diff options
| author | Timothy Flynn <trflynn89@pm.me> | 2021-04-04 11:45:39 -0400 |
|---|---|---|
| committer | Andreas Kling <kling@serenityos.org> | 2021-04-04 18:30:15 +0200 |
| commit | 1380dbeef35bfb43705ebf4447eb9e4cad411840 (patch) | |
| tree | e5e307963712f416a5ef6b441ca29d08204b35c0 /Userland/Libraries/LibWeb/Layout/RadioButton.cpp | |
| parent | 2199a5961438ffd8706217363b34a9b45f100728 (diff) | |
| download | serenity-1380dbeef35bfb43705ebf4447eb9e4cad411840.zip | |
LibWeb: Protect RadioButton and TextNode against mutating DOM
RadioButton had some protection, but also needed to be protected against
click events originating from its associated label.
Diffstat (limited to 'Userland/Libraries/LibWeb/Layout/RadioButton.cpp')
| -rw-r--r-- | Userland/Libraries/LibWeb/Layout/RadioButton.cpp | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/Userland/Libraries/LibWeb/Layout/RadioButton.cpp b/Userland/Libraries/LibWeb/Layout/RadioButton.cpp index 1574c86096..f20b5b338e 100644 --- a/Userland/Libraries/LibWeb/Layout/RadioButton.cpp +++ b/Userland/Libraries/LibWeb/Layout/RadioButton.cpp @@ -115,6 +115,9 @@ void RadioButton::handle_associated_label_mousedown(Badge<Label>) void RadioButton::handle_associated_label_mouseup(Badge<Label>) { + // NOTE: Changing the checked state of the DOM node may run arbitrary JS, which could disappear this node. + NonnullRefPtr protect = *this; + set_checked_within_group(); m_being_pressed = false; } |