← WebKit — 2026-W36

3a653d746ba1065cc85bac38902bd129bd3dd0a3  Preserve document's declarative shadow root opt-in when cloning

severity low class LogicError confidence 0.35 signal score 8.17 Source/WebCore/dom
Primitive: parserContentPolicy/securityOriginPolicy not propagated to parseHTMLUnsafe and cloned documents
Triage note: Document::parseHTMLUnsafe now sets contextDocument and securityOriginPolicy from the context, and parserContentPolicy is threaded through createCloned/serializeNode so clones retain it. Mostly correctness plumbing; the securityOriginPolicy propagation has a security flavor but no exploitable primitive is demonstrated.
Structural signals: smartptr_member_added (+4.87), area:Source/WebCore/dom (+2.0), surgical (+1.3)

Commit message

Preserve document's declarative shadow root opt-in when cloning
https://bugs.webkit.org/show_bug.cgi?id=323212

Reviewed by Ryosuke Niwa.

Per the DOM standard allow declarative shadow roots needs to survive
cloning. And per discussion Document.parseHTMLUnsafe() should not have an
opaque origin. It's already not opaque in other browsers.

Canonical link: https://commits.webkit.org/320399@main

Before / after

Loading diff…