◆ WebKit WeeklyBeta

nullhook

WebCore contributor

65 commits (7mo)
1 security fixes
1 hardening
View all commits on GitHub ↗

Summary

nullhook works almost entirely in WebCore's SVG and CSS resource-loading paths: the `link-parameters` property and css-link-params test coverage, SVG external resources (moved from preview to enabled-by-default within this window), and external/`data:` URL references for clip-path, filter, and marker on both SVG and HTML elements. The pattern is feature enablement rather than security work — the lone security fix (`SVGProperty::contextElement` dropping `m_animVal` without `detach()` after `stopAnimation`) and the `IsolatedSVGDocumentContext` hardening commit both sit inside the same SVG surface being expanded. Where to look next: external and `data:` resource references are newly reachable from HTML elements, and the supporting churn — fragment stripping in `DocumentLoader::subresource()`, scope-bound image observer save/restore, `SVGImage` container parameters bundled into a struct — concentrates in the lifetime and URL-resolution logic that the isolated-document boundary is meant to contain.

Components

WebCore
90%
Platform
4%
Other
3%
WebKit
1%
WebCore CSS
1%

Security Fix History

Hardening Commits

Recent Commits

1 / 5

← All Contributors