From 7097152ebc9f2e830f61085daa53d34caf89ea4f Mon Sep 17 00:00:00 2001 From: Tim Ledbetter Date: Sat, 30 Nov 2024 22:00:16 +0000 Subject: [PATCH] LibWeb: Restrict `HTMLTextAreaElement::min_length` to the range of `i32` --- Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp | 2 +- .../HTML/unsigned-long-reflection.txt | 20 ++++++++++++++++++- .../input/HTML/unsigned-long-reflection.html | 1 + 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp b/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp index 093d54ba83c..6aeb1363cc3 100644 --- a/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp +++ b/Libraries/LibWeb/HTML/HTMLTextAreaElement.cpp @@ -276,7 +276,7 @@ WebIDL::Long HTMLTextAreaElement::min_length() const { // The minLength IDL attribute must reflect the minlength content attribute, limited to only non-negative numbers. if (auto minlength_string = get_attribute(HTML::AttributeNames::minlength); minlength_string.has_value()) { - if (auto minlength = parse_non_negative_integer(*minlength_string); minlength.has_value()) + if (auto minlength = parse_non_negative_integer(*minlength_string); minlength.has_value() && *minlength <= 2147483647) return *minlength; } return -1; diff --git a/Tests/LibWeb/Text/expected/HTML/unsigned-long-reflection.txt b/Tests/LibWeb/Text/expected/HTML/unsigned-long-reflection.txt index e81fc059a4b..2e89ad73398 100644 --- a/Tests/LibWeb/Text/expected/HTML/unsigned-long-reflection.txt +++ b/Tests/LibWeb/Text/expected/HTML/unsigned-long-reflection.txt @@ -253,6 +253,24 @@ select.getAttribute("size") after select.setAttribute("size", "4294967295"): 429 select.size after select.setAttribute("size", "4294967295"): 0 select.getAttribute("size") after select.size = 4294967295: 0 select.size after select.size = 4294967295: 0 +textarea.getAttribute("maxlength") after textarea.setAttribute("maxLength", "0"): 0 +textarea.maxLength after textarea.setAttribute("maxlength", "0"): 0 +textarea.getAttribute("maxlength") after textarea.maxLength = 0: 0 +textarea.maxLength after textarea.maxLength = 0: 0 +textarea.getAttribute("maxlength") after textarea.setAttribute("maxLength", "1"): 1 +textarea.maxLength after textarea.setAttribute("maxlength", "1"): 1 +textarea.getAttribute("maxlength") after textarea.maxLength = 1: 1 +textarea.maxLength after textarea.maxLength = 1: 1 +textarea.getAttribute("maxlength") after textarea.setAttribute("maxLength", "2147483647"): 2147483647 +textarea.maxLength after textarea.setAttribute("maxlength", "2147483647"): 2147483647 +textarea.getAttribute("maxlength") after textarea.maxLength = 2147483647: 2147483647 +textarea.maxLength after textarea.maxLength = 2147483647: 2147483647 +textarea.getAttribute("maxlength") after textarea.setAttribute("maxLength", "2147483648"): 2147483648 +textarea.maxLength after textarea.setAttribute("maxlength", "2147483648"): -1 +textarea.maxLength = 2147483648 threw exception of type IndexSizeError +textarea.getAttribute("maxlength") after textarea.setAttribute("maxLength", "4294967295"): 4294967295 +textarea.maxLength after textarea.setAttribute("maxlength", "4294967295"): -1 +textarea.maxLength = 4294967295 threw exception of type IndexSizeError textarea.getAttribute("minlength") after textarea.setAttribute("minLength", "0"): 0 textarea.minLength after textarea.setAttribute("minlength", "0"): 0 textarea.getAttribute("minlength") after textarea.minLength = 0: 0 @@ -266,7 +284,7 @@ textarea.minLength after textarea.setAttribute("minlength", "2147483647"): 21474 textarea.getAttribute("minlength") after textarea.minLength = 2147483647: 2147483647 textarea.minLength after textarea.minLength = 2147483647: 2147483647 textarea.getAttribute("minlength") after textarea.setAttribute("minLength", "2147483648"): 2147483648 -textarea.minLength after textarea.setAttribute("minlength", "2147483648"): -2147483648 +textarea.minLength after textarea.setAttribute("minlength", "2147483648"): -1 textarea.minLength = 2147483648 threw exception of type IndexSizeError textarea.getAttribute("minlength") after textarea.setAttribute("minLength", "4294967295"): 4294967295 textarea.minLength after textarea.setAttribute("minlength", "4294967295"): -1 diff --git a/Tests/LibWeb/Text/input/HTML/unsigned-long-reflection.html b/Tests/LibWeb/Text/input/HTML/unsigned-long-reflection.html index 97fc9a6c185..408da7014c4 100644 --- a/Tests/LibWeb/Text/input/HTML/unsigned-long-reflection.html +++ b/Tests/LibWeb/Text/input/HTML/unsigned-long-reflection.html @@ -55,6 +55,7 @@ testProperty("marquee", "scrollAmount", (marquee) => marquee.scrollAmount, (marquee, value) => marquee.scrollAmount = value); testProperty("marquee", "scrollDelay", (marquee) => marquee.scrollDelay, (marquee, value) => marquee.scrollDelay = value); testProperty("select", "size", (select) => select.size, (select, value) => select.size = value); + testProperty("textarea", "maxLength", (textarea) => textarea.maxLength, (textarea, value) => textarea.maxLength = value); testProperty("textarea", "minLength", (textarea) => textarea.minLength, (textarea, value) => textarea.minLength = value); testProperty("textarea", "rows", (textarea) => textarea.rows, (textarea, value) => textarea.rows = value); testProperty("textarea", "cols", (textarea) => textarea.cols, (textarea, value) => textarea.cols = value);