diff options
| author | Timothy Flynn <trflynn89@pm.me> | 2021-04-04 11:45:39 -0400 |
|---|---|---|
| committer | Andreas Kling <kling@serenityos.org> | 2021-04-04 18:30:15 +0200 |
| commit | 1380dbeef35bfb43705ebf4447eb9e4cad411840 (patch) | |
| tree | e5e307963712f416a5ef6b441ca29d08204b35c0 /Userland/Libraries/LibWeb/Layout/TextNode.cpp | |
| parent | 2199a5961438ffd8706217363b34a9b45f100728 (diff) | |
| download | serenity-1380dbeef35bfb43705ebf4447eb9e4cad411840.zip | |
LibWeb: Protect RadioButton and TextNode against mutating DOM
RadioButton had some protection, but also needed to be protected against
click events originating from its associated label.
Diffstat (limited to 'Userland/Libraries/LibWeb/Layout/TextNode.cpp')
| -rw-r--r-- | Userland/Libraries/LibWeb/Layout/TextNode.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/Userland/Libraries/LibWeb/Layout/TextNode.cpp b/Userland/Libraries/LibWeb/Layout/TextNode.cpp index cfa20a2957..8c0eb48ddc 100644 --- a/Userland/Libraries/LibWeb/Layout/TextNode.cpp +++ b/Userland/Libraries/LibWeb/Layout/TextNode.cpp @@ -324,6 +324,10 @@ void TextNode::handle_mouseup(Badge<EventHandler>, const Gfx::IntPoint& position { if (!parent() || !is<Label>(*parent())) return; + + // NOTE: Changing the state of the DOM node may run arbitrary JS, which could disappear this node. + NonnullRefPtr protect = *this; + downcast<Label>(*parent()).handle_mouseup_on_label({}, position, button); frame().event_handler().set_mouse_event_tracking_layout_node(nullptr); } |