Title: [144549] trunk/Source/WebCore
- Revision
- 144549
- Author
- [email protected]
- Date
- 2013-03-02 17:45:58 -0800 (Sat, 02 Mar 2013)
Log Message
XSSAuditor has a subtle race condition when used with the threaded HTML parser
https://bugs.webkit.org/show_bug.cgi?id=111253
Reviewed by Eric Seidel.
We were refing and derefing a StringImpl for a main-thread
AtomicString. Using QualifiedNames on the background thread is very
fragile and we should figure out a more robust solution.
* html/parser/XSSAuditor.cpp:
(WebCore::findAttributeWithName):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (144548 => 144549)
--- trunk/Source/WebCore/ChangeLog 2013-03-03 00:57:26 UTC (rev 144548)
+++ trunk/Source/WebCore/ChangeLog 2013-03-03 01:45:58 UTC (rev 144549)
@@ -1,3 +1,17 @@
+2013-03-02 Adam Barth <[email protected]>
+
+ XSSAuditor has a subtle race condition when used with the threaded HTML parser
+ https://bugs.webkit.org/show_bug.cgi?id=111253
+
+ Reviewed by Eric Seidel.
+
+ We were refing and derefing a StringImpl for a main-thread
+ AtomicString. Using QualifiedNames on the background thread is very
+ fragile and we should figure out a more robust solution.
+
+ * html/parser/XSSAuditor.cpp:
+ (WebCore::findAttributeWithName):
+
2013-03-02 Benjamin Poulain <[email protected]>
Move computedStyleIncludingVisitedInfo from TestRunner to Internals
Modified: trunk/Source/WebCore/html/parser/XSSAuditor.cpp (144548 => 144549)
--- trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2013-03-03 00:57:26 UTC (rev 144548)
+++ trunk/Source/WebCore/html/parser/XSSAuditor.cpp 2013-03-03 01:45:58 UTC (rev 144549)
@@ -127,11 +127,9 @@
static bool findAttributeWithName(const HTMLToken& token, const QualifiedName& name, size_t& indexOfMatchingAttribute)
{
- String attrName = name.localName().string();
+ // Notice that we're careful not to ref the StringImpl here because we might be on a background thread.
+ const String& attrName = name.namespaceURI() == XLinkNames::xlinkNamespaceURI ? "xlink:" + name.localName().string() : name.localName().string();
- if (name.namespaceURI() == XLinkNames::xlinkNamespaceURI)
- attrName = "xlink:" + attrName;
-
for (size_t i = 0; i < token.attributes().size(); ++i) {
if (equalIgnoringNullity(token.attributes().at(i).name, attrName)) {
indexOfMatchingAttribute = i;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
