-
Notifications
You must be signed in to change notification settings - Fork 30k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
url: enforce valid UTF-8 in WHATWG parser
This commit implements the Web IDL USVString conversion, which mandates all unpaired Unicode surrogates be turned into U+FFFD REPLACEMENT CHARACTER. It also disallows Symbols to be used as USVString per spec. Certain functions call into C++ methods in the binding that use the Utf8Value class to access string arguments. Utf8Value already does the normalization using V8's String::Write, so in those cases, instead of doing the full USVString normalization, only a symbol check is done (`'' + val`, which uses ES's ToString, versus `String()` which has special provisions for symbols). PR-URL: #11436 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
- v23.4.0
- v23.3.0
- v23.2.0
- v23.1.0
- v23.0.0
- v22.12.0
- v22.11.0
- v22.10.0
- v22.9.0
- v22.8.0
- v22.7.0
- v22.6.0
- v22.5.1
- v22.5.0
- v22.4.1
- v22.4.0
- v22.3.0
- v22.2.0
- v22.1.0
- v22.0.0
- v21.7.3
- v21.7.2
- v21.7.1
- v21.7.0
- v21.6.2
- v21.6.1
- v21.6.0
- v21.5.0
- v21.4.0
- v21.3.0
- v21.2.0
- v21.1.0
- v21.0.0
- v20.18.1
- v20.18.0
- v20.17.0
- v20.16.0
- v20.15.1
- v20.15.0
- v20.14.0
- v20.13.1
- v20.13.0
- v20.12.2
- v20.12.1
- v20.12.0
- v20.11.1
- v20.11.0
- v20.10.0
- v20.9.0
- v20.8.1
- v20.8.0
- v20.7.0
- v20.6.1
- v20.6.0
- v20.5.1
- v20.5.0
- v20.4.0
- v20.3.1
- v20.3.0
- v20.2.0
- v20.1.0
- v20.0.0
- v19.9.0
- v19.8.1
- v19.8.0
- v19.7.0
- v19.6.1
- v19.6.0
- v19.5.0
- v19.4.0
- v19.3.0
- v19.2.0
- v19.1.0
- v19.0.1
- v19.0.0
- v18.20.5
- v18.20.4
- v18.20.3
- v18.20.2
- v18.20.1
- v18.20.0
- v18.19.1
- v18.19.0
- v18.18.2
- v18.18.1
- v18.18.0
- v18.17.1
- v18.17.0
- v18.16.1
- v18.16.0
- v18.15.0
- v18.14.2
- v18.14.1
- v18.14.0
- v18.13.0
- v18.12.1
- v18.12.0
- v18.11.0
- v18.10.0
- v18.9.1
- v18.9.0
- v18.8.0
- v18.7.0
- v18.6.0
- v18.5.0
- v18.4.0
- v18.3.0
- v18.2.0
- v18.1.0
- v18.0.0
- v17.9.1
- v17.9.0
- v17.8.0
- v17.7.2
- v17.7.1
- v17.7.0
- v17.6.0
- v17.5.0
- v17.4.0
- v17.3.1
- v17.3.0
- v17.2.0
- v17.1.0
- v17.0.1
- v17.0.0
- v16.20.2
- v16.20.1
- v16.20.0
- v16.19.1
- v16.19.0
- v16.18.1
- v16.18.0
- v16.17.1
- v16.17.0
- v16.16.0
- v16.15.1
- v16.15.0
- v16.14.2
- v16.14.1
- v16.14.0
- v16.13.2
- v16.13.1
- v16.13.0
- v16.12.0
- v16.11.1
- v16.11.0
- v16.10.0
- v16.9.1
- v16.9.0
- v16.8.0
- v16.7.0
- v16.6.2
- v16.6.1
- v16.6.0
- v16.5.0
- v16.4.2
- v16.4.1
- v16.4.0
- v16.3.0
- v16.2.0
- v16.1.0
- v16.0.0
- v15.14.0
- v15.13.0
- v15.12.0
- v15.11.0
- v15.10.0
- v15.9.0
- v15.8.0
- v15.7.0
- v15.6.0
- v15.5.1
- v15.5.0
- v15.4.0
- v15.3.0
- v15.2.1
- v15.2.0
- v15.1.0
- v15.0.1
- v15.0.0
- v14.21.3
- v14.21.2
- v14.21.1
- v14.21.0
- v14.20.1
- v14.20.0
- v14.19.3
- v14.19.2
- v14.19.1
- v14.19.0
- v14.18.3
- v14.18.2
- v14.18.1
- v14.18.0
- v14.17.6
- v14.17.5
- v14.17.4
- v14.17.3
- v14.17.2
- v14.17.1
- v14.17.0
- v14.16.1
- v14.16.0
- v14.15.5
- v14.15.4
- v14.15.3
- v14.15.2
- v14.15.1
- v14.15.0
- v14.14.0
- v14.13.1
- v14.13.0
- v14.12.0
- v14.11.0
- v14.10.1
- v14.10.0
- v14.9.0
- v14.8.0
- v14.7.0
- v14.6.0
- v14.5.0
- v14.4.0
- v14.3.0
- v14.2.0
- v14.1.0
- v14.0.0
- v13.14.0
- v13.13.0
- v13.12.0
- v13.11.0
- v13.10.1
- v13.10.0
- v13.9.0
- v13.8.0
- v13.7.0
- v13.6.0
- v13.5.0
- v13.4.0
- v13.3.0
- v13.2.0
- v13.1.0
- v13.0.1
- v13.0.0
- v12.22.12
- v12.22.11
- v12.22.10
- v12.22.9
- v12.22.8
- v12.22.7
- v12.22.6
- v12.22.5
- v12.22.4
- v12.22.3
- v12.22.2
- v12.22.1
- v12.22.0
- v12.21.0
- v12.20.2
- v12.20.1
- v12.20.0
- v12.19.1
- v12.19.0
- v12.18.4
- v12.18.3
- v12.18.2
- v12.18.1
- v12.18.0
- v12.17.0
- v12.16.3
- v12.16.2
- v12.16.1
- v12.16.0
- v12.15.0
- v12.14.1
- v12.14.0
- v12.13.1
- v12.13.0
- v12.12.0
- v12.11.1
- v12.11.0
- v12.10.0
- v12.9.1
- v12.9.0
- v12.8.1
- v12.8.0
- v12.7.0
- v12.6.0
- v12.5.0
- v12.4.0
- v12.3.1
- v12.3.0
- v12.2.0
- v12.1.0
- v12.0.0
- v11.15.0
- v11.14.0
- v11.13.0
- v11.12.0
- v11.11.0
- v11.10.1
- v11.10.0
- v11.9.0
- v11.8.0
- v11.7.0
- v11.6.0
- v11.5.0
- v11.4.0
- v11.3.0
- v11.2.0
- v11.1.0
- v11.0.0
- v10.24.1
- v10.24.0
- v10.23.3
- v10.23.2
- v10.23.1
- v10.23.0
- v10.22.1
- v10.22.0
- v10.21.0
- v10.20.1
- v10.20.0
- v10.19.0
- v10.18.1
- v10.18.0
- v10.17.0
- v10.16.3
- v10.16.2
- v10.16.1
- v10.16.0
- v10.15.3
- v10.15.2
- v10.15.1
- v10.15.0
- v10.14.2
- v10.14.1
- v10.14.0
- v10.13.0
- v10.12.0
- v10.11.0
- v10.10.0
- v10.9.0
- v10.8.0
- v10.7.0
- v10.6.0
- v10.5.0
- v10.4.1
- v10.4.0
- v10.3.0
- v10.2.1
- v10.2.0
- v10.1.0
- v10.0.0
- v9.11.2
- v9.11.1
- v9.11.0
- v9.10.1
- v9.10.0
- v9.9.0
- v9.8.0
- v9.7.1
- v9.7.0
- v9.6.1
- v9.6.0
- v9.5.0
- v9.4.0
- v9.3.0
- v9.2.1
- v9.2.0
- v9.1.0
- v9.0.0
- v8.17.0
- v8.16.2
- v8.16.1
- v8.16.0
- v8.15.1
- v8.15.0
- v8.14.1
- v8.14.0
- v8.13.0
- v8.12.0
- v8.11.4
- v8.11.3
- v8.11.2
- v8.11.1
- v8.11.0
- v8.10.0
- v8.9.4
- v8.9.3
- v8.9.2
- v8.9.1
- v8.9.0
- v8.8.1
- v8.8.0
- v8.7.0
- v8.6.0
- v8.5.0
- v8.4.0
- v8.3.0
- v8.2.1
- v8.2.0
- v8.1.4
- v8.1.3
- v8.1.2
- v8.1.1
- v8.1.0
- v8.0.0
Showing
13 changed files
with
509 additions
and
44 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -23,6 +23,18 @@ const IteratorPrototype = Object.getPrototypeOf( | |
Object.getPrototypeOf([][Symbol.iterator]()) | ||
); | ||
|
||
const unpairedSurrogateRe = | ||
/([^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])/; | ||
function toUSVString(val) { | ||
const str = '' + val; | ||
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
TimothyGu
Author
Member
|
||
// As of V8 5.5, `str.search()` (and `unpairedSurrogateRe[@@search]()`) are | ||
// slower than `unpairedSurrogateRe.exec()`. | ||
const match = unpairedSurrogateRe.exec(str); | ||
if (!match) | ||
return str; | ||
return binding.toUSVString(str, match.index); | ||
} | ||
|
||
class OpaqueOrigin { | ||
toString() { | ||
return 'null'; | ||
|
@@ -104,7 +116,6 @@ function onParseComplete(flags, protocol, username, password, | |
|
||
// Reused by URL constructor and URL#href setter. | ||
function parse(url, input, base) { | ||
input = String(input); | ||
const base_context = base ? base[context] : undefined; | ||
url[context] = new StorageObject(); | ||
binding.parse(input.trim(), -1, | ||
|
@@ -206,8 +217,10 @@ function onParseHashComplete(flags, protocol, username, password, | |
|
||
class URL { | ||
constructor(input, base) { | ||
// toUSVString is not needed. | ||
input = '' + input; | ||
if (base !== undefined && !(base instanceof URL)) | ||
base = new URL(String(base)); | ||
base = new URL(base); | ||
parse(this, input, base); | ||
} | ||
|
||
|
@@ -315,6 +328,8 @@ Object.defineProperties(URL.prototype, { | |
return this[kFormat]({}); | ||
}, | ||
set(input) { | ||
// toUSVString is not needed. | ||
input = '' + input; | ||
parse(this, input); | ||
} | ||
}, | ||
|
@@ -332,7 +347,8 @@ Object.defineProperties(URL.prototype, { | |
return this[context].scheme; | ||
}, | ||
set(scheme) { | ||
scheme = String(scheme); | ||
// toUSVString is not needed. | ||
scheme = '' + scheme; | ||
if (scheme.length === 0) | ||
return; | ||
binding.parse(scheme, binding.kSchemeStart, null, this[context], | ||
|
@@ -346,7 +362,8 @@ Object.defineProperties(URL.prototype, { | |
return this[context].username || ''; | ||
}, | ||
set(username) { | ||
username = String(username); | ||
// toUSVString is not needed. | ||
username = '' + username; | ||
if (!this.hostname) | ||
return; | ||
const ctx = this[context]; | ||
|
@@ -366,7 +383,8 @@ Object.defineProperties(URL.prototype, { | |
return this[context].password || ''; | ||
}, | ||
set(password) { | ||
password = String(password); | ||
// toUSVString is not needed. | ||
password = '' + password; | ||
if (!this.hostname) | ||
return; | ||
const ctx = this[context]; | ||
|
@@ -391,7 +409,8 @@ Object.defineProperties(URL.prototype, { | |
}, | ||
set(host) { | ||
const ctx = this[context]; | ||
host = String(host); | ||
// toUSVString is not needed. | ||
host = '' + host; | ||
if (this[cannotBeBase] || | ||
(this[special] && host.length === 0)) { | ||
// Cannot set the host if cannot-be-base is set or | ||
|
@@ -415,7 +434,8 @@ Object.defineProperties(URL.prototype, { | |
}, | ||
set(host) { | ||
const ctx = this[context]; | ||
host = String(host); | ||
// toUSVString is not needed. | ||
host = '' + host; | ||
if (this[cannotBeBase] || | ||
(this[special] && host.length === 0)) { | ||
// Cannot set the host if cannot-be-base is set or | ||
|
@@ -439,11 +459,12 @@ Object.defineProperties(URL.prototype, { | |
return port === undefined ? '' : String(port); | ||
}, | ||
set(port) { | ||
// toUSVString is not needed. | ||
port = '' + port; | ||
const ctx = this[context]; | ||
if (!ctx.host || this[cannotBeBase] || | ||
this.protocol === 'file:') | ||
return; | ||
port = String(port); | ||
if (port === '') { | ||
ctx.port = undefined; | ||
return; | ||
|
@@ -462,9 +483,11 @@ Object.defineProperties(URL.prototype, { | |
return ctx.path !== undefined ? `/${ctx.path.join('/')}` : ''; | ||
}, | ||
set(path) { | ||
// toUSVString is not needed. | ||
path = '' + path; | ||
if (this[cannotBeBase]) | ||
return; | ||
binding.parse(String(path), binding.kPathStart, null, this[context], | ||
binding.parse(path, binding.kPathStart, null, this[context], | ||
onParsePathComplete.bind(this)); | ||
} | ||
}, | ||
|
@@ -477,7 +500,7 @@ Object.defineProperties(URL.prototype, { | |
}, | ||
set(search) { | ||
const ctx = this[context]; | ||
search = String(search); | ||
search = toUSVString(search); | ||
if (!search) { | ||
ctx.query = null; | ||
ctx.flags &= ~binding.URL_FLAGS_HAS_QUERY; | ||
|
@@ -509,7 +532,8 @@ Object.defineProperties(URL.prototype, { | |
}, | ||
set(hash) { | ||
const ctx = this[context]; | ||
hash = String(hash); | ||
// toUSVString is not needed. | ||
hash = '' + hash; | ||
if (this.protocol === 'javascript:') | ||
return; | ||
if (!hash) { | ||
|
@@ -652,19 +676,22 @@ class URLSearchParams { | |
if (pair.length !== 2) { | ||
throw new TypeError('Each query pair must be a name/value tuple'); | ||
} | ||
this[searchParams].push(String(pair[0]), String(pair[1])); | ||
const key = toUSVString(pair[0]); | ||
const value = toUSVString(pair[1]); | ||
this[searchParams].push(key, value); | ||
} | ||
} else { | ||
// record<USVString, USVString> | ||
this[searchParams] = []; | ||
for (const key of Object.keys(init)) { | ||
const value = String(init[key]); | ||
for (var key of Object.keys(init)) { | ||
key = toUSVString(key); | ||
const value = toUSVString(init[key]); | ||
this[searchParams].push(key, value); | ||
} | ||
} | ||
} else { | ||
// USVString | ||
init = String(init); | ||
init = toUSVString(init); | ||
if (init[0] === '?') init = init.slice(1); | ||
initSearchParams(this, init); | ||
} | ||
|
@@ -743,8 +770,8 @@ defineIDLClass(URLSearchParams.prototype, 'URLSearchParams', { | |
throw new TypeError('"name" and "value" arguments must be specified'); | ||
} | ||
|
||
name = String(name); | ||
value = String(value); | ||
name = toUSVString(name); | ||
value = toUSVString(value); | ||
this[searchParams].push(name, value); | ||
update(this[context], this); | ||
}, | ||
|
@@ -758,7 +785,7 @@ defineIDLClass(URLSearchParams.prototype, 'URLSearchParams', { | |
} | ||
|
||
const list = this[searchParams]; | ||
name = String(name); | ||
name = toUSVString(name); | ||
for (var i = 0; i < list.length;) { | ||
const cur = list[i]; | ||
if (cur === name) { | ||
|
@@ -779,7 +806,7 @@ defineIDLClass(URLSearchParams.prototype, 'URLSearchParams', { | |
} | ||
|
||
const list = this[searchParams]; | ||
name = String(name); | ||
name = toUSVString(name); | ||
for (var i = 0; i < list.length; i += 2) { | ||
if (list[i] === name) { | ||
return list[i + 1]; | ||
|
@@ -798,7 +825,7 @@ defineIDLClass(URLSearchParams.prototype, 'URLSearchParams', { | |
|
||
const list = this[searchParams]; | ||
const values = []; | ||
name = String(name); | ||
name = toUSVString(name); | ||
for (var i = 0; i < list.length; i += 2) { | ||
if (list[i] === name) { | ||
values.push(list[i + 1]); | ||
|
@@ -816,7 +843,7 @@ defineIDLClass(URLSearchParams.prototype, 'URLSearchParams', { | |
} | ||
|
||
const list = this[searchParams]; | ||
name = String(name); | ||
name = toUSVString(name); | ||
for (var i = 0; i < list.length; i += 2) { | ||
if (list[i] === name) { | ||
return true; | ||
|
@@ -834,8 +861,8 @@ defineIDLClass(URLSearchParams.prototype, 'URLSearchParams', { | |
} | ||
|
||
const list = this[searchParams]; | ||
name = String(name); | ||
value = String(value); | ||
name = toUSVString(name); | ||
value = toUSVString(value); | ||
|
||
// If there are any name-value pairs whose name is `name`, in `list`, set | ||
// the value of the first such name-value pair to `value` and remove the | ||
|
@@ -1098,11 +1125,13 @@ function originFor(url, base) { | |
} | ||
|
||
function domainToASCII(domain) { | ||
return binding.domainToASCII(String(domain)); | ||
// toUSVString is not needed. | ||
return binding.domainToASCII('' + domain); | ||
} | ||
|
||
function domainToUnicode(domain) { | ||
return binding.domainToUnicode(String(domain)); | ||
// toUSVString is not needed. | ||
return binding.domainToUnicode('' + domain); | ||
} | ||
|
||
// Utility function that converts a URL object into an ordinary | ||
|
@@ -1188,11 +1217,14 @@ function getPathFromURL(path) { | |
return isWindows ? getPathFromURLWin32(path) : getPathFromURLPosix(path); | ||
} | ||
|
||
exports.getPathFromURL = getPathFromURL; | ||
exports.URL = URL; | ||
exports.URLSearchParams = URLSearchParams; | ||
exports.domainToASCII = domainToASCII; | ||
exports.domainToUnicode = domainToUnicode; | ||
exports.urlToOptions = urlToOptions; | ||
exports.formatSymbol = kFormat; | ||
exports.searchParamsSymbol = searchParams; | ||
module.exports = { | ||
toUSVString, | ||
getPathFromURL, | ||
URL, | ||
URLSearchParams, | ||
domainToASCII, | ||
domainToUnicode, | ||
urlToOptions, | ||
formatSymbol: kFormat, | ||
searchParamsSymbol: searchParams | ||
}; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
This will not perform ToString(), but instead ToPrimitive(). For example, if val is
{ toString() { return "5"; }, toPrimitive() { return "6"; }
, you will get"6"
.