Bug 194186 - LocalAuthenticator::getAssertion attempts to put an NSData into a string using %s
Summary: LocalAuthenticator::getAssertion attempts to put an NSData into a string usin...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 181943
  Show dependency tree / graph
 
Reported: 2019-02-01 20:00 PST by Darin Adler
Modified: 2019-08-06 13:13 PDT (History)
4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Darin Adler 2019-02-01 20:00:20 PST 
When converting code to remove uses of String::format, I noticed this misuse:

    m_connection->getUserConsent(
        String::format("Log into %s with %s.", requestData().requestOptions.rpId.utf8().data(), selectedCredentialAttributes[(id)kSecAttrApplicationTag]),
        (__bridge SecAccessControlRef)selectedCredentialAttributes[(id)kSecAttrAccessControl],
        WTFMove(callback));

selectedCredentialAttributes[(id)kSecAttrApplicationTag] returns an NSData *, which can't be usefully formatted with %s.
Comment 1 Radar WebKit Bug Importer 2019-02-04 08:59:34 PST 
<rdar://problem/47787251>
Comment 2 Darin Adler 2019-02-25 09:44:08 PST 
I fixed this in r242014 <https://trac.webkit.org/changeset/242014> but it’s untested.
Comment 3 Jiewen Tan 2019-02-25 12:22:24 PST 
(In reply to Darin Adler from comment #2)
> I fixed this in r242014 <https://trac.webkit.org/changeset/242014> but it’s
> untested.

Thanks, Darin. I will test it before closing the bug.
Comment 4 Jiewen Tan 2019-08-06 13:13:47 PDT 
Verified fix by:
Committed r248308: <https://trac.webkit.org/changeset/248308>