[webkit-reviews] review granted: [Bug 205979] REGRESSION (r253662): Large Data URLs are not being handled properly : [Attachment 387173] Patch

[bugzilla-daemon at webkit.org]

youenn fablet <youennf at gmail.com> has granted Brent Fulgham
<bfulgham at webkit.org>'s request for review:
Bug 205979: REGRESSION (r253662): Large Data URLs are not being handled
properly
https://bugs.webkit.org/show_bug.cgi?id=205979

Attachment 387173: Patch

https://bugs.webkit.org/attachment.cgi?id=387173&action=review




--- Comment #9 from youenn fablet <youennf at gmail.com> ---
Comment on attachment 387173
  --> https://bugs.webkit.org/attachment.cgi?id=387173
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=387173&action=review

>> Source/WebCore/page/SecurityOrigin.cpp:49
>> +constexpr unsigned maximumURLSize = 0x04000000;
> 
> This changes from 32 KB to 64 MB, which might be too big for
memory-constrained devices. Might be good to keep the limit and just skip the
check for data URIs?

Should we add a 32KB+1 data URL test?

> Or bump the standard URL limit, but have a much larger limit for data URIs
only?

I think it might be best to bump to 64 MB.
We do not know what happens for custom schemes for instance.
Also, javascript scheme should probably have the same constraint has data URL.

We could also decide to decrease specific schemes like HTTP/HTTPS/FTP URLs back
to 0x8000 if that is adding some kind of protection.