Bug 175081 - Web Automation: consider file extensions in the "accept" attribute when deciding if a file can be uploaded
Summary: Web Automation: consider file extensions in the "accept" attribute when decid...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: BJ Burg
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2017-08-02 11:45 PDT by BJ Burg
Modified: 2017-08-04 09:11 PDT (History)
10 users (show)

See Also:


Attachments
Patch (3.42 KB, patch)
2017-08-02 12:45 PDT, BJ Burg
joepeck: review+
buildbot: commit-queue-
Details | Formatted Diff | Diff
Archive of layout-test-results from ews105 for mac-elcapitan-wk2 (1.18 MB, application/zip)
2017-08-02 14:07 PDT, Build Bot
no flags Details
Archive of layout-test-results from ews114 for mac-elcapitan (1.83 MB, application/zip)
2017-08-02 20:14 PDT, Build Bot
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 BJ Burg 2017-08-02 12:45:01 PDT
Created attachment 316983 [details]
Patch
Comment 2 Build Bot 2017-08-02 14:07:06 PDT
Comment on attachment 316983 [details]
Patch

Attachment 316983 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/4241503

New failing tests:
imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.any.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-basic.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.any.worker.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-origin.any.html
imported/w3c/web-platform-tests/fetch/api/cors/cors-no-preflight.any.html
Comment 3 Build Bot 2017-08-02 14:07:08 PDT
Created attachment 316991 [details]
Archive of layout-test-results from ews105 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews105  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6
Comment 4 Build Bot 2017-08-02 20:14:28 PDT
Comment on attachment 316983 [details]
Patch

Attachment 316983 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/4243532

New failing tests:
fast/dom/StyleSheet/detached-sheet-owner-node-link.html
Comment 5 Build Bot 2017-08-02 20:14:29 PDT
Created attachment 317075 [details]
Archive of layout-test-results from ews114 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews114  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 6 Joseph Pecoraro 2017-08-02 21:31:16 PDT
Comment on attachment 316983 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=316983&action=review

r=me, but you may want to tighten up the extension checking.

> Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:540
>      String extension = filename.substring(filename.reverseFind('.') + 1);

There must be a better way to get a file's extension.

However this does pretty much match what `File::computeNameAndContentType` does it in WebCore/fileapi/File.cpp.

• What if this is a hidden file: ~/.bashrc
• What if this doesn't have an extension? /tmp/foo
• Is the filename here just a name or a path? /tmp/.hidden/foo

I think you will still at the very least want to handle if reverseFind returns WTF::notFound.
Comment 7 BJ Burg 2017-08-03 09:01:17 PDT
(In reply to Joseph Pecoraro from comment #6)
> Comment on attachment 316983 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=316983&action=review
> 
> r=me, but you may want to tighten up the extension checking.
> 
> > Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:540
> >      String extension = filename.substring(filename.reverseFind('.') + 1);
> 
> There must be a better way to get a file's extension.
> 
> However this does pretty much match what `File::computeNameAndContentType`
> does it in WebCore/fileapi/File.cpp.
> 
> • What if this is a hidden file: ~/.bashrc
> • What if this doesn't have an extension? /tmp/foo
> • Is the filename here just a name or a path? /tmp/.hidden/foo

MIME type inference will fail in all of these cases, so it doesn't really matter.

> I think you will still at the very least want to handle if reverseFind
> returns WTF::notFound.

Yep.
Comment 8 BJ Burg 2017-08-03 13:19:47 PDT
Committed r220222: <http://trac.webkit.org/changeset/220222>
Comment 9 Radar WebKit Bug Importer 2017-08-03 13:21:11 PDT
<rdar://problem/33707206>
Comment 10 Darin Adler 2017-08-03 21:19:13 PDT
Comment on attachment 316983 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=316983&action=review

>>> Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:540
>>>      String extension = filename.substring(filename.reverseFind('.') + 1);
>> 
>> There must be a better way to get a file's extension.
>> 
>> However this does pretty much match what `File::computeNameAndContentType` does it in WebCore/fileapi/File.cpp.
>> 
>> • What if this is a hidden file: ~/.bashrc
>> • What if this doesn't have an extension? /tmp/foo
>> • Is the filename here just a name or a path? /tmp/.hidden/foo
>> 
>> I think you will still at the very least want to handle if reverseFind returns WTF::notFound.
> 
> MIME type inference will fail in all of these cases, so it doesn't really matter.

I think it’s not great style to do this rather than using a helper function that can do it right.

> Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:541
> +    if (allowedFileExtensions.contains(extension))

Is this meant to be case sensitive? Or ASCII case insensitive?
Comment 11 BJ Burg 2017-08-04 09:11:05 PDT
Comment on attachment 316983 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=316983&action=review

>>>> Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:540
>>>>      String extension = filename.substring(filename.reverseFind('.') + 1);
>>> 
>>> There must be a better way to get a file's extension.
>>> 
>>> However this does pretty much match what `File::computeNameAndContentType` does it in WebCore/fileapi/File.cpp.
>>> 
>>> • What if this is a hidden file: ~/.bashrc
>>> • What if this doesn't have an extension? /tmp/foo
>>> • Is the filename here just a name or a path? /tmp/.hidden/foo
>>> 
>>> I think you will still at the very least want to handle if reverseFind returns WTF::notFound.
>> 
>> MIME type inference will fail in all of these cases, so it doesn't really matter.
> 
> I think it’s not great style to do this rather than using a helper function that can do it right.

The patch I landed handles the notFound case.

>> Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp:541
>> +    if (allowedFileExtensions.contains(extension))
> 
> Is this meant to be case sensitive? Or ASCII case insensitive?

This is a great point that Joe and I both missed, and it applies to the MIME types as well. I'll fix this in a followup. WebCore does convertToASCIILowercase on the accept values, so we need to do that for the filenames that we get via WebDriver and any MIME types that we infer.

https://html.spec.whatwg.org/multipage/input.html#file-upload-state-(type=file)