76234 2012-01-12 17:19:24 -0800 NSURL to KURL conversion shouldn't turn raw paths into file URLs 2012-02-09 13:41:40 -0800 1 1 1 Unclassified WebKit Platform 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 78280 1 ap ap darin sam oldest_to_newest 535324 0 ap 2012-01-12 17:19:24 -0800 This creates ways for strings that didn't look like file URLs at first to become file URLs after security checks have cleared them. I tracked the origins of this code to <http://trac.webkit.org/changeset/4662>. It's not clear if there was any reason for doing this - I couldn't find any evidence of any Foundation or AppKit methods doing much with such NSURLs. 535328 1 122345 ap 2012-01-12 17:22:00 -0800 Created attachment 122345 proposed patch I suggest waiting to see if any non-Safari clients break because of this. We can then add more relaxed conversion for APIs that are used this way. 535331 2 122345 darin 2012-01-12 17:25:44 -0800 Comment on attachment 122345 proposed patch Seems good to do this. I agree we can add code to add "file:" prefix in the WebKit level later if we find we need it for compatibility. 535335 3 ap 2012-01-12 17:27:47 -0800 Committed <http://trac.webkit.org/changeset/104885>. 535489 4 ap 2012-01-13 00:12:24 -0800 Forgot about matching CF code. Filed bug 76251 about it. 122345 2012-01-12 17:22:00 -0800 2012-01-12 17:25:44 -0800 proposed patch RemoveFilePathConversion.txt text/plain 1632 ap SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEwNDg4NCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEyIEBACisyMDEyLTAxLTEyICBBbGV4ZXkg UHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgorCisgICAgICAgIE5TVVJMIHRvIEtVUkwgY29u dmVyc2lvbiBzaG91bGRuJ3QgdHVybiByYXcgcGF0aHMgaW50byBmaWxlIFVSTHMKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc2MjM0CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9tYWMvS1VS TE1hYy5tbTogKFdlYkNvcmU6OktVUkw6OktVUkwpOiBSZW1vdmVkIHRoaXMgY29kZS4KKwogMjAx Mi0wMS0xMiAgQW5kZXJzIENhcmxzc29uICA8YW5kZXJzY2FAYXBwbGUuY29tPgogCiAgICAgICAg IENyZWF0ZSBhIEdyYXBoaWNzTGF5ZXIgZm9yIHRoZSBvdmVyaGFuZyBhcmVhcyBpZiB0aHJlYWRl ZCBzY3JvbGxpbmcgaXMgZW5hYmxlZApJbmRleDogU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbWFj L0tVUkxNYWMubW0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbWFjL0tV UkxNYWMubW0JKHJldmlzaW9uIDEwNDg1NSkKKysrIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL21h Yy9LVVJMTWFjLm1tCSh3b3JraW5nIGNvcHkpCkBAIC00MiwyMiArNDIsMTEgQEAgS1VSTDo6S1VS TChOU1VSTCAqdXJsKQogICAgIH0KIAogICAgIENGSW5kZXggYnl0ZXNMZW5ndGggPSBDRlVSTEdl dEJ5dGVzKHJlaW50ZXJwcmV0X2Nhc3Q8Q0ZVUkxSZWY+KHVybCksIDAsIDApOwotICAgIFZlY3Rv cjxjaGFyLCA1MTI+IGJ1ZmZlcihieXRlc0xlbmd0aCArIDYpOyAvLyA1IGZvciAiZmlsZToiLCAx IGZvciBudWxsIGNoYXJhY3RlciB0byBlbmQgQyBzdHJpbmcKLSAgICBjaGFyKiBieXRlcyA9ICZi dWZmZXJbNV07CisgICAgVmVjdG9yPGNoYXIsIDUxMj4gYnVmZmVyKGJ5dGVzTGVuZ3RoICsgMSk7 CisgICAgY2hhciogYnl0ZXMgPSAmYnVmZmVyWzBdOwogICAgIENGVVJMR2V0Qnl0ZXMocmVpbnRl cnByZXRfY2FzdDxDRlVSTFJlZj4odXJsKSwgcmVpbnRlcnByZXRfY2FzdDxVSW50OCo+KGJ5dGVz KSwgYnl0ZXNMZW5ndGgpOwogICAgIGJ5dGVzW2J5dGVzTGVuZ3RoXSA9ICdcMCc7Ci0gICAgaWYg KGJ5dGVzWzBdICE9ICcvJykgewotICAgICAgICBwYXJzZShieXRlcyk7Ci0gICAgICAgIHJldHVy bjsKLSAgICB9Ci0KLSAgICBidWZmZXJbMF0gPSAnZic7Ci0gICAgYnVmZmVyWzFdID0gJ2knOwot ICAgIGJ1ZmZlclsyXSA9ICdsJzsKLSAgICBidWZmZXJbM10gPSAnZSc7Ci0gICAgYnVmZmVyWzRd ID0gJzonOwotCi0gICAgcGFyc2UoYnVmZmVyLmRhdGEoKSk7CisgICAgcGFyc2UoYnl0ZXMpOwog fQogCiBLVVJMOjpvcGVyYXRvciBOU1VSTCAqKCkgY29uc3QK