Skip to content
  • tkent@chromium.org's avatar
    Validate form state strings in FormController::setStateForNewFormElements() · bcc71634
    tkent@chromium.org authored
    https://bugs.webkit.org/show_bug.cgi?id=88768
    
    Reviewed by Hajime Morita.
    
    .:
    
    * Source/autotools/symbols.filter: Expose some symbols used by Internals.cpp.
    
    Source/WebCore:
    
    Reject invalid form state vectors. This state vectors are generated by
    WebKit itself. However it can be invalid because
    - Serialized state vectors can be corrupted
    - A future version of WebKit might change the format
    
    So we had better reject unexpected state vectors as possible.
    
    Test: fast/forms/state-restore-broken-state.html
    
    * WebCore.exp.in: Expose some symbols used by Internals.cpp.
    * html/FormController.cpp:
    (WebCore::isNotFormControlTypeCharacter): A helper for state validation.
    (WebCore::FormController::setStateForNewFormElements):
    Reject state vectors of which size is not a multiple of 3, or a type name is invalid.
    * testing/Internals.cpp:
    (WebCore::Internals::formControlStateOfPreviousHistoryItem):
    Returns a form state vector of the previous document.
    (WebCore::Internals::setFormControlStateOfPreviousHistoryItem):
    Sets a form state vector for the previous document.
    * testing/Internals.h: Declare new functions.
    * testing/Internals.idl: ditto.
    
    Source/WebKit2:
    
    * win/WebKit2.def: Expose some symbols used by Internals.cpp.
    * win/WebKit2CFLite.def: ditto.
    
    LayoutTests:
    
    * fast/forms/resources/state-restore-broken-state-1.html: Added.
    * fast/forms/resources/state-restore-broken-state-2.html: Added.
    * fast/forms/state-restore-broken-state-expected.txt: Added.
    * fast/forms/state-restore-broken-state.html: Added.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@120397 268f45cc-cd09-0410-ab3c-d52691b4dbfc
    bcc71634