Chromium Code Reviews| Index: Source/core/dom/Document.cpp |
| diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp |
| index a5dddea9ff27a0d1ab8a4d19beb42ad0897e3fd2..61f22e9d024ea8ad3589a78334c16e46f4c9fd61 100644 |
| --- a/Source/core/dom/Document.cpp |
| +++ b/Source/core/dom/Document.cpp |
| @@ -2841,6 +2841,11 @@ void Document::processHttpEquivXFrameOptions(const String& content) |
| } |
| } |
| +static bool isInvalidSeparator(UChar c) |
| +{ |
| + return c == ';'; |
| +} |
| + |
| // Though isspace() considers \t and \v to be whitespace, Win IE doesn't. |
| static bool isSeparator(UChar c) |
| { |
| @@ -2849,6 +2854,8 @@ static bool isSeparator(UChar c) |
| void Document::processArguments(const String& features, void* data, ArgumentsCallback callback) |
| { |
| + bool error = false; |
| + |
| // Tread lightly in this code -- it was specifically designed to mimic Win IE's parsing behavior. |
| int keyBegin, keyEnd; |
| int valueBegin, valueEnd; |
| @@ -2859,6 +2866,7 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
| while (i < length) { |
| // skip to first non-separator, but don't skip past the end of the string |
| while (isSeparator(buffer[i])) { |
| + error |= isInvalidSeparator(buffer[i]); |
|
rune
2013/08/20 11:36:59
This will never do anything since isSeparator is n
|
| if (i >= length) |
| break; |
| i++; |
| @@ -2866,12 +2874,15 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
| keyBegin = i; |
| // skip to first separator |
| - while (!isSeparator(buffer[i])) |
| + while (!isSeparator(buffer[i])) { |
| + error |= isInvalidSeparator(buffer[i]); |
| i++; |
| + } |
| keyEnd = i; |
| // skip to first '=', but don't skip past a ',' or the end of the string |
| while (buffer[i] != '=') { |
| + error |= isInvalidSeparator(buffer[i]); |
| if (buffer[i] == ',' || i >= length) |
| break; |
| i++; |
| @@ -2879,6 +2890,7 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
| // skip to first non-separator, but don't skip past a ',' or the end of the string |
| while (isSeparator(buffer[i])) { |
| + error |= isInvalidSeparator(buffer[i]); |
|
rune
2013/08/20 11:36:59
This will never do anything since isSeparator is n
|
| if (buffer[i] == ',' || i >= length) |
| break; |
| i++; |
| @@ -2886,8 +2898,10 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
| valueBegin = i; |
| // skip to first separator |
| - while (!isSeparator(buffer[i])) |
| + while (!isSeparator(buffer[i])) { |
| + error |= isInvalidSeparator(buffer[i]); |
| i++; |
| + } |
| valueEnd = i; |
| ASSERT_WITH_SECURITY_IMPLICATION(i <= length); |
| @@ -2896,6 +2910,8 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
| String valueString = buffer.substring(valueBegin, valueEnd - valueBegin); |
| callback(keyString, valueString, this, data); |
| } |
| + if (error) |
| + reportViewportWarning(this, InvalidKeyValuePairSeparatorError, String(), String()); |
| } |
| void Document::processViewport(const String& features, ViewportArguments::Type origin) |