Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
https://bugs.webkit.org/show_bug.cgi?id=171132
<rdar://problem/31426752>
Reviewed by Ryosuke Niwa.
LayoutTests/imported/w3c:
Re-sync web-platform-tests/domparsing from upstream.
* web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
* web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
* web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
* web-platform-tests/domparsing/createContextualFragment.html:
* web-platform-tests/domparsing/innerhtml-01.xhtml:
* web-platform-tests/domparsing/innerhtml-03.xhtml:
* web-platform-tests/domparsing/innerhtml-04.html:
* web-platform-tests/domparsing/innerhtml-05.xhtml:
* web-platform-tests/domparsing/innerhtml-06.html:
* web-platform-tests/domparsing/innerhtml-07.html:
* web-platform-tests/domparsing/insert-adjacent.html:
* web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
* web-platform-tests/domparsing/insert_adjacent_html.html:
* web-platform-tests/domparsing/outerhtml-01.html:
* web-platform-tests/domparsing/outerhtml-02.html:
* web-platform-tests/domparsing/style_attribute_html.html:
* web-platform-tests/domparsing/w3c-import.log:
* web-platform-tests/domparsing/xml-serialization.xhtml:
Source/WebCore:
Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
is called on a Node, we want XML serialization, even if the node comes from an HTML document.
[1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization
Test: fast/dom/XMLSerializer-serializeToString-entities.html
* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendAttributeValue):
(WebCore::MarkupAccumulator::appendAttribute):
* editing/MarkupAccumulator.h:
LayoutTests:
Add layout test coverage. This test is passing in both Firefox and Chrome.
* fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
* fast/dom/XMLSerializer-serializeToString-entities.html: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@215648 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 21d1c17..dea40b6 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2017-04-21 Chris Dumez <cdumez@apple.com>
+
+ Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+ https://bugs.webkit.org/show_bug.cgi?id=171132
+ <rdar://problem/31426752>
+
+ Reviewed by Ryosuke Niwa.
+
+ Add layout test coverage. This test is passing in both Firefox and Chrome.
+
+ * fast/dom/XMLSerializer-serializeToString-entities-expected.txt: Added.
+ * fast/dom/XMLSerializer-serializeToString-entities.html: Added.
+
2017-04-21 Youenn Fablet <youenn@apple.com>
[ios-simulator] LayoutTest webrtc/multi-video.html is a flaky crash
diff --git a/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt
new file mode 100644
index 0000000..45ab0d4
--- /dev/null
+++ b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities-expected.txt
@@ -0,0 +1,10 @@
+Tests that XMLSerializer.serializeToString() properly encodes entities in attribute values when the Element's associated document is an HTMLDocument.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS (new XMLSerializer()).serializeToString(node) is "<test xmlns=\"http://www.w3.org/1999/xhtml\" a=\"<potato/>\"></test>"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html
new file mode 100644
index 0000000..c3ac9a1
--- /dev/null
+++ b/LayoutTests/fast/dom/XMLSerializer-serializeToString-entities.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script src="../../resources/js-test-pre.js"></script>
+<script>
+description("Tests that XMLSerializer.serializeToString() properly encodes entities in attribute values when the Element's associated document is an HTMLDocument.");
+const node = document.createElement("test");
+node.setAttribute("a", "<potato/>");
+shouldBeEqualToString('(new XMLSerializer()).serializeToString(node)', '<test xmlns="http://www.w3.org/1999/xhtml" a="<potato/>"></test>');
+</script>
+<script src="../../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/imported/w3c/ChangeLog b/LayoutTests/imported/w3c/ChangeLog
index 97c81f5..19b65de 100644
--- a/LayoutTests/imported/w3c/ChangeLog
+++ b/LayoutTests/imported/w3c/ChangeLog
@@ -1,3 +1,33 @@
+2017-04-21 Chris Dumez <cdumez@apple.com>
+
+ Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+ https://bugs.webkit.org/show_bug.cgi?id=171132
+ <rdar://problem/31426752>
+
+ Reviewed by Ryosuke Niwa.
+
+ Re-sync web-platform-tests/domparsing from upstream.
+
+ * web-platform-tests/domparsing/DOMParser-parseFromString-html.html:
+ * web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html:
+ * web-platform-tests/domparsing/DOMParser-parseFromString-xml.html:
+ * web-platform-tests/domparsing/XMLSerializer-serializeToString.html:
+ * web-platform-tests/domparsing/createContextualFragment.html:
+ * web-platform-tests/domparsing/innerhtml-01.xhtml:
+ * web-platform-tests/domparsing/innerhtml-03.xhtml:
+ * web-platform-tests/domparsing/innerhtml-04.html:
+ * web-platform-tests/domparsing/innerhtml-05.xhtml:
+ * web-platform-tests/domparsing/innerhtml-06.html:
+ * web-platform-tests/domparsing/innerhtml-07.html:
+ * web-platform-tests/domparsing/insert-adjacent.html:
+ * web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml:
+ * web-platform-tests/domparsing/insert_adjacent_html.html:
+ * web-platform-tests/domparsing/outerhtml-01.html:
+ * web-platform-tests/domparsing/outerhtml-02.html:
+ * web-platform-tests/domparsing/style_attribute_html.html:
+ * web-platform-tests/domparsing/w3c-import.log:
+ * web-platform-tests/domparsing/xml-serialization.xhtml:
+
2017-04-19 Ryan Haddad <ryanhaddad@apple.com>
Remove two tests after r215515.
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
index ec42442..3081f9a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
@@ -1,7 +1,7 @@
<!doctype html>
<title>DOMParser basic test of HTML parsing</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<script>
// |expected| should be an object indicating the expected type of node.
function assert_node(actual, expected) {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
index cd655ac..52261f2 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
@@ -2,8 +2,8 @@
<meta charset=utf-8>
<title>HTML entities for various XHTML Doctype variants</title>
<link rel=help href="http://w3c.github.io/html/xhtml.html#parsing-xhtml-documents">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<div id="log"></div>
<script>
test(function () {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
index c639c23..1090c76 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
@@ -1,8 +1,8 @@
<!DOCTYPE html>
<title>DOMParser</title>
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<div id="log"></div>
<script>
function checkMetadata(doc, contentType) {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
index 60932ee..4a7627a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
@@ -3,8 +3,8 @@
<html>
<head>
<title>domparsing Test: XMLSerializer.serializeToString</title>
- <script src="/resources/testharness.js"></script>
- <script src="/resources/testharnessreport.js"></script>
+ <script src="../../../../resources/testharness.js"></script>
+ <script src="../../../../resources/testharnessreport.js"></script>
</head>
<body>
<h1>domparsing_XMLSerializer_serializeToString</h1>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
index a885a5d..b1ac321 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
@@ -1,8 +1,8 @@
<!doctype html>
<title>createContextualFragment() tests</title>
<div id=log></div>
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
+<script src=../../../../resources/testharness.js></script>
+<script src=../../../../resources/testharnessreport.js></script>
<script>
// We are not testing XML documents here, because apparently it's not clear
// what we want to happen there. We also aren't testing the HTML parser in any
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
index 432cfbf..38da5e5 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
@@ -5,8 +5,8 @@
<link rel="help" href="https://w3c.github.io/DOM-Parsing/#widl-Element-innerHTML"/>
<link rel="help" href="http://www.whatwg.org/html5/#xml-fragment-serialization-algorithm"/>
<link rel="help" href="http://www.whatwg.org/html5/#document.title"/>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
</head>
<body>
<div id="log"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
index 313531e..c704ddd 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
@@ -5,8 +5,8 @@
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com"/>
<link rel="help" href="http://html5.org/specs/dom-parsing.html#dom-innerhtml"/>
<link rel="help" href="http://www.whatwg.org/html5/#xml-fragment-serialization-algorithm"/>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
</head>
<body>
<div id="log"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html
index 32c921d..24061bf 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-04.html
@@ -2,8 +2,8 @@
<title>innerHTML in HTML</title>
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
<link rel="help" href="https://w3c.github.io/DOM-Parsing/#widl-Element-innerHTML">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<div id="log"></div>
<script>
function testIsChild(p, c) {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml
index da2d851..10eef36 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05.xhtml
@@ -5,8 +5,8 @@
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com"/>
<link rel="help" href="http://html5.org/specs/dom-parsing.html#dom-innerhtml"/>
<link rel="help" href="http://www.whatwg.org/html5/#xml-fragment-serialization-algorithm"/>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
</head>
<body>
<div id="log"></div>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
index 81e9c57..735b032c 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
@@ -2,8 +2,8 @@
<html>
<head>
<title>math in html: innerHTML</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
</head>
<body>
<h1>math in html: innerHTML</h1>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
index 9e313a2..79ea04b 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
@@ -2,8 +2,8 @@
<title>innerHTML and string conversion</title>
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
<link rel="help" href="http://domparsing.spec.whatwg.org/#extensions-to-the-element-interface">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<div id="log"></div>
<script>
test(function() {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
index f43ec40..02cdf3a 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
@@ -1,7 +1,7 @@
<!doctype html>
<title>insertAdjacentHTML</title>
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<style>
#element {
display: none;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
index eadf10e..8e2f4af 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
@@ -1,8 +1,8 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>insertAdjacentHTML in HTML</title>
- <script src="/resources/testharness.js"></script>
- <script src="/resources/testharnessreport.js"></script>
+ <script src="../../../../resources/testharness.js"></script>
+ <script src="../../../../resources/testharnessreport.js"></script>
<script src="insert_adjacent_html.js"></script>
</head>
<body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
index dfe624f..3c4468d 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
@@ -2,8 +2,8 @@
<html>
<head>
<title>insertAdjacentHTML in HTML</title>
- <script src="/resources/testharness.js"></script>
- <script src="/resources/testharnessreport.js"></script>
+ <script src="../../../../resources/testharness.js"></script>
+ <script src="../../../../resources/testharnessreport.js"></script>
<script src="insert_adjacent_html.js"></script>
</head>
<body>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
index 2e8072e..8492232 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
@@ -2,8 +2,8 @@
<title>outerHTML: child of #document</title>
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
<link rel="help" href="http://html5.org/specs/dom-parsing.html#outerhtml">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<div id="log"></div>
<script>
test(function() {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
index 7b69fbf..abd19e3 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
@@ -2,8 +2,8 @@
<title>outerHTML and string conversion</title>
<link rel="author" title="Ms2ger" href="mailto:ms2ger@gmail.com">
<link rel="help" href="http://domparsing.spec.whatwg.org/#extensions-to-the-element-interface">
-<script src="/resources/testharness.js"></script>
-<script src="/resources/testharnessreport.js"></script>
+<script src="../../../../resources/testharness.js"></script>
+<script src="../../../../resources/testharnessreport.js"></script>
<div id="log"></div>
<script>
test(function() {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html b/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
index f7f057d..aba4f2e 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
@@ -1,8 +1,8 @@
<!doctype html>
<meta charset=utf-8>
<title>Style attribute in HTML</title>
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
+<script src=../../../../resources/testharness.js></script>
+<script src=../../../../resources/testharnessreport.js></script>
<script>
var div;
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log b/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log
index 3611552..e507a88 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/w3c-import.log
@@ -16,7 +16,10 @@
------------------------------------------------------------------------
List of files:
/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-html.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml-doctype.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/DOMParser-parseFromString-xml.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/OWNERS
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/XMLSerializer-serializeToString.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/createContextualFragment.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-01.xhtml
/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-03.xhtml
@@ -25,8 +28,10 @@
/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-06.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-07.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert-adjacent.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html-xhtml.xhtml
/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/insert_adjacent_html.js
/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-01.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/outerhtml-02.html
+/LayoutTests/imported/w3c/web-platform-tests/domparsing/style_attribute_html.html
/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
diff --git a/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml b/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
index 678523d..eac8a79 100644
--- a/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
+++ b/LayoutTests/imported/w3c/web-platform-tests/domparsing/xml-serialization.xhtml
@@ -1,8 +1,8 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>XML serialization</title>
- <script src="/resources/testharness.js"></script>
- <script src="/resources/testharnessreport.js"></script>
+ <script src="../../../../resources/testharness.js"></script>
+ <script src="../../../../resources/testharnessreport.js"></script>
</head>
<body>
<div id="log"></div>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index be2f33d..ace8c3d 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,24 @@
+2017-04-21 Chris Dumez <cdumez@apple.com>
+
+ Regression(r206240): XMLSerializer.serializeToString() does not properly escape '<' / '>' in attribute values
+ https://bugs.webkit.org/show_bug.cgi?id=171132
+ <rdar://problem/31426752>
+
+ Reviewed by Ryosuke Niwa.
+
+ Use XMLSerialization [1] in MarkupAccumulator::appendAttribute() when inXMLFragmentSerialization()
+ returns true, even if the node's associated document is an HTML document. When XMLSerializer.serializeToString()
+ is called on a Node, we want XML serialization, even if the node comes from an HTML document.
+
+ [1] https://w3c.github.io/DOM-Parsing/#dfn-xml-serialization
+
+ Test: fast/dom/XMLSerializer-serializeToString-entities.html
+
+ * editing/MarkupAccumulator.cpp:
+ (WebCore::MarkupAccumulator::appendAttributeValue):
+ (WebCore::MarkupAccumulator::appendAttribute):
+ * editing/MarkupAccumulator.h:
+
2017-04-20 Sam Weinig <sam@webkit.org>
Split cryptographic digest computation and parsing out of CSP code so it can be reused
diff --git a/Source/WebCore/editing/MarkupAccumulator.cpp b/Source/WebCore/editing/MarkupAccumulator.cpp
index efc4517..d3bb0af 100644
--- a/Source/WebCore/editing/MarkupAccumulator.cpp
+++ b/Source/WebCore/editing/MarkupAccumulator.cpp
@@ -214,10 +214,10 @@
result.append(m_markup);
}
-void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool documentIsHTML)
+void MarkupAccumulator::appendAttributeValue(StringBuilder& result, const String& attribute, bool isSerializingHTML)
{
appendCharactersReplacingEntities(result, attribute, 0, attribute.length(),
- documentIsHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
+ isSerializingHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
}
void MarkupAccumulator::appendCustomAttributes(StringBuilder&, const Element&, Namespaces*)
@@ -489,12 +489,12 @@
void MarkupAccumulator::appendAttribute(StringBuilder& result, const Element& element, const Attribute& attribute, Namespaces* namespaces)
{
- bool documentIsHTML = element.document().isHTMLDocument();
+ bool isSerializingHTML = element.document().isHTMLDocument() && !inXMLFragmentSerialization();
result.append(' ');
QualifiedName prefixedName = attribute.name();
- if (documentIsHTML && !attributeIsInSerializedNamespace(attribute))
+ if (isSerializingHTML && !attributeIsInSerializedNamespace(attribute))
result.append(attribute.name().localName());
else {
if (!attribute.namespaceURI().isEmpty()) {
@@ -524,11 +524,11 @@
appendQuotedURLAttributeValue(result, element, attribute);
else {
result.append('"');
- appendAttributeValue(result, attribute.value(), documentIsHTML);
+ appendAttributeValue(result, attribute.value(), isSerializingHTML);
result.append('"');
}
- if ((inXMLFragmentSerialization() || !documentIsHTML) && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
+ if (!isSerializingHTML && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
appendNamespace(result, prefixedName.prefix(), prefixedName.namespaceURI(), *namespaces);
}
diff --git a/Source/WebCore/editing/MarkupAccumulator.h b/Source/WebCore/editing/MarkupAccumulator.h
index 7f78b88..38b73c6 100644
--- a/Source/WebCore/editing/MarkupAccumulator.h
+++ b/Source/WebCore/editing/MarkupAccumulator.h
@@ -92,7 +92,7 @@
void appendStartMarkup(StringBuilder&, const Node&, Namespaces*);
void appendEndMarkup(StringBuilder&, const Element&);
- void appendAttributeValue(StringBuilder&, const String&, bool);
+ void appendAttributeValue(StringBuilder&, const String&, bool isSerializingHTML);
void appendNamespace(StringBuilder&, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces&, bool allowEmptyDefaultNS = false);
void appendXMLDeclaration(StringBuilder&, const Document&);
void appendDocumentType(StringBuilder&, const DocumentType&);
