diff --git a/third_party/blink/renderer/core/sanitizer/sanitizer.cc b/third_party/blink/renderer/core/sanitizer/sanitizer.cc index f12f2660b60d6..3cf3ee81b3c5c 100644 --- a/third_party/blink/renderer/core/sanitizer/sanitizer.cc +++ b/third_party/blink/renderer/core/sanitizer/sanitizer.cc @@ -858,26 +858,29 @@ void Sanitizer::SanitizeJavascriptNavigationAttributes(Element* element, } // Attributes that trigger navigation: + // Use Matches() (prefix-insensitive) rather than operator== so prefixed + // XHTML/SVG elements parsed via the XML parser are recognised, mirroring the + // SanitizerNameSet/Map semantics used everywhere else in the sanitizer. const QualifiedName& qname = element->TagQName(); - if (qname == html_names::kATag || qname == html_names::kAreaTag || - qname == html_names::kBaseTag) { + if (qname.Matches(html_names::kATag) || qname.Matches(html_names::kAreaTag) || + qname.Matches(html_names::kBaseTag)) { RemoveAttributeIfProtocolIsJavaScript(element, html_names::kHrefAttr); - } else if (qname == svg_names::kATag || + } else if (qname.Matches(svg_names::kATag) || element->namespaceURI() == mathml_names::kNamespaceURI) { RemoveAttributeIfProtocolIsJavaScript(element, html_names::kHrefAttr); RemoveAttributeIfProtocolIsJavaScript(element, xlink_names::kHrefAttr); - } else if (qname == html_names::kButtonTag || - qname == html_names::kInputTag) { + } else if (qname.Matches(html_names::kButtonTag) || + qname.Matches(html_names::kInputTag)) { RemoveAttributeIfProtocolIsJavaScript(element, html_names::kFormactionAttr); - } else if (qname == html_names::kFormTag) { + } else if (qname.Matches(html_names::kFormTag)) { RemoveAttributeIfProtocolIsJavaScript(element, html_names::kActionAttr); - } else if (qname == html_names::kIFrameTag) { + } else if (qname.Matches(html_names::kIFrameTag)) { RemoveAttributeIfProtocolIsJavaScript(element, html_names::kSrcAttr); // SVG animations of navigating attributes: - } else if (qname == svg_names::kAnimateTag || - qname == svg_names::kAnimateTransformTag || - qname == svg_names::kSetTag) { + } else if (qname.Matches(svg_names::kAnimateTag) || + qname.Matches(svg_names::kAnimateTransformTag) || + qname.Matches(svg_names::kSetTag)) { RemoveAttributeIfValueIsHref(element, svg_names::kAttributeNameAttr); } }