Commit 882ddb97 authored by Emilio Cobos Álvarez's avatar Emilio Cobos Álvarez
Browse files

Bug 1835437 - Be consistent about value sanitization in... 

Bug 1835437 - Be consistent about value sanitization in HTMLInputElement::SetDirectionFromValue. r=smaug

aKnownValue is unsanitized, but GetValue is sanitized. Make sure they
match.

Differential Revision: https://phabricator.services.mozilla.com/D179790
parent ff9f5478

dom/html/HTMLInputElement.cpp

+16 −7
Original line number Diff line number Diff line
@@ -5698,15 +5698,24 @@ nsresult HTMLInputElement::SetDefaultValueAsValue() { 


void HTMLInputElement::SetDirectionFromValue(bool aNotify,

                                             const nsAString* aKnownValue) {

  if (IsSingleLineTextControl(true)) {

  // FIXME(emilio): https://html.spec.whatwg.org/#the-directionality says this

  // applies to Text, Search, Telephone, URL, or Email state, but the check

  // below doesn't filter out week/month/number.

  if (!IsSingleLineTextControl(true)) {

    return;

  }

  nsAutoString value;

  if (!aKnownValue) {

      GetValue(value, CallerType::System);

    // It's unclear if per spec we should use the sanitized or unsanitized

    // value to set the directionality, but aKnownValue is unsanitized, so be

    // consistent. Using what the user is seeing to determine directionality

    // instead of the sanitized (empty if invalid) value probably makes more

    // sense.

    GetValueInternal(value, CallerType::System);

    aKnownValue = &value;

  }

  SetDirectionalityFromValue(this, *aKnownValue, aNotify);

}

}



NS_IMETHODIMP

HTMLInputElement::Reset() {

testing/web-platform/tests/html/semantics/forms/the-input-element/input-type-number-rtl-invalid-crash.html

0 → 100644
+11 −0
Original line number Diff line number Diff line 
<!doctype html>

<meta charset="utf-8">

<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1835437">

<script>

window.onload = () => {

    a.stepDown(251)

    document.execCommand("delete", false, null)

}

</script>

<form lang="ar-SA">

<input id="a" type="number" autofocus dir="auto">