Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: Fix SVG crash for v0 distribution into foreignObject #18561

Merged
merged 2 commits into from Jun 4, 2019
Merged

fix: Fix SVG crash for v0 distribution into foreignObject #18561

merged 2 commits into from Jun 4, 2019

Conversation

miniak
Copy link
Contributor

@miniak miniak commented Jun 1, 2019 •
edited

Description of Change

Backport fix for https://bugs.chromium.org/p/chromium/issues/detail?id=915469
https://chromium.googlesource.com/chromium/src.git/+/032c3339bfb454c65ce38e7eafe49a54bac83073

Fix SVG crash for v0 distribution into foreignObject.

We require a parent element to be an SVG element for non-svg-root
elements in order to create a LayoutObject for them. However, we checked
the light tree parent element, not the flat tree one which is the parent
for the layout tree construction. Note that this is just an issue in
Shadow DOM v0 since v1 does not allow shadow roots on SVG elements.

/cc @electron/wg-security

Checklist

Release Notes

Notes: Backported fix for https://bugs.chromium.org/p/chromium/issues/detail?id=915469.

@miniak miniak requested a review from a team June 1, 2019 20:46
@miniak miniak self-assigned this Jun 1, 2019
@electron-cation electron-cation bot added the new-pr 🌱 PR opened in the last 24 hours label Jun 1, 2019
@miniak miniak added the 4-2-x label Jun 1, 2019
@miniak miniak changed the title fix: SVG crash for v0 distribution into foreignObject. fix: Issue 915469: Security: Type Confusion in LayoutBlockFlow::CreateLineBoxes Jun 1, 2019
@miniak miniak changed the title fix: Issue 915469: Security: Type Confusion in LayoutBlockFlow::CreateLineBoxes fix: Fix SVG crash for v0 distribution into foreignObject Jun 1, 2019
@electron-cation electron-cation bot removed the new-pr 🌱 PR opened in the last 24 hours label Jun 2, 2019
@codebytere codebytere added the backport This is a backport PR label Jun 3, 2019
@miniak miniak added backport This is a backport PR and removed backport This is a backport PR labels Jun 3, 2019
@zcbenz zcbenz merged commit 7d164b3 into 4-2-x Jun 4, 2019
@release-clerk
Copy link

release-clerk bot commented Jun 4, 2019

Release Notes Persisted

Backported fix for https://bugs.chromium.org/p/chromium/issues/detail?id=915469.

@zcbenz zcbenz deleted the miniak/fix_svg_crash_for_v0_distribution_into_foreignobject-4-2-x branch June 4, 2019 08:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nornagon nornagon nornagon approved these changes

@zcbenz zcbenz zcbenz approved these changes

Assignees

@miniak miniak

Labels
4-2-x backport This is a backport PR security 🔒
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
4 participants
@miniak @nornagon @zcbenz @codebytere