Index: Source/core/dom/Document.cpp |
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp |
index a5dddea9ff27a0d1ab8a4d19beb42ad0897e3fd2..61f22e9d024ea8ad3589a78334c16e46f4c9fd61 100644 |
--- a/Source/core/dom/Document.cpp |
+++ b/Source/core/dom/Document.cpp |
@@ -2841,6 +2841,11 @@ void Document::processHttpEquivXFrameOptions(const String& content) |
} |
} |
+static bool isInvalidSeparator(UChar c) |
+{ |
+ return c == ';'; |
+} |
+ |
// Though isspace() considers \t and \v to be whitespace, Win IE doesn't. |
static bool isSeparator(UChar c) |
{ |
@@ -2849,6 +2854,8 @@ static bool isSeparator(UChar c) |
void Document::processArguments(const String& features, void* data, ArgumentsCallback callback) |
{ |
+ bool error = false; |
+ |
// Tread lightly in this code -- it was specifically designed to mimic Win IE's parsing behavior. |
int keyBegin, keyEnd; |
int valueBegin, valueEnd; |
@@ -2859,6 +2866,7 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
while (i < length) { |
// skip to first non-separator, but don't skip past the end of the string |
while (isSeparator(buffer[i])) { |
+ error |= isInvalidSeparator(buffer[i]); |
rune
2013/08/20 11:36:59
This will never do anything since isSeparator is n
|
if (i >= length) |
break; |
i++; |
@@ -2866,12 +2874,15 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
keyBegin = i; |
// skip to first separator |
- while (!isSeparator(buffer[i])) |
+ while (!isSeparator(buffer[i])) { |
+ error |= isInvalidSeparator(buffer[i]); |
i++; |
+ } |
keyEnd = i; |
// skip to first '=', but don't skip past a ',' or the end of the string |
while (buffer[i] != '=') { |
+ error |= isInvalidSeparator(buffer[i]); |
if (buffer[i] == ',' || i >= length) |
break; |
i++; |
@@ -2879,6 +2890,7 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
// skip to first non-separator, but don't skip past a ',' or the end of the string |
while (isSeparator(buffer[i])) { |
+ error |= isInvalidSeparator(buffer[i]); |
rune
2013/08/20 11:36:59
This will never do anything since isSeparator is n
|
if (buffer[i] == ',' || i >= length) |
break; |
i++; |
@@ -2886,8 +2898,10 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
valueBegin = i; |
// skip to first separator |
- while (!isSeparator(buffer[i])) |
+ while (!isSeparator(buffer[i])) { |
+ error |= isInvalidSeparator(buffer[i]); |
i++; |
+ } |
valueEnd = i; |
ASSERT_WITH_SECURITY_IMPLICATION(i <= length); |
@@ -2896,6 +2910,8 @@ void Document::processArguments(const String& features, void* data, ArgumentsCal |
String valueString = buffer.substring(valueBegin, valueEnd - valueBegin); |
callback(keyString, valueString, this, data); |
} |
+ if (error) |
+ reportViewportWarning(this, InvalidKeyValuePairSeparatorError, String(), String()); |
} |
void Document::processViewport(const String& features, ViewportArguments::Type origin) |