Bug 10183 – REGRESSION: obfuscated JS decoding breaks because of soft hyphen removal (Fanfiction.net author pages not listing stories)

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Hone Melgren]

It would appear that Fanfiction.net have changed how they list the stories on an author's page. It used to work as little as a week ago.

[Mark Rowe (bdash)]

The URL provided currently gives me a server error in both Safari and Firefox.  Will try again later.

Created attachment 10172 [details]
Obsufucated Javascript output decoded

There seems to be an issue with the "eval" bit on line 13 of the attached HTML file.

The javascript in the attached HTML file is taken from fanfiction.net - this is the bit that prevents the stories list from appearing.

[Alexey Proskuryakov]

Created attachment 10177 [details]
reduced test case

(In reply to comment #4)
> Created an attachment (id=10177) [edit]
> reduced test case
> 

Both TOT and Firefox display the following: **f** (should be **f**), while shipping Safari gives this: **f££ (should be **f**).

[Alexey Proskuryakov]

You are right, I was fooled by similar symptoms in stock and TOT, while the cause is different.

So, this actually looks like a regression from bug 4931 (a string literal here includes a soft hyphen, and removing it breaks decoding).

[Alexey Proskuryakov]

Created attachment 10715 [details]
proposed fix

Some other possible approaches to the problem:
- preserve Cf characters in literals, but strip from code;
- change nothing, and evangelize the site instead.

[Maciej Stachowiak]

Comment on attachment 10715 [details]
proposed fix

r=me

It's not worth being technically correct on this point if it's gonna cause compatibility problems. We should let the ECMA committee know so they can fix this for a future version of the spec.

[Alexey Proskuryakov]

Committed revision 16542.

[Darin Adler]

Could we strip out the other Cf characters, and just allow soft hyphen?

[Alexey Proskuryakov]

The soft hyphen is the only Cf character in Latin-1, so making it an exception would probably resolve issues with "binary" strings, such as the one in this bug. However, it is also easy to imagine e.g. RTL/LTR overrides being used in literals.

I guess I just don't get the reason behind this ECMA rule, so I don't see any real benefit in deviating from what other browsers do.