Title: [274717] trunk/Source/WebCore
- Revision
- 274717
- Author
- [email protected]
- Date
- 2021-03-19 07:35:00 -0700 (Fri, 19 Mar 2021)
Log Message
CSP headers can block default <video> controls
https://bugs.webkit.org/show_bug.cgi?id=223422
<rdar://problem/41192193>
Reviewed by Antoine Quint.
Covered by existing tests.
* Modules/modern-media-controls/controls/icon-service.js:
(IconService.prototype.imageForIconAndLayoutTraits):
In order for an `<img>` to skip CSP checks it must be `isInUserAgentShadowTree` before setting `src`.
* Modules/modern-media-controls/main.js:
(createControls):
Provide the UA `shadowRoot` to the `iconService` so it can temporarily attach the `<img>`.
* dom/Element.cpp:
(WebCore::Element::addShadowRoot):
Web Inspector should be notified about new UA shadow roots before they're modified.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (274716 => 274717)
--- trunk/Source/WebCore/ChangeLog 2021-03-19 14:30:29 UTC (rev 274716)
+++ trunk/Source/WebCore/ChangeLog 2021-03-19 14:35:00 UTC (rev 274717)
@@ -1,3 +1,25 @@
+2021-03-19 Devin Rousso <[email protected]>
+
+ CSP headers can block default <video> controls
+ https://bugs.webkit.org/show_bug.cgi?id=223422
+ <rdar://problem/41192193>
+
+ Reviewed by Antoine Quint.
+
+ Covered by existing tests.
+
+ * Modules/modern-media-controls/controls/icon-service.js:
+ (IconService.prototype.imageForIconAndLayoutTraits):
+ In order for an `<img>` to skip CSP checks it must be `isInUserAgentShadowTree` before setting `src`.
+
+ * Modules/modern-media-controls/main.js:
+ (createControls):
+ Provide the UA `shadowRoot` to the `iconService` so it can temporarily attach the `<img>`.
+
+ * dom/Element.cpp:
+ (WebCore::Element::addShadowRoot):
+ Web Inspector should be notified about new UA shadow roots before they're modified.
+
2021-03-19 Commit Queue <[email protected]>
Unreviewed, reverting r274706.
Modified: trunk/Source/WebCore/Modules/modern-media-controls/controls/icon-service.js (274716 => 274717)
--- trunk/Source/WebCore/Modules/modern-media-controls/controls/icon-service.js 2021-03-19 14:30:29 UTC (rev 274716)
+++ trunk/Source/WebCore/Modules/modern-media-controls/controls/icon-service.js 2021-03-19 14:35:00 UTC (rev 274717)
@@ -82,11 +82,20 @@
image = this.images[path] = new Image;
+ // Prevent this image from being shown if it's ever attached to the DOM.
+ image.style.display = "none";
+
+ // Must attach the `<img>` to the UA shadow root before setting `src` so that `isInUserAgentShadowTree` is correct.
+ this.shadowRoot?.appendChild(image);
+
if (this.mediaControlsHost)
image.src = "" icon.type)}`;
else
image.src = ""
+ // Remove the `<img>` from the shadow root once the `src` has been set as `isInUserAgentShadowTree` has already been checked by this point.
+ image.remove();
+
return image;
}
Modified: trunk/Source/WebCore/Modules/modern-media-controls/main.js (274716 => 274717)
--- trunk/Source/WebCore/Modules/modern-media-controls/main.js 2021-03-19 14:30:29 UTC (rev 274716)
+++ trunk/Source/WebCore/Modules/modern-media-controls/main.js 2021-03-19 14:35:00 UTC (rev 274717)
@@ -34,7 +34,10 @@
{
if (host) {
mediaControlsHost = host;
+
+ iconService.shadowRoot = shadowRoot;
iconService.mediaControlsHost = host;
+
shadowRoot.appendChild(document.createElement("style")).textContent = host.shadowRootCSSText;
}
Modified: trunk/Source/WebCore/dom/Element.cpp (274716 => 274717)
--- trunk/Source/WebCore/dom/Element.cpp 2021-03-19 14:30:29 UTC (rev 274716)
+++ trunk/Source/WebCore/dom/Element.cpp 2021-03-19 14:35:00 UTC (rev 274717)
@@ -2354,13 +2354,13 @@
notifyChildNodeInserted(*this, shadowRoot);
#endif
+ InspectorInstrumentation::didPushShadowRoot(*this, shadowRoot);
+
invalidateStyleAndRenderersForSubtree();
}
if (shadowRoot.mode() == ShadowRootMode::UserAgent)
didAddUserAgentShadowRoot(shadowRoot);
-
- InspectorInstrumentation::didPushShadowRoot(*this, shadowRoot);
}
void Element::removeShadowRoot()
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
