From kde-commits Sun Jan 20 00:36:03 2008 From: Harri Porten Date: Sun, 20 Jan 2008 00:36:03 +0000 To: kde-commits Subject: branches/KDE/4.0/kdelibs/khtml/xml Message-Id: <1200789363.358839.10316.nullmailer () svn ! kde ! org> X-MARC-Message: https://marc.info/?l=kde-commits&m=120078937315735 SVN commit 763644 by porten: We missed some namespace checking in createElementNS() and createAttributeNS(). Function size is unhealthy now. M +12 -2 dom_elementimpl.h --- branches/KDE/4.0/kdelibs/khtml/xml/dom_elementimpl.h #763643:763644 @@ -380,12 +380,22 @@ } } + bool hasXMLPrefix = colonpos == 3 && (*qname)[0] == QLatin1Char('x') && + (*qname)[1] == QLatin1Char('m') && (*qname)[2] == QLatin1Char('l'); + bool hasXMLNSPrefix = colonpos == 5 && (*qname)[0] == QLatin1Char('x') && + (*qname)[1] == QLatin1Char('m') && (*qname)[2] == QLatin1Char('l') && + (*qname)[3] == QLatin1Char('n') && (*qname)[4] == QLatin1Char('s'); + if ((!qualifiedName.isNull() && Element::khtmlMalformedQualifiedName(qualifiedName)) || (colonpos >= 0 && namespaceURI.isNull()) || colonpos == 0 || // prefix has to consist of at least a letter (qualifiedName.isNull() && !namespaceURI.isNull()) || - (colonpos == 3 && qualifiedName[0] == QLatin1Char('x') && qualifiedName[1] == QLatin1Char('m') && qualifiedName[2] == QLatin1Char('l') && - namespaceURI != "http://www.w3.org/XML/1998/namespace")) { + (hasXMLPrefix && + namespaceURI != "http://www.w3.org/XML/1998/namespace") || + (hasXMLNSPrefix && + namespaceURI != "http://www.w3.org/2000/xmlns/") || + (namespaceURI == "http://www.w3.org/2000/xmlns/" && + !hasXMLNSPrefix && qualifiedName != "xmlns")) { if (pExceptioncode) *pExceptioncode = DOMException::NAMESPACE_ERR; return false;