60322 2011-05-05 17:12:20 -0700 Implement whitelist for registerProtocolHandler 2011-06-09 11:48:18 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 koz koz abarth ap eric ian rektide oldest_to_newest 399214 0 koz 2011-05-05 17:12:20 -0700 Implement whitelist for registerProtocolHandler 399216 1 92507 koz 2011-05-05 17:13:56 -0700 Created attachment 92507 Patch 402575 2 92507 eric 2011-05-11 19:55:36 -0700 Comment on attachment 92507 Patch Seems reasonable. 402578 3 92507 abarth 2011-05-11 20:11:00 -0700 Comment on attachment 92507 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=92507&action=review > Source/WebCore/page/Navigator.cpp:236 > + if (scheme.startsWith("web+")) { Is there a spec for this scheme prefix? This feels like the kind of thing that would make IETFers go bananas. 402581 4 abarth 2011-05-11 20:13:08 -0700 I see. It was hixie's idea. 411057 5 koz 2011-05-26 18:17:45 -0700 Committed r87459: <http://trac.webkit.org/changeset/87459> 418152 6 rektide 2011-06-09 11:48:18 -0700 Why was this patch done? Is it part of any spec? It mutes the ability of registerProtocolHandler to extend the web, and strikes me as a drastic overreaction to the need for a protective black-list. Mega :( 92507 2011-05-05 17:13:56 -0700 2011-05-11 20:11:00 -0700 Patch bug-60322-20110506101353.patch text/plain 4567 koz U3VidmVyc2lvbiBSZXZpc2lvbjogODQ5NzMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBmZGYzMGUxMDMyNDA3ODU4MjEwN2I2 MGY3NDkyMzkxMWFmMDVhMzZhLi5hZjNmMTYzOWI3NGI1NDFmNTZlYjMyN2U5NDRhYzc0Y2FlZDIy ZDE1IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDUtMDUgIEphbWVzIEtvemlhbnNraSAg PGtvekBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgSW1wbGVtZW50IGEgd2hpdGVsaXN0IGZvciByZWdpc3RlclByb3RvY29sSGFu ZGxlci4KKworICAgICAgICBEZXNjcmliZWQgaW4gdGhlIHRocmVhZCBoZXJlCisgICAgICAgIGh0 dHA6Ly9saXN0cy53aGF0d2cub3JnL2h0ZGlnLmNnaS93aGF0d2ctd2hhdHdnLm9yZy8yMDExLUFw cmlsLzAzMTIyMC5odG1sCisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTYwMzIyCisKKyAgICAgICAgKiBmYXN0L2RvbS9yZWdpc3Rlci1wcm90b2NvbC1o YW5kbGVyLmh0bWw6CisKIDIwMTEtMDQtMjYgIE1hcmlvIFNhbmNoZXogUHJhZGEgIDxtc2FuY2hl ekBpZ2FsaWEuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEVyaWMgU2VpZGVsLgpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9kb20vcmVnaXN0ZXItcHJvdG9jb2wtaGFuZGxlci5odG1s IGIvTGF5b3V0VGVzdHMvZmFzdC9kb20vcmVnaXN0ZXItcHJvdG9jb2wtaGFuZGxlci5odG1sCmlu ZGV4IDc4ZjkzOWY5MTZmYWE1NjM1NjMzMDcxNjAxNWJhMjAzMzJiOWJhYWMuLmUxYmJmZjg5OWQz NDY0MjNhMjViZTYxZjNkOTU5NjI0NjE2YmVlYTEgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2Zh c3QvZG9tL3JlZ2lzdGVyLXByb3RvY29sLWhhbmRsZXIuaHRtbAorKysgYi9MYXlvdXRUZXN0cy9m YXN0L2RvbS9yZWdpc3Rlci1wcm90b2NvbC1oYW5kbGVyLmh0bWwKQEAgLTM2LDcgKzM2LDcgQEAg dmFyIGludmFsaWRfdXJscyA9IFsiIiwgIiVTIl07CiBpbnZhbGlkX3VybHMuZm9yRWFjaChmdW5j dGlvbiAodXJsKSB7CiAgICB2YXIgc3VjY2VlZGVkID0gZmFsc2U7CiAgICB0cnkgewotICAgICAg ICB3aW5kb3cubmF2aWdhdG9yLnJlZ2lzdGVyUHJvdG9jb2xIYW5kbGVyKCdteXByb3RvY29sJywg dXJsLCAndGl0bGUnKTsKKyAgICAgICAgd2luZG93Lm5hdmlnYXRvci5yZWdpc3RlclByb3RvY29s SGFuZGxlcignd2ViK215cHJvdG9jb2wnLCB1cmwsICd0aXRsZScpOwogICAgIH0gY2F0Y2ggKGUp IHsKICAgICAgICAgc3VjY2VlZGVkID0gJ1NZTlRBWF9FUlInID09IGUubmFtZTsKICAgICB9CkBA IC01MCw3ICs1MCw3IEBAIGludmFsaWRfdXJscy5mb3JFYWNoKGZ1bmN0aW9uICh1cmwpIHsKIC8v IFRlc3QgdGhhdCB0aGUgQVBJIGhhcyBkZWZhdWx0IG5vLW9wIGltcGxlbWVudGF0aW9uLgogdmFy IHN1Y2NlZWRlZCA9IHRydWU7CiB0cnkgewotICAgIHdpbmRvdy5uYXZpZ2F0b3IucmVnaXN0ZXJQ cm90b2NvbEhhbmRsZXIoJ215cHJvdG9jb2wnLCAiJXMiLCAidGl0bGUiKTsKKyAgICB3aW5kb3cu bmF2aWdhdG9yLnJlZ2lzdGVyUHJvdG9jb2xIYW5kbGVyKCd3ZWIrbXlwcm90b2NvbCcsICIlcyIs ICJ0aXRsZSIpOwogfSBjYXRjaCAoZSkgewogICAgIHN1Y2NlZWRlZCA9IGZhbHNlOwogfQpkaWZm IC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCmluZGV4IGE2ZjUyOWVlODA2ZTE2MDE4Y2VjZWJkYmNjODgyZGViMGY4Y2VkYTYuLmExYTBl NGVmMjVjMjMwOWI1YTYzNDYwODRkMmFlZGRiYTljZTJiY2YgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyAr MSwxNSBAQAorMjAxMS0wNS0wNSAgSmFtZXMgS296aWFuc2tpICA8a296QGNocm9taXVtLm9yZz4K KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJbXBsZW1l bnQgYSB3aGl0ZWxpc3QgZm9yIHJlZ2lzdGVyUHJvdG9jb2xIYW5kbGVyCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02MDMyMgorCisgICAgICAgICogcGFn ZS9OYXZpZ2F0b3IuY3BwOgorICAgICAgICAoV2ViQ29yZTo6aW5pdFByb3RvY29sSGFuZGxlcldo aXRlbGlzdCk6CisgICAgICAgIChXZWJDb3JlOjppc1Byb3RvY29sV2hpdGVsaXN0ZWQpOgorICAg ICAgICAoV2ViQ29yZTo6dmVyaWZ5UHJvdG9jb2xIYW5kbGVyU2NoZW1lKToKKwogMjAxMS0wNC0y NiAgQW5kZXJzIENhcmxzc29uICA8YW5kZXJzY2FAYXBwbGUuY29tPgogCiAgICAgICAgIEZpeCBj bGFuZysrIGJ1aWxkLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9OYXZpZ2F0b3Iu Y3BwIGIvU291cmNlL1dlYkNvcmUvcGFnZS9OYXZpZ2F0b3IuY3BwCmluZGV4IDc4MGIyMDU2NTE3 MmU0ZGEyYzRmMDc5NmQyZWUxOTM2YzRiMGFlODYuLjQxOTJiNDdiNjg0Njc1MWFhYjNhOTY0ZDM4 MWEyYjg2YjU1NDNlNjIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvTmF2aWdhdG9y LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL05hdmlnYXRvci5jcHAKQEAgLTQyLDYgKzQy LDcgQEAKICNpbmNsdWRlICJQbHVnaW5EYXRhLmgiCiAjaW5jbHVkZSAiU2V0dGluZ3MuaCIKICNp bmNsdWRlICJTdG9yYWdlTmFtZXNwYWNlLmgiCisjaW5jbHVkZSA8d3RmL0hhc2hTZXQuaD4KICNp bmNsdWRlIDx3dGYvU3RkTGliRXh0cmFzLmg+CiAKIG5hbWVzcGFjZSBXZWJDb3JlIHsKQEAgLTE4 MSw2ICsxODIsMjEgQEAgdm9pZCBOYXZpZ2F0b3I6OmdldFN0b3JhZ2VVcGRhdGVzKCkKICNlbmRp ZgogCiAjaWYgRU5BQkxFKFJFR0lTVEVSX1BST1RPQ09MX0hBTkRMRVIpCitzdGF0aWMgSGFzaFNl dDxTdHJpbmc+KiBwcm90b2NvbFdoaXRlbGlzdDsKKworc3RhdGljIHZvaWQgaW5pdFByb3RvY29s SGFuZGxlcldoaXRlbGlzdCgpCit7CisgICAgcHJvdG9jb2xXaGl0ZWxpc3QgPSBuZXcgSGFzaFNl dDxTdHJpbmc+OworICAgIHN0YXRpYyBjb25zdCBjaGFyKiBwcm90b2NvbHNbXSA9IHsKKyAgICAg ICAgIm1haWx0byIsCisgICAgICAgICJtbXMiLAorICAgICAgICAibm50cCIsCisgICAgICAgICJy dHNwIiwKKyAgICB9OworICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgV1RGX0FSUkFZX0xFTkdU SChwcm90b2NvbHMpOyArK2kpCisgICAgICAgIHByb3RvY29sV2hpdGVsaXN0LT5hZGQocHJvdG9j b2xzW2ldKTsKK30KKwogc3RhdGljIGJvb2wgdmVyaWZ5Q3VzdG9tSGFuZGxlclVSTChjb25zdCBT dHJpbmcmIGJhc2VVUkwsIGNvbnN0IFN0cmluZyYgdXJsLCBFeGNlcHRpb25Db2RlJiBlYykKIHsK ICAgICAvLyBUaGUgc3BlY2lmaWNhdGlvbiByZXF1aXJlcyB0aGF0IGl0IGlzIGEgU1lOVEFYX0VS UiBpZiB0aGUgIiVzIiB0b2tlbiBpcwpAQCAtMjA4LDE0ICsyMjQsMjYgQEAgc3RhdGljIGJvb2wg dmVyaWZ5Q3VzdG9tSGFuZGxlclVSTChjb25zdCBTdHJpbmcmIGJhc2VVUkwsIGNvbnN0IFN0cmlu ZyYgdXJsLCBFeGMKICAgICByZXR1cm4gdHJ1ZTsKIH0KIAorc3RhdGljIGJvb2wgaXNQcm90b2Nv bFdoaXRlbGlzdGVkKGNvbnN0IFN0cmluZyYgc2NoZW1lKQoreworICAgIGlmICghcHJvdG9jb2xX aGl0ZWxpc3QpCisgICAgICAgIGluaXRQcm90b2NvbEhhbmRsZXJXaGl0ZWxpc3QoKTsKKyAgICBy ZXR1cm4gcHJvdG9jb2xXaGl0ZWxpc3QtPmNvbnRhaW5zKHNjaGVtZSk7Cit9CisKIHN0YXRpYyBi b29sIHZlcmlmeVByb3RvY29sSGFuZGxlclNjaGVtZShjb25zdCBTdHJpbmcmIHNjaGVtZSwgRXhj ZXB0aW9uQ29kZSYgZWMpCiB7Ci0gICAgLy8gSXQgaXMgYSBTRUNVUklUWV9FUlIgZm9yIHRoZXNl IHNjaGVtZXMgdG8gYmUgaGFuZGxlZCBieSBhIGN1c3RvbSBoYW5kbGVyLgotICAgIGlmIChlcXVh bElnbm9yaW5nQ2FzZShzY2hlbWUsICJodHRwIikgfHwgZXF1YWxJZ25vcmluZ0Nhc2Uoc2NoZW1l LCAiaHR0cHMiKSB8fCBlcXVhbElnbm9yaW5nQ2FzZShzY2hlbWUsICJmaWxlIikpIHsKKyAgICBp ZiAoc2NoZW1lLnN0YXJ0c1dpdGgoIndlYisiKSkgeworICAgICAgICBpZiAoaXNWYWxpZFByb3Rv Y29sKHNjaGVtZSkpCisgICAgICAgICAgICByZXR1cm4gdHJ1ZTsKICAgICAgICAgZWMgPSBTRUNV UklUWV9FUlI7CiAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICB9Ci0gICAgcmV0dXJuIHRydWU7 CisKKyAgICBpZiAoaXNQcm90b2NvbFdoaXRlbGlzdGVkKHNjaGVtZSkpCisgICAgICAgIHJldHVy biB0cnVlOworICAgIGVjID0gU0VDVVJJVFlfRVJSOworICAgIHJldHVybiBmYWxzZTsKIH0KIAog dm9pZCBOYXZpZ2F0b3I6OnJlZ2lzdGVyUHJvdG9jb2xIYW5kbGVyKGNvbnN0IFN0cmluZyYgc2No ZW1lLCBjb25zdCBTdHJpbmcmIHVybCwgY29uc3QgU3RyaW5nJiB0aXRsZSwgRXhjZXB0aW9uQ29k ZSYgZWMpCg==