Future-proof data format used for LocalStorage.

content/renderer/dom_storage/local_storage_cached_area.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/dom_storage/local_storage_cached_area.h"
 
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/rand_util.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_split.h"
 #include "base/time/time.h"
 #include "content/common/dom_storage/dom_storage_map.h"
 #include "content/common/storage_partition_service.mojom.h"
 #include "content/renderer/dom_storage/local_storage_area.h"
 #include "content/renderer/dom_storage/local_storage_cached_areas.h"
 #include "mojo/public/cpp/bindings/strong_associated_binding.h"
 #include "third_party/WebKit/public/platform/WebURL.h"
 #include "third_party/WebKit/public/web/WebStorageEventDispatcher.h"
 
 namespace content {
 
 namespace {
 
+// Don't change or reorder any of the values in this enum, as these values
+// are serialized on disk.
+enum class StorageFormat : uint8_t { UTF16 = 0 };
+
 base::string16 Uint8VectorToString16(const std::vector<uint8_t>& input) {
-  return base::string16(reinterpret_cast<const base::char16*>(input.data()),
-                        input.size() / sizeof(base::char16));
+  CHECK(input.size() % sizeof(base::char16) == 1);
+  CHECK_EQ(input[0], static_cast<uint8_t>(StorageFormat::UTF16));

[michaeln, 2017/03/18 01:00:30]

Not sure we should crash the renderer here? Most users won't figure out how to
fix it.

For this to happen, either we downgrading to an older version of chrome or
there's corruption in database (assuming its not memory corruption of some
kind). Is that right? Is the version downgrade case detected farther upstream?

[Marijn Kruisselbrink, 2017/03/21 23:16:29]

Or compromised renderers, yes. So yeah, crashing the renderer is probably not
the right thing to do (even though that apparently is what indexeddb currently
does with data it can't deserialize). Changed it to for now just silently ignore
corrupt data, and added a TODO to do something better.

+  base::string16 result;
+  result.resize(input.size() / sizeof(base::char16));
+  std::memcpy(reinterpret_cast<void*>(&result[0]), input.data() + 1,

[michaeln, 2017/03/18 01:00:30]

is there a reason to use memcpy instead of a string16 ctor directly?

[Marijn Kruisselbrink, 2017/03/21 23:16:29]

I believe that using a string16 ctor directly would be potentially undefined
behavior, as it would involve reading a base::char16 from an address that is
almost certainly not correctly aligned for such a type. Having said that, I
believe that on all platforms and compilers we support it would actually work
correctly, but using memcpy seemed cleaner, since (I think) it's guaranteed to
work correctly.

+              input.size() - 1);
+  return result;
 }
 
 std::vector<uint8_t> String16ToUint8Vector(const base::string16& input) {
   const uint8_t* data = reinterpret_cast<const uint8_t*>(input.data());
-  return std::vector<uint8_t>(data, data + input.size() * sizeof(base::char16));
+  std::vector<uint8_t> result;
+  result.reserve(input.size() * sizeof(base::char16) + 1);
+  result.push_back(static_cast<uint8_t>(StorageFormat::UTF16));
+  result.insert(result.end(), data, data + input.size() * sizeof(base::char16));
+  return result;
 }
 
 class GetAllCallback : public mojom::LevelDBWrapperGetAllCallback {
  public:
   static mojom::LevelDBWrapperGetAllCallbackAssociatedPtrInfo CreateAndBind(
       const base::Callback<void(bool)>& callback) {
     mojom::LevelDBWrapperGetAllCallbackAssociatedPtrInfo ptr_info;
     auto request = mojo::MakeRequest(&ptr_info);
     mojo::MakeStrongAssociatedBinding(
         base::WrapUnique(new GetAllCallback(callback)), std::move(request));
@@ skipping 315 matching lines @@
 }
 
 void LocalStorageCachedArea::Reset() {
   map_ = NULL;
   ignore_key_mutations_.clear();
   ignore_all_mutations_ = false;
   weak_factory_.InvalidateWeakPtrs();
 }
 
 }  // namespace content