Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick 3abc372c9c00 from chromium #26895

Merged
merged 3 commits into from Dec 11, 2020

Conversation

@nornagon
Copy link
Member

@nornagon nornagon commented Dec 8, 2020

Apply markup sanitizer in CompositeEditCommand::MoveParagraphs()

CompositeEditCommand::MoveParagraphs() serailizes part of the DOM and
then re-parse it and insert it at some other place of the document. This
is essentially a copy-and-paste, and can be exploited in the same way
how copy-and-paste is exploited. So we should also sanitize markup in
the function.

(cherry picked from commit c529cbcc1bb0f72af944c30f03c2b3b435317bc7)

Bug: 1141350
Change-Id: I25c1dfc61c20b9134b23e057c5a3a0f56c190b5c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2500633
Commit-Queue: Yoshifumi Inoue yosin@chromium.org
Reviewed-by: Yoshifumi Inoue yosin@chromium.org
Cr-Original-Commit-Position: refs/heads/master@{#821098}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2518088
Reviewed-by: Xiaocheng Hu xiaochengh@chromium.org
Commit-Queue: Xiaocheng Hu xiaochengh@chromium.org
Cr-Commit-Position: refs/branch-heads/4280@{#1099}
Cr-Branched-From: ea420fb963f9658c9969b6513c56b8f47efa1a2a-refs/heads/master@{#812852}

Notes: Security: backported fix for 1141350.

miniak
miniak approved these changes Dec 10, 2020
@codebytere codebytere merged commit a574285 into 9-x-y Dec 11, 2020
17 checks passed
Loading
@release-clerk
Copy link

@release-clerk release-clerk bot commented Dec 11, 2020

Release Notes Persisted

Security: backported fix for 1141350.

Loading

@codebytere codebytere deleted the cherry-pick/9-x-y/chromium/3abc372c9c00 branch Dec 11, 2020
belenko pushed a commit that referenced this issue Dec 14, 2020
* chore: cherry-pick 3abc372c9c00 from chromium

* resolve conflict
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants