dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWeb: Don't crash when evaluating XPath against a rootless document

Browse source 
Problem: Crash when evaluating an XPath expression against a document
that has no root element.

Cause: mirror_node()’s DOCUMENT_NODE branch unconditionally mirrored
document.document_element(). But a document may lack a root element —
in which case, document_element() returns null.

Fix: Return null from mirror_node() when the document has no root
element. (The caller already maps a null mirror result to a failed
evaluation, and raises an error in that case.)

Fixes https://github.com/LadybirdBrowser/ladybird/issues/10004
This commit is contained in:
sideshowbarker 2026-06-21 15:34:10 +09:00 committed by Jelle Raaijmakers
parent a7ce007ff4
commit 4af1b9357b
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
Libraries/LibWeb/XPath/XPath.cpp
View file

@ -92,7 +92,10 @@ static xmlNodePtr mirror_node(xmlDocPtr doc, DOM::Node const& node)
} }
case DOM::NodeType::DOCUMENT_NODE: { case DOM::NodeType::DOCUMENT_NODE: {
auto const& document = static_cast<DOM::Document const&>(node); auto const& document = static_cast<DOM::Document const&>(node);
return mirror_node(doc, *document.document_element()); auto const* document_element = document.document_element();
if (!document_element)
return nullptr;
return mirror_node(doc, *document_element);
} }
case DOM::NodeType::DOCUMENT_TYPE_NODE: { case DOM::NodeType::DOCUMENT_TYPE_NODE: {
return nullptr; // Unused in libxml2 return nullptr; // Unused in libxml2

6
Tests/LibWeb/Crash/DOM/xpath-evaluate-rootless-document.html Normal file
View file

@ -0,0 +1,6 @@
<!DOCTYPE html>
<script>
// createDocument with an empty qualified name yields a document with no root element.
const doc = document.implementation.createDocument(null, "", null);
document.evaluate("/", doc, null, XPathResult.ANY_TYPE, null);
</script>