Bug 167894 - Correct File Path Handling in SecurityOrigin and FileSystem
Summary: Correct File Path Handling in SecurityOrigin and FileSystem
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: All All
: P2 Critical
Assignee: Brent Fulgham
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-02-06 11:35 PST by Brent Fulgham
Modified: 2017-02-06 17:49 PST (History)
4 users (show)

See Also:


Attachments
Patch (12.13 KB, patch)
2017-02-06 15:38 PST, Brent Fulgham
no flags Details | Formatted Diff | Diff
Patch (removed volume-creation test logic) (9.18 KB, patch)
2017-02-06 17:26 PST, Brent Fulgham
ap: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Brent Fulgham 2017-02-06 11:35:28 PST
The fix in Bug 167696 was not correct. Rather than adding calls to URL decoding in the FileSystem class, we should be making sure that the callers of these functions are passing well-formed file paths.

This change fixes the calls sites in SecurityOrigin to avoid this problem, and removes the improperly URL decoding from FileSystem.cpp.
Comment 1 Radar WebKit Bug Importer 2017-02-06 11:36:16 PST
<rdar://problem/30380075>
Comment 2 Radar WebKit Bug Importer 2017-02-06 11:36:24 PST
<rdar://problem/30380080>
Comment 3 Brent Fulgham 2017-02-06 15:38:40 PST
Created attachment 300761 [details]
Patch
Comment 4 Alexey Proskuryakov 2017-02-06 16:05:03 PST
Comment on attachment 300761 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=300761&action=review

> Tools/TestWebKitAPI/Tests/WebCore/FileSystem.cpp:69
> +        system("mkdir resources");
> +        system("echo  \"<!DOCTYPE html><html><body>Hello</body></html>\" > resources/CrossPartitionFileTest.html");
> +        system("hdiutil create otherVolume.dmg -srcfolder resources/ -ov > /dev/null");
> +        system("hdiutil attach otherVolume.dmg > /dev/null");

This seems more invasive than I'd like the tests to be. Seems likely to cause more problems that it's worth it.
Comment 5 Brent Fulgham 2017-02-06 16:06:48 PST
(In reply to comment #4)
> Comment on attachment 300761 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=300761&action=review
> 
> > Tools/TestWebKitAPI/Tests/WebCore/FileSystem.cpp:69
> > +        system("mkdir resources");
> > +        system("echo  \"<!DOCTYPE html><html><body>Hello</body></html>\" > resources/CrossPartitionFileTest.html");
> > +        system("hdiutil create otherVolume.dmg -srcfolder resources/ -ov > /dev/null");
> > +        system("hdiutil attach otherVolume.dmg > /dev/null");
> 
> This seems more invasive than I'd like the tests to be. Seems likely to
> cause more problems that it's worth it.

Do you have a suggestion for creating multiple volumes during testing?

Or do you think the potential downside means we should not test this code path?
Comment 6 Alexey Proskuryakov 2017-02-06 17:08:29 PST
> Or do you think the potential downside means we should not test this code path?

That would be my inclination, yes.
Comment 7 Brent Fulgham 2017-02-06 17:26:03 PST
Created attachment 300773 [details]
Patch (removed volume-creation test logic)
Comment 8 Brent Fulgham 2017-02-06 17:28:31 PST
Note: The Windows build failure seems to be due to a bad commit to WebCore::CredentialStorage, and not this particular patch.
Comment 9 Brent Fulgham 2017-02-06 17:49:52 PST
Committed r211763: <http://trac.webkit.org/changeset/211763>