Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 94eeb1642d1c7d5be84d5147bed2809641508a73
https://github.com/WebKit/WebKit/commit/94eeb1642d1c7d5be84d5147bed2809641508a73
Author: Chris Dumez <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WTF/wtf/cocoa/NSURLExtras.mm
M Tools/TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm
Log Message:
-----------
isUserVisibleURL() inspects the wrong bytes for %-escapes and "xn--"
https://bugs.webkit.org/show_bug.cgi?id=319223
rdar://181625207
Reviewed by Darin Adler.
isUserVisibleURL() is a fast-path guard that returns YES only when
userVisibleString() is guaranteed to leave a URL unchanged; callers use
it to skip IDN / percent-escape normalization. When 286606@main
rewrote its scanning loop from a pointer that advanced each iteration
(`while (auto character = *characters++)`) into a range-for over a fixed
span, the look-ahead accesses were left as the literal indices
characters[0], characters[1] and characters[2]. Those now always refer
to the first few bytes of the string instead of the bytes following the
current character.
As a result, a percent-escape that expands to a non-ASCII byte, or an
"xn--" IDN sequence, is only detected when it happens to sit at the very
start of the string. For any URL where the triggering sequence appears
later (e.g. "http://example.com/%E2%82%AC"; or "http://xn--nxasmq6b.com/";)
the function wrongly returns YES, so the required normalization is
skipped.
Fix the look-ahead to be position-relative and bounds-checked, using
indexedRange() to iterate the span with its index. The explicit
`i + 2 < size` / `i + 3 < size` guards also make the accesses safe by
construction rather than relying on short-circuit evaluation.
Test: URLExtras.IsUserVisibleURL
* Source/WTF/wtf/cocoa/NSURLExtras.mm:
(WTF::isUserVisibleURL):
* Tools/TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm:
(TestWebKitAPI::TEST(URLExtras, IsUserVisibleURL)):
Canonical link: https://commits.webkit.org/317086@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
