Chromium Code Reviews| Index: Source/devtools/front_end/network/RequestJSONView.js |
| diff --git a/Source/devtools/front_end/network/RequestJSONView.js b/Source/devtools/front_end/network/RequestJSONView.js |
| index 8373b078d6f7e4bb16d07b2c839f68acce01112a..dd3b1ef8adb013ea3cb8ac1b49ec6505d4007645 100644 |
| --- a/Source/devtools/front_end/network/RequestJSONView.js |
| +++ b/Source/devtools/front_end/network/RequestJSONView.js |
| @@ -41,121 +41,33 @@ WebInspector.RequestJSONView = function(request, parsedJSON) |
| this.element.classList.add("json"); |
| } |
| -// "false", "true", "null", ",", "{", "}", "[", "]", number, double-quoted string. |
| -WebInspector.RequestJSONView._jsonToken = new RegExp('(?:false|true|null|[/*&\\|;=\\(\\),\\{\\}\\[\\]]|(?:-?\\b(?:0|[1-9][0-9]*)(?:\\.[0-9]+)?(?:[eE][+-]?[0-9]+)?\\b)|(?:\"(?:[^\\0-\\x08\\x0a-\\x1f\"\\\\]|\\\\(?:[\"/\\\\bfnrt]|u[0-9A-Fa-f]{4}))*\"))', 'g'); |
| - |
| -// Escaped unicode char. |
| -WebInspector.RequestJSONView._escapedUnicode = new RegExp('\\\\(?:([^u])|u(.{4}))', 'g'); |
| - |
| -// Map from escaped char to its literal value. |
| -WebInspector.RequestJSONView._standardEscapes = {'"': '"', '/': '/', '\\': '\\', 'b': '\b', 'f': '\f', 'n': '\n', 'r': '\r', 't': '\t'}; |
| - |
| -/** |
| - * @param {string} full |
| - * @param {string} standard |
| - * @param {string} unicode |
| - * @return {string} |
| - */ |
| -WebInspector.RequestJSONView._unescape = function(full, standard, unicode) |
| -{ |
| - return standard ? WebInspector.RequestJSONView._standardEscapes[standard] : String.fromCharCode(parseInt(unicode, 16)); |
| -} |
| - |
| -/** |
| - * @param {string} text |
| - * @return {string} |
| - */ |
| -WebInspector.RequestJSONView._unescapeString = function(text) |
| -{ |
| - return text.indexOf("\\") === -1 ? text : text.replace(WebInspector.RequestJSONView._escapedUnicode, WebInspector.RequestJSONView._unescape); |
| -} |
| - |
| -/** |
| - * @return {*} |
| - */ |
| -WebInspector.RequestJSONView._buildObjectFromJSON = function(text) |
| -{ |
| - var regExp = WebInspector.RequestJSONView._jsonToken; |
| - regExp.lastIndex = 0; |
| - var result = []; |
| - var tip = result; |
| - var stack = []; |
| - var key = undefined; |
| - var token = undefined; |
| - var lastToken = undefined; |
| - while (true) { |
| - var match = regExp.exec(text); |
| - if (match === null) |
| - break; |
| - lastToken = token; |
| - token = match[0]; |
| - var code = token.charCodeAt(0); |
| - if ((code === 0x5b) || (code === 0x7b)) { // [ or { |
| - var newTip = (code === 0x5b) ? [] : {}; |
| - tip[key || tip.length] = newTip; |
| - stack.push(tip); |
| - tip = newTip; |
| - } else if ((code === 0x5d) || (code === 0x7d)) { // ] or } |
| - tip = stack.pop(); |
| - if (!tip) |
| - break; |
| - } else if (code === 0x2C) { // , |
| - if (Array.isArray(tip) && (lastToken === undefined || lastToken === "[" || lastToken === ",")) |
| - tip[tip.length] = undefined; |
| - } else if (code === 0x22) { // " |
| - token = WebInspector.RequestJSONView._unescapeString(token.substring(1, token.length - 1)); |
| - if (!key) { |
| - if (Array.isArray(tip)) { |
| - key = tip.length; |
| - } else { |
| - key = token || ""; |
| - continue; |
| - } |
| - } |
| - tip[key] = token; |
| - } else if (code === 0x66) { // f |
| - tip[key || tip.length] = false; |
| - } else if (code === 0x6e) { // n |
| - tip[key || tip.length] = null; |
| - } else if (code === 0x74) { // t |
| - tip[key || tip.length] = true; |
| - } else if (code === 0x2f || code === 0x2a || code === 0x26 || code === 0x7c || code === 0x3b || code === 0x3d || code === 0x28 || code === 0x29) { // /*&|;=() |
| - // Looks like JavaScript |
| - throw "Invalid JSON"; |
| - } else { // sign or digit |
| - tip[key || tip.length] = +(token); |
| - } |
| - key = undefined; |
| - } |
| - return (result.length > 1) ? result : result[0]; |
| -} |
| - |
| /** |
| * @param {string} text |
| * @return {?WebInspector.ParsedJSON} |
| */ |
| WebInspector.RequestJSONView.parseJSON = function(text) |
| { |
| - // Trim stubs like "while(1)", "for(;;)", weird numbers, etc. We need JSON start. |
| + // Do not treat HTML as JSON. |
| + if (text.startsWith("<")) |
| + return; |
| var inner = WebInspector.RequestJSONView._findBrackets(text, "{", "}"); |
| var inner2 = WebInspector.RequestJSONView._findBrackets(text, "[", "]"); |
| inner = inner2.length > inner.length ? inner2 : inner; |
| - var inner3 = WebInspector.RequestJSONView._findBrackets(text, "(", ")"); |
| - if (inner3.length - 2 > inner.length) { |
| - inner = inner3; |
| - ++inner.start; |
| - --inner.end; |
| - } |
| - if (inner.length === -1) |
| - return null; |
| + // Return on blank payloads or on payloads significantly smaller than original text. |
| + if (inner.length === -1 || text.length - inner.length > 80) |
| + return null; |
| var prefix = text.substring(0, inner.start); |
| var suffix = text.substring(inner.end + 1); |
| text = text.substring(inner.start, inner.end + 1); |
| + // Only process valid JSONP |
|
dgozman
2015/05/28 11:12:43
nit: full stop please.
|
| + if (suffix.length && !suffix.trim().startsWith(")")) |
|
dgozman
2015/05/28 11:12:43
&& prefix.trim().endsWith("(")
pfeldman
2015/05/28 11:27:01
"while (1) [1, 2]" is a valid json request.
dgozman
2015/05/28 11:41:31
But if we have suffix starting with ")", there mus
|
| + return null; |
| + |
| try { |
| - return new WebInspector.ParsedJSON(WebInspector.RequestJSONView._buildObjectFromJSON(text), prefix, suffix); |
| + return new WebInspector.ParsedJSON(JSON.parse(text), prefix, suffix); |
| } catch (e) { |
| return null; |
| } |