From 5ce274cec4c6c16499fb4045ab121fb8e877e351 Mon Sep 17 00:00:00 2001
From: Karl Seguin <k@openmymind.io>
Date: Thu, 30 Jul 2026 13:53:08 +0800
Subject: [PATCH] fix: potential UAF when option's value is programmatically
 set

---
 src/browser/tests/element/html/option.html | 17 +++++++++++++++++
 src/browser/webapi/element/html/Option.zig |  6 ++++--
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/browser/tests/element/html/option.html b/src/browser/tests/element/html/option.html
index ec99e8991..305305816 100644
--- a/src/browser/tests/element/html/option.html
+++ b/src/browser/tests/element/html/option.html
@@ -23,6 +23,23 @@
   testing.expectEqual('changed', $('#opt1').value)
 </script>
 
+<script id="value_set_attribute">
+  {
+    const option = document.createElement('option')
+
+    // short values are stored inline in the String passed to our
+    // attributeChange hook, long ones are heap-backed
+    option.setAttribute('value', 'ab')
+    testing.expectEqual('ab', option.value)
+
+    option.setAttribute('value', 'a-long-attribute-value')
+    testing.expectEqual('a-long-attribute-value', option.value)
+
+    option.removeAttribute('value')
+    testing.expectEqual('', option.value)
+  }
+</script>
+
 <script id="text">
   testing.expectEqual('Text 1', $('#opt1').text)
   testing.expectEqual('Text 2', $('#opt2').text)
diff --git a/src/browser/webapi/element/html/Option.zig b/src/browser/webapi/element/html/Option.zig
index 300b70410..db03f262f 100644
--- a/src/browser/webapi/element/html/Option.zig
+++ b/src/browser/webapi/element/html/Option.zig
@@ -159,11 +159,13 @@ pub const Build = struct {
         self._disabled = element.getAttributeSafe(comptime .wrap("disabled")) != null;
     }
 
-    pub fn attributeChange(element: *Element, name: String, value: String, _: *Frame) !void {
+    pub fn attributeChange(element: *Element, name: String, _: String, _: *Frame) !void {
         const attribute = std.meta.stringToEnum(enum { value, selected }, name.str()) orelse return;
         const self = element.as(Option);
         switch (attribute) {
-            .value => self._value = value.str(),
+            // `value` is passed by value; for <= 12 bytes, str() points into our
+            // own parameter copy, so we have to re-read the owned bytes.
+            .value => self._value = element.getAttributeSafe(comptime .wrap("value")),
             .selected => {
                 self._default_selected = true;
                 self._selected = true;