);
     void appendDocumentType(StringBuilder&, const DocumentType&);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to