Do not parse or scroll to text fragments in iframe URLs.

https://bugs.webkit.org/show_bug.cgi?id=244661 rdar://99202126 Reviewed by Tim Horton. Since we are unsure of all the security implications, do not search of text fragments in iFrame URLs. * LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/no-iframe-match-expected.html: Added. * LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/no-iframe-match.html: Added. * LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/resources/iframe-scroll-to-text-fragment.html: Added. * Source/WebCore/page/FrameView.cpp: (WebCore::FrameView::scrollToFragment): Canonical link: https://commits.webkit.org/254073@main
WebKit · Sep 1, 2022 · 9a232d5a670960a3549444d5b8922b8dcd893f93 · 9a232d5
1 parent 7d37933
commit 9a232d5a670960a3549444d5b8922b8dcd893f93
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 1 deletion.
diff --git a/LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/no-iframe-match-expected.html b/LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/no-iframe-match-expected.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html><!-- webkit-test-runner [ ScrollToTextFragmentIndicatorEnabled=false ] -->
+<meta charset="utf-8" />
+<title>Scroll to text fragment - highlight simple start text</title>
+<link rel="help" href="https://wicg.github.io/scroll-to-text-fragment/">
+<meta name="assert" content="This test checks that a fragment directive with start text is correctly highlighted.">
+<link rel="match" href="scroll-to-text-fragment-start-expected.html">
+
+<p>The test passes if there is no highlight in the following iframe.</p>
+<iframe width="400px" height="100px" src="../resources/iframe-scroll-to-text-fragment.html"></iframe>
+
+</html>
diff --git a/LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/no-iframe-match.html b/LayoutTests/http/wpt/html/dom/scroll-to-text-fragment/no-iframe-match.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html><!-- webkit-test-runner [ ScrollToTextFragmentIndicatorEnabled=false ] -->
+<meta charset="utf-8" />
+<title>Scroll to text fragment - highlight simple start text</title>
+<link rel="help" href="https://wicg.github.io/scroll-to-text-fragment/">
+<meta name="assert" content="This test checks that a fragment directive with start text is correctly highlighted.">
+<link rel="match" href="scroll-to-text-fragment-start-expected.html">
+
+<p>The test passes if there is no highlight in the following iframe.</p>
+<iframe width="400px" height="100px" src="../resources/iframe-scroll-to-text-fragment.html#:~:text=Example"></iframe>
+
+<script>
+  location.href = "#:~:text=Example";
+</script>
+</html>
diff --git a/...s/http/wpt/html/dom/scroll-to-text-fragment/resources/iframe-scroll-to-text-fragment.html b/...s/http/wpt/html/dom/scroll-to-text-fragment/resources/iframe-scroll-to-text-fragment.html
@@ -0,0 +1 @@
+Example
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
@@ -2221,7 +2221,7 @@ bool FrameView::scrollToFragment(const URL& url)
     auto fragmentIdentifier = url.fragmentIdentifier();
     auto fragmentDirective = document->fragmentDirective();
 
-    if (document->settings().scrollToTextFragmentEnabled() && !fragmentDirective.isEmpty()) {
+    if (frame().isMainFrame() && document->settings().scrollToTextFragmentEnabled() && !fragmentDirective.isEmpty()) {
         FragmentDirectiveParser fragmentDirectiveParser(fragmentDirective);
 
         if (fragmentDirectiveParser.isValid()) {