Bug (CVE-2011-0244) – Remove remaining calls to deprecatedParseURL

• Component: CSS
• Status: RESOLVED FIXED

[Darin Adler]

Turns out there are two kinds of callers to the CSSHelper.h parseURL function:

    1) Callers that are actually parsing CSS. None of these need to do any of the things in the parseURL function because the lexer and CSSParser object already take care of everything correctly.

    2) Callers that are not parsing CSS. These callers are going to get some really strange behavior since they really don't want all the quirky things that parseURL does.

I have a patch that removes the unneeded calls of type (1) and that adds a comment explaining why callers of type (2) need to get off the crack pipe.

[Darin Adler]

Created attachment 31636 [details]
work in progress

[Darin Adler]

Created attachment 32729 [details]
patch for part 1

Comment on attachment 32729 [details]
patch for part 1

> +            // FIXME: The completeURL call should be done when using the CSSImageValue,
> +            // not when creating it.
> +            parsedValue = CSSFontFaceSrcValue::create(m_styleSheet->completeURL(val->string));

The comment should say CSSFontFaceSrcValue.

[David Kilzer (:ddkilzer)]

(In reply to comment #2)
> Created an attachment (id=32729) [details]
> patch for part 1

There are two ChangeLog entries in WebCore/ChangeLog.  You probably want to delete one of them.

[Darin Adler]

(In reply to comment #3)
> (From update of attachment 32729 [details])
> > +            // FIXME: The completeURL call should be done when using the CSSImageValue,
> > +            // not when creating it.
> > +            parsedValue = CSSFontFaceSrcValue::create(m_styleSheet->completeURL(val->string));
> 
> The comment should say CSSFontFaceSrcValue.

Will do.

(In reply to comment #4)
> There are two ChangeLog entries in WebCore/ChangeLog.  You probably want to
> delete one of them.

Will do.

[Darin Adler]

Comment on attachment 32729 [details]
patch for part 1

Landed this as http://trac.webkit.org/changeset/45946 and now clearing flag so we can finish the rest of this.

[Darin Adler]

Created attachment 34273 [details]
some work in progress

[Darin Adler]

Created attachment 34275 [details]
test I'm experimenting with

[Darin Adler]

Created attachment 34276 [details]
another test I'm experimenting with

[Darin Adler]

Created attachment 69144 [details]
Checkpoint of work in progress

[Darin Adler]

Created attachment 69361 [details]
Patch

[Darin Adler]

Committed r68854: <http://trac.webkit.org/changeset/68854>