Bug 26599 (CVE-2011-0244) - Remove remaining calls to deprecatedParseURL
Summary: Remove remaining calls to deprecatedParseURL
Status: RESOLVED FIXED
Alias: CVE-2011-0244
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Darin Adler
URL:
Keywords:
Depends on: 45695
Blocks:
  Show dependency treegraph
 
Reported: 2009-06-22 00:46 PDT by Darin Adler
Modified: 2011-06-30 17:44 PDT (History)
2 users (show)

See Also:


Attachments
work in progress (13.38 KB, patch)
2009-06-22 01:20 PDT, Darin Adler
no flags Details | Formatted Diff | Diff
patch for part 1 (24.26 KB, patch)
2009-07-14 12:44 PDT, Darin Adler
no flags Details | Formatted Diff | Diff
some work in progress (23.50 KB, patch)
2009-08-07 08:14 PDT, Darin Adler
no flags Details | Formatted Diff | Diff
test I'm experimenting with (1.38 KB, text/html)
2009-08-07 08:16 PDT, Darin Adler
no flags Details
another test I'm experimenting with (31 bytes, text/html)
2009-08-07 08:16 PDT, Darin Adler
no flags Details
Checkpoint of work in progress (63.48 KB, patch)
2010-09-28 17:46 PDT, Darin Adler
no flags Details | Formatted Diff | Diff
Patch (103.19 KB, patch)
2010-09-30 12:13 PDT, Darin Adler
sam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Darin Adler 2009-06-22 00:46:27 PDT
Turns out there are two kinds of callers to the CSSHelper.h parseURL function:

    1) Callers that are actually parsing CSS. None of these need to do any of the things in the parseURL function because the lexer and CSSParser object already take care of everything correctly.

    2) Callers that are not parsing CSS. These callers are going to get some really strange behavior since they really don't want all the quirky things that parseURL does.

I have a patch that removes the unneeded calls of type (1) and that adds a comment explaining why callers of type (2) need to get off the crack pipe.
Comment 1 Darin Adler 2009-06-22 01:20:22 PDT
Created attachment 31636 [details]
work in progress
Comment 2 Darin Adler 2009-07-14 12:44:12 PDT
Created attachment 32729 [details]
patch for part 1
Comment 3 mitz 2009-07-14 22:29:26 PDT
Comment on attachment 32729 [details]
patch for part 1

> +            // FIXME: The completeURL call should be done when using the CSSImageValue,
> +            // not when creating it.
> +            parsedValue = CSSFontFaceSrcValue::create(m_styleSheet->completeURL(val->string));

The comment should say CSSFontFaceSrcValue.
Comment 4 David Kilzer (:ddkilzer) 2009-07-15 01:10:47 PDT
(In reply to comment #2)
> Created an attachment (id=32729) [details]
> patch for part 1

There are two ChangeLog entries in WebCore/ChangeLog.  You probably want to delete one of them.
Comment 5 Darin Adler 2009-07-15 10:13:35 PDT
(In reply to comment #3)
> (From update of attachment 32729 [details])
> > +            // FIXME: The completeURL call should be done when using the CSSImageValue,
> > +            // not when creating it.
> > +            parsedValue = CSSFontFaceSrcValue::create(m_styleSheet->completeURL(val->string));
> 
> The comment should say CSSFontFaceSrcValue.

Will do.

(In reply to comment #4)
> There are two ChangeLog entries in WebCore/ChangeLog.  You probably want to
> delete one of them.

Will do.
Comment 6 Darin Adler 2009-07-15 14:45:52 PDT
Comment on attachment 32729 [details]
patch for part 1

Landed this as http://trac.webkit.org/changeset/45946 and now clearing flag so we can finish the rest of this.
Comment 7 Darin Adler 2009-08-07 08:14:52 PDT
Created attachment 34273 [details]
some work in progress
Comment 8 Darin Adler 2009-08-07 08:16:26 PDT
Created attachment 34275 [details]
test I'm experimenting with
Comment 9 Darin Adler 2009-08-07 08:16:46 PDT
Created attachment 34276 [details]
another test I'm experimenting with
Comment 10 Darin Adler 2010-09-28 17:46:23 PDT
Created attachment 69144 [details]
Checkpoint of work in progress
Comment 11 Darin Adler 2010-09-30 12:13:34 PDT
Created attachment 69361 [details]
Patch
Comment 12 Darin Adler 2010-09-30 17:04:27 PDT
Committed r68854: <http://trac.webkit.org/changeset/68854>