Bug 113962

Summary: GtkSelectionData length is off by one
Product: WebKit Reporter: Daniel Narvaez <dwnarvaez>
Component: WebKitGTKAssignee: Martin Robinson <mrobinson>
Status: RESOLVED FIXED    
Severity: Normal CC: dwnarvaez, mrobinson
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Linux   
Attachments:
Description Flags
Testcase
none
Patch none

Description Daniel Narvaez 2013-04-04 14:41:00 PDT
If you drag a link from webkit to another gtk widget, which supports text/uri-list, the GtkSelectionData passed to the drag-data-received event will have the wrong length. In fact it will include the NULL termination.

It looks like the issue might be here

https://trac.webkit.org/browser/trunk/Source/WebCore/platform/gtk/PasteboardHelper.cpp#L175

The + 1 there seems wrong to me. Similar issue with TargetTypeMarkup.
Comment 1 Daniel Narvaez 2013-04-04 14:44:03 PDT
Oh and TargetTypeNetscapeURL.
Comment 2 Martin Robinson 2013-05-14 20:20:20 PDT
Thanks for reporting this bug. Is it causing any visible issues? I've been looking at the drag-and-drop atom contents for different browsers and it seems they are all differ. For instance, I ran the paste program from: http://www.edwardrosten.com/code/x11.html like so:

./paste -dnd text/uri-list

After dragging a link 38 characters long, this is what I see in various browsers:

* Chromium: Number of items: 40
* Epiphany: Number of items: 39
* Firefox: Number of items: 38

If all browsers do something different and this isn't causing issues, I'm tempted keep things as they are. If not, what widgets are showing issues and are they reproducible with Chromium?
Comment 3 Daniel Narvaez 2013-05-15 00:33:06 PDT
If you drag a link from a webkitgtk widget to an application which uses pygobject Gtk.SelectionData.get_data, you will get uris with an extra \x00 at the end. In C applications I think it's normally not user visible because the string is null terminated anyway.
Comment 4 Martin Robinson 2013-05-15 07:34:14 PDT
(In reply to comment #3)
> If you drag a link from a webkitgtk widget to an application which uses pygobject Gtk.SelectionData.get_data, you will get uris with an extra \x00 at the end. In C applications I think it's normally not user visible because the string is null terminated anyway.

Do you have an example somewhere that illustrates this problem?
Comment 5 Daniel Narvaez 2013-05-15 07:37:47 PDT
I can write a testcase, give me a couple of days.
Comment 6 Daniel Narvaez 2013-05-17 16:07:18 PDT
Created attachment 202169 [details]
Testcase
Comment 7 Daniel Narvaez 2013-05-17 16:11:49 PDT
If you run the testcase, drag a link from the web view to the empty window, the url with the final \x00 will printed out.

I got different results than yours testing this with firefox and epiphany with this testcase. I dragged the planet link on webkitgtk.org and firefox worked as expected, epiphany failed in the same way as webkit. That's more in line with what I'd have expected.

firefox 10.0.12
epiphany 3.4.2
webkit 1.8.1
Comment 8 Martin Robinson 2013-05-17 16:31:49 PDT
(In reply to comment #7)
> If you run the testcase, drag a link from the web view to the empty window, the url with the final \x00 will printed out.
> 
> I got different results than yours testing this with firefox and epiphany with this testcase. I dragged the planet link on webkitgtk.org and firefox worked as expected, epiphany failed in the same way as webkit. That's more in line with what I'd have expected.
> 
> firefox 10.0.12
> epiphany 3.4.2
> webkit 1.8.1

Thanks very much for the test case. Chromium's data is two characters longer because it includes a carriage return and a newline. Firefox includes neither. I'll try to have a fix today.
Comment 9 Martin Robinson 2013-05-18 17:32:12 PDT
Created attachment 202223 [details]
Patch
Comment 10 Martin Robinson 2013-05-19 07:55:37 PDT
Comment on attachment 202223 [details]
Patch

Clearing flags on attachment: 202223

Committed r150350: <http://trac.webkit.org/changeset/150350>
Comment 11 Martin Robinson 2013-05-19 07:55:40 PDT
All reviewed patches have been landed.  Closing bug.