Bug 57035 – Web Inspector: render XHRs matching JSON regex as JSON.

• Status: RESOLVED
• Resolution: FIXED
• Component: Web Inspector (Deprecated)

[Pavel Feldman]

Patch to follow.

[Pavel Feldman]

Created attachment 86794 [details]
[IMAGE] Screenshot with patch applied.

[Pavel Feldman]

Created attachment 86798 [details]
Patch

[Yury Semikhatsky]

Comment on attachment 86798 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=86798&action=review

> Source/WebCore/inspector/front-end/RemoteObject.js:219
> +                buffer += ", ";

Why not use Array.join instead?

> Source/WebCore/inspector/front-end/ResourceJSONView.js:41
> +    var start = /[{[]/.exec(text);

I vaguely recall that it's not uncommon to use a sequence of all kinds of brackets instead of while(1) to prevent XSS in this case. I don't remember details though and in particular whether the brackets should be opening or closing ones, you may want to double check.

> Source/WebCore/inspector/front-end/ResourceJSONView.js:42
> +    if (start && start.index)

Can it be a valid JSON string if it doesn't contain no { nor [ ?

[Pavel Feldman]

> I vaguely recall that it's not uncommon to use a sequence of all kinds of brackets instead of while(1) to prevent XSS in this case. I don't remember details though and in particular whether the brackets should be opening or closing ones, you may want to double check.

I did check, they prepend closing brackets.

> > Source/WebCore/inspector/front-end/ResourceJSONView.js:42
> > +    if (start && start.index)
> 
> Can it be a valid JSON string if it doesn't contain no { nor [ ?

Sure, it can be a string or a number.

[Pavel Feldman]

Committed r81878: <http://trac.webkit.org/changeset/81878>