[Sanitizer] Check for SVG animate targets by parsing the QName. [chromium/src : main]

0 views
Skip to first unread message

Daniel Vogelheim (Gerrit)

unread,
Feb 27, 2026, 12:27:25 PM (yesterday) Feb 27
to Daniel Vogelheim, Chromium LUCI CQ, Menard, Alexis, chromium...@chromium.org, Dirk Schulze, Fredrik Söderquist, Olga Gerchikov, Stephen Chenney, blink-revie...@chromium.org, blink-...@chromium.org, fmalit...@chromium.org, kouhe...@chromium.org, pdr+svgw...@chromium.org
Attention needed from Joey Arhar

Daniel Vogelheim voted Commit-Queue+0

Commit-Queue+0
Open in Gerrit

Related details

Attention is currently required from:
  • Joey Arhar
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: Ib263b10493952775a8efa7dc66191f9bc90a0920
Gerrit-Change-Number: 7617147
Gerrit-PatchSet: 7
Gerrit-Owner: Daniel Vogelheim <voge...@chromium.org>
Gerrit-Reviewer: Daniel Vogelheim <voge...@chromium.org>
Gerrit-Reviewer: Joey Arhar <jar...@chromium.org>
Gerrit-CC: Dirk Schulze <dsch...@chromium.org>
Gerrit-CC: Fredrik Söderquist <f...@opera.com>
Gerrit-CC: Menard, Alexis <alexis...@intel.com>
Gerrit-CC: Olga Gerchikov <gerc...@microsoft.com>
Gerrit-CC: Stephen Chenney <sche...@chromium.org>
Gerrit-Attention: Joey Arhar <jar...@chromium.org>
Gerrit-Comment-Date: Fri, 27 Feb 2026 17:27:09 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Joey Arhar (Gerrit)

unread,
Feb 27, 2026, 4:22:54 PM (yesterday) Feb 27
to Daniel Vogelheim, Chromium LUCI CQ, Menard, Alexis, chromium...@chromium.org, Dirk Schulze, Fredrik Söderquist, Olga Gerchikov, Stephen Chenney, blink-revie...@chromium.org, blink-...@chromium.org, fmalit...@chromium.org, kouhe...@chromium.org, pdr+svgw...@chromium.org
Attention needed from Daniel Vogelheim

Joey Arhar voted and added 1 comment

Votes added by Joey Arhar

Code-Review+1

1 comment

File third_party/blink/renderer/core/sanitizer/sanitizer_unittest.cc
Line 19, Patchset 7 (Latest):TEST_F(SanitizerTest, Regression) {
Joey Arhar . unresolved

I think a more descriptive name would be better?

Open in Gerrit

Related details

Attention is currently required from:
  • Daniel Vogelheim
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Ib263b10493952775a8efa7dc66191f9bc90a0920
    Gerrit-Change-Number: 7617147
    Gerrit-PatchSet: 7
    Gerrit-Owner: Daniel Vogelheim <voge...@chromium.org>
    Gerrit-Reviewer: Daniel Vogelheim <voge...@chromium.org>
    Gerrit-Reviewer: Joey Arhar <jar...@chromium.org>
    Gerrit-CC: Dirk Schulze <dsch...@chromium.org>
    Gerrit-CC: Fredrik Söderquist <f...@opera.com>
    Gerrit-CC: Menard, Alexis <alexis...@intel.com>
    Gerrit-CC: Olga Gerchikov <gerc...@microsoft.com>
    Gerrit-CC: Stephen Chenney <sche...@chromium.org>
    Gerrit-Attention: Daniel Vogelheim <voge...@chromium.org>
    Gerrit-Comment-Date: Fri, 27 Feb 2026 21:22:44 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Daniel Vogelheim (Gerrit)

    unread,
    11:09 AM (10 hours ago) 11:09 AM
    to Daniel Vogelheim, Chromium LUCI CQ, Menard, Alexis, chromium...@chromium.org, Dirk Schulze, Fredrik Söderquist, Olga Gerchikov, Stephen Chenney, blink-revie...@chromium.org, blink-...@chromium.org, fmalit...@chromium.org, kouhe...@chromium.org, pdr+svgw...@chromium.org

    Daniel Vogelheim added 1 comment

    File third_party/blink/renderer/core/sanitizer/sanitizer_unittest.cc
    Line 19, Patchset 7:TEST_F(SanitizerTest, Regression) {
    Joey Arhar . resolved

    I think a more descriptive name would be better?

    Daniel Vogelheim

    Done

    Open in Gerrit

    Related details

    Attention set is empty
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: Ib263b10493952775a8efa7dc66191f9bc90a0920
      Gerrit-Change-Number: 7617147
      Gerrit-PatchSet: 8
      Gerrit-Owner: Daniel Vogelheim <voge...@chromium.org>
      Gerrit-Reviewer: Daniel Vogelheim <voge...@chromium.org>
      Gerrit-Reviewer: Joey Arhar <jar...@chromium.org>
      Gerrit-CC: Dirk Schulze <dsch...@chromium.org>
      Gerrit-CC: Fredrik Söderquist <f...@opera.com>
      Gerrit-CC: Menard, Alexis <alexis...@intel.com>
      Gerrit-CC: Olga Gerchikov <gerc...@microsoft.com>
      Gerrit-CC: Stephen Chenney <sche...@chromium.org>
      Gerrit-Comment-Date: Sat, 28 Feb 2026 16:09:16 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Joey Arhar <jar...@chromium.org>
      satisfied_requirement
      open
      diffy

      Daniel Vogelheim (Gerrit)

      unread,
      11:09 AM (10 hours ago) 11:09 AM
      to Daniel Vogelheim, Chromium LUCI CQ, Menard, Alexis, chromium...@chromium.org, Dirk Schulze, Fredrik Söderquist, Olga Gerchikov, Stephen Chenney, blink-revie...@chromium.org, blink-...@chromium.org, fmalit...@chromium.org, kouhe...@chromium.org, pdr+svgw...@chromium.org

      Daniel Vogelheim voted Commit-Queue+2

      Commit-Queue+2
      Gerrit-Comment-Date: Sat, 28 Feb 2026 16:09:22 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy

      Chromium LUCI CQ (Gerrit)

      unread,
      11:16 AM (10 hours ago) 11:16 AM
      to Daniel Vogelheim, Menard, Alexis, chromium...@chromium.org, Dirk Schulze, Fredrik Söderquist, Olga Gerchikov, Stephen Chenney, blink-revie...@chromium.org, blink-...@chromium.org, fmalit...@chromium.org, kouhe...@chromium.org, pdr+svgw...@chromium.org

      Chromium LUCI CQ submitted the change with unreviewed changes

      Unreviewed changes

      7 is the latest approved patch-set.
      The change was submitted with unreviewed changes in the following files:

      ```
      The name of the file: third_party/blink/renderer/core/sanitizer/sanitizer_unittest.cc
      Insertions: 1, Deletions: 1.

      @@ -16,7 +16,7 @@
       class SanitizerTest : public PageTestBase {};
       
       // Regression test for crbug.com/487863654.
      -TEST_F(SanitizerTest, Regression) {
      +TEST_F(SanitizerTest, SvgSetWithMultipleColons) {
         // Payload from crbug.com/487863654.
         const char* payload =
             R"X(<svg viewBox="0 0 240 80" xmlns:xlink="http://www.w3.org/1999/xlink"><a id="foo"><text x="20" y="20">click me</text></a><set href="#foo" attributeName="xlink:href:x" to="javascript:alert()"></set></svg>)X";
      ```
      ```
      The name of the file: third_party/blink/renderer/core/sanitizer/sanitizer.h
      Insertions: 1, Deletions: 1.

      @@ -129,7 +129,7 @@
         // Helper for constructors: Copy from other Sanitizer.
         void setFrom(const Sanitizer&);
       
      -  FRIEND_TEST_ALL_PREFIXES(SanitizerTest, Regression);
      +  FRIEND_TEST_ALL_PREFIXES(SanitizerTest, SvgSetWithMultipleColons);
       
        private:
         enum class SanitizerBoolWithAbsence { kAbsent, kTrue, kFalse };
      ```

      Change information

      Commit message:
      [Sanitizer] Check for SVG animate targets by parsing the QName.

      To check whether an <svg:set> (& other animate elements) targets a
      href/xlink:href attribute, we presently use a string comparison.
      That is what the spec says. This may fail, because the actual
      interpretation of that value is more complex. Instead, we properly
      parse the attribute name, just like SVGAnimateElement::ConstructQualifiedName does.
      Bug: 487863654
      Change-Id: Ib263b10493952775a8efa7dc66191f9bc90a0920
      Commit-Queue: Daniel Vogelheim <voge...@chromium.org>
      Reviewed-by: Joey Arhar <jar...@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#1592033}
      Files:
      • M third_party/blink/renderer/core/sanitizer/build.gni
      • M third_party/blink/renderer/core/sanitizer/sanitizer.cc
      • M third_party/blink/renderer/core/sanitizer/sanitizer.h
      • A third_party/blink/renderer/core/sanitizer/sanitizer_unittest.cc
      Change size: S
      Delta: 4 files changed, 43 insertions(+), 1 deletion(-)
      Branch: refs/heads/main
      Submit Requirements:
      • requirement satisfiedCode-Review: +1 by Joey Arhar
      Open in Gerrit
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: merged
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: Ib263b10493952775a8efa7dc66191f9bc90a0920
      Gerrit-Change-Number: 7617147
      Gerrit-PatchSet: 9
      Gerrit-Owner: Daniel Vogelheim <voge...@chromium.org>
      Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
      Gerrit-Reviewer: Daniel Vogelheim <voge...@chromium.org>
      Gerrit-Reviewer: Joey Arhar <jar...@chromium.org>
      open
      diffy
      satisfied_requirement
      Reply all
      Reply to author
      Forward
      0 new messages