Changeset 236528 in webkit

Timestamp:

Sep 26, 2018, 2:58:29 PM (8 years ago)

Author:

achristensen@apple.com

Message:

URLs with mismatched surrogate pairs in the host should fail to parse
​https://bugs.webkit.org/show_bug.cgi?id=190005

Reviewed by Chris Dumez.

Source/WebCore:

Elsewhere in the URLParser, when we encounter mismatched surrogate pairs we use the replacement character,
but that just fails later on in domainToASCII, so we may as well just fail.
This behavior matches Chrome, but is unclear in the spec. There are no valid uses of hosts containing mismatched surrogate pairs.
Covered by new API tests.

• platform/URLParser.cpp:

(WebCore::URLParser::parseHostAndPort):

Tools:

• TestWebKitAPI/Tests/WebCore/URLParser.cpp:

(TestWebKitAPI::TEST_F):

Location:

trunk

Files:

• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/platform/URLParser.cpp (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/TestWebKitAPI/Tests/WebCore/URLParser.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-09-26  Alex Christensen  <achristensen@webkit.org>
+
+        URLs with mismatched surrogate pairs in the host should fail to parse
+        https://bugs.webkit.org/show_bug.cgi?id=190005
+
+        Reviewed by Chris Dumez.
+
+        Elsewhere in the URLParser, when we encounter mismatched surrogate pairs we use the replacement character,
+        but that just fails later on in domainToASCII, so we may as well just fail.
+        This behavior matches Chrome, but is unclear in the spec.  There are no valid uses of hosts containing mismatched surrogate pairs.
+        Covered by new API tests.
+
+        * platform/URLParser.cpp:
+        (WebCore::URLParser::parseHostAndPort):
+
 2018-09-26  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/platform/URLParser.cpp

@@ -2754 +2754 @@
             syntaxViolation(hostBegin);
 
+        if (!U_IS_UNICODE_CHAR(*iterator))
+            return false;
         uint8_t buffer[U8_MAX_LENGTH];
         int32_t offset = 0;
-        UBool error = false;
-        U8_APPEND(buffer, offset, U8_MAX_LENGTH, *iterator, error);
-        ASSERT_WITH_SECURITY_IMPLICATION(offset <= static_cast<int32_t>(sizeof(buffer)));
-        // FIXME: Check error.
+        U8_APPEND_UNSAFE(buffer, offset, *iterator);
         utf8Encoded.append(buffer, offset);
     }

trunk/Tools/ChangeLog

@@ +1 @@
+2018-09-26  Alex Christensen  <achristensen@webkit.org>
+
+        URLs with mismatched surrogate pairs in the host should fail to parse
+        https://bugs.webkit.org/show_bug.cgi?id=190005
+
+        Reviewed by Chris Dumez.
+
+        * TestWebKitAPI/Tests/WebCore/URLParser.cpp:
+        (TestWebKitAPI::TEST_F):
+
 2018-09-26  Alex Christensen  <achristensen@webkit.org>
 

trunk/Tools/TestWebKitAPI/Tests/WebCore/URLParser.cpp

@@ -1258 +1258 @@
     const wchar_t validSurrogateEnd = 0xDD55;
     const wchar_t invalidSurrogateEnd = 'A';
+    const wchar_t replacementCharacter = 0xFFFD;
     checkURL(utf16String<12>({'h', 't', 't', 'p', ':', '/', '/', 'w', '/', surrogateBegin, validSurrogateEnd, '\0'}),
         {"http", "", "", "w", 0, "/%F0%90%85%95", "", "", "http://w/%F0%90%85%95"}, testTabsValueForSurrogatePairs);
-
+    shouldFail(utf16String<10>({'h', 't', 't', 'p', ':', '/', surrogateBegin, invalidSurrogateEnd, '/', '\0'}));
+    shouldFail(utf16String<9>({'h', 't', 't', 'p', ':', '/', replacementCharacter, '/', '\0'}));
+    
     // URLParser matches Chrome and Firefox but not URL::parse.
     checkURLDifferences(utf16String<12>({'h', 't', 't', 'p', ':', '/', '/', 'w', '/', surrogateBegin, invalidSurrogateEnd}),