ladybird/Tests/LibWeb/Ref/input/svg-as-img-with-script.html at f05bc7c0cd31d8a119bef052d531ac7c68e2e039 - ladybird - lab48

eliott/ladybird

mirror of https://github.com/LadybirdBrowser/ladybird synced 2026-04-27 02:05:07 +02:00

Files

Andreas Kling 91cf575b82 LibWeb: Disable script execution for SVG images loaded via <img>

SVG images loaded as <img> elements must not execute scripts per spec.
Previously, SVGScriptElement::process_the_script_element() did not
check whether scripting was disabled, so script processing was
triggered via the children_changed() callback during XML parsing,
causing a nested event loop spin.

Fix this by:
- Disabling scripting on the SVG image's Page
- Passing XMLScriptingSupport::Disabled to the XML document builder
- Checking is_scripting_disabled() in SVGScriptElement before
  processing any script element
- Logging a diagnostic when SVG XML parsing fails (previously the
  parse result was silently discarded)

2026-02-01 22:48:51 +01:00

8 lines

327 B

HTML

Raw Blame History

 <!DOCTYPE html>
 <link rel="match" href="../expected/svg-as-img-with-script-ref.html" />
 <style>img { display: block; }</style>
 <p>SVG scripts must not execute when loaded as an image.</p>
 <img src="../data/svg-with-script.svg">
 <img src="../data/svg-with-external-script.svg">
 <img src="../data/svg-with-multiple-scripts.svg">