diff --git a/dom/html/HTMLScriptElement.cpp b/dom/html/HTMLScriptElement.cpp
index 0d7209fcb338..27208e1434ba 100644
--- a/dom/html/HTMLScriptElement.cpp
+++ b/dom/html/HTMLScriptElement.cpp
@@ -126,6 +126,15 @@ nsresult HTMLScriptElement::Clone(dom::NodeInfo* aNodeInfo,
return NS_OK;
}
+void HTMLScriptElement::SetTextContentInternal(const nsAString& aTextContent,
+ nsIPrincipal* aSubjectPrincipal,
+ ErrorResult& aError) {
+ if(aTextContent.isTainted()) {
+ ReportTaintSink(aTextContent, "script.textContent", this);
+ }
+ FragmentOrElement::SetTextContentInternal(aTextContent, aSubjectPrincipal, aError);
+ }
+
nsresult HTMLScriptElement::CheckTaintSinkSetAttr(int32_t aNamespaceID, nsAtom* aName,
const nsAString& aValue) {
if (aNamespaceID == kNameSpaceID_None && aName == nsGkAtoms::src) {
diff --git a/dom/html/HTMLScriptElement.h b/dom/html/HTMLScriptElement.h
index c270d47babdb..0b795ec4a860 100644
--- a/dom/html/HTMLScriptElement.h
+++ b/dom/html/HTMLScriptElement.h
@@ -152,6 +152,9 @@ class HTMLScriptElement final : public nsGenericHTMLElement,
[[nodiscard]] static bool Supports(const GlobalObject& aGlobal,
const nsAString& aType);
+ virtual void SetTextContentInternal(const nsAString& aTextContent,
+ nsIPrincipal* aSubjectPrincipal,
+ ErrorResult& aError) override;
protected:
virtual ~HTMLScriptElement();
diff --git a/taint/test/mochitest/test_script_sinks.html b/taint/test/mochitest/test_script_sinks.html
index 9c69b513adac..3080a1663875 100644
--- a/taint/test/mochitest/test_script_sinks.html
+++ b/taint/test/mochitest/test_script_sinks.html
@@ -19,10 +19,13 @@
SimpleTest.waitForExplicitFinish();
addEventListener("__taintreport", (report) => {
- SimpleTest.is(report.detail.str, "tainted=hello", "Check sink string content");
-
+ if(i == 0) {
+ SimpleTest.is(report.detail.str, "url", "Check sink string content");
+ } else {
+ SimpleTest.is(report.detail.str, "console.log();", "Check sink string content");
+ }
let flow = report.detail.str.taint[0].flow;
- SimpleTest.is(flow[2].operation, sink_names[i]);
+ SimpleTest.is(flow[2].operation, sink_names[i], `${sink_names[i]} sink test`);
i += 1;
if (i >= sink_names.length) {
@@ -30,18 +33,24 @@
}
}, false);
+ function setScriptProperty(text, f) {
+ let script = document.createElement("script");
+ script.id = "tempscript";
+ f(script, text);
+ document.body.appendChild(script);
+ document.body.removeChild(script);
+ }
+
function startTest() {
- let tainted = String.tainted("tainted=hello");
- let script = document.getElementById("emptyScript");
- script.src = tainted;
- script.text = tainted;
- script.innerHTML = tainted;
- script.textContent = tainted;
+ let tainted = String.tainted("console.log();");
+ setScriptProperty(String.tainted("url"), (s,t) => s.src = t);
+ setScriptProperty(tainted, (s,t) => s.text = t);
+ setScriptProperty(tainted, (s,t) => s.innerHTML = t);
+ setScriptProperty(tainted, (s,t) => s.textContent = t);
}
-
+