Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fac50442561859ce96263a686864803d53965d4a
https://github.com/WebKit/WebKit/commit/fac50442561859ce96263a686864803d53965d4a
Author: Chris Dumez <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
M Source/WTF/wtf/UUID.cpp
M Tools/TestWebKitAPI/Tests/WTF/UUID.cpp
Log Message:
-----------
UUID::parse fails to reject a leading '+' in the third segment
https://bugs.webkit.org/show_bug.cgi?id=319229
Reviewed by Darin Adler and Yusuke Suzuki.
parseInteger() silently accepts a single leading '+', so UUID::parse()
guards against a '+' at the start of each segment before delegating to
it. The five segments begin at indices 0, 9, 14, 19 and 24, but the
guard checked only 0, 9, 19 and 24 -- the third segment (index 14) was
omitted.
As a result a malformed string such as
"01234567-89ab-+def-0123-456789abcdef" was accepted and aliased to the
canonical "01234567-89ab-0def-0123-456789abcdef", so two distinct
strings mapped to a single UUID identity. Add the missing index-14
check.
This gap could not be caught through parseVersion4(): a leading '+' at
index 14 consumes a character slot, leaving only 3 hex digits, so the
version nibble can never be 4 and the version check rejects the input
before the '+' would matter. The new test therefore exercises parse()
directly.
Test: WTF.UUIDParseRejectsLeadingPlusInEachSegment
* Source/WTF/wtf/UUID.cpp:
(WTF::UUID::parse):
* Tools/TestWebKitAPI/Tests/WTF/UUID.cpp:
(TEST(WTF, UUIDParseRejectsLeadingPlusInEachSegment)):
Canonical link: https://commits.webkit.org/317089@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
