[Webkit-unassigned] [Bug 37327] New: String::format() does not support UTF-8, yet used with UTF-8 strings

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=37327

           Summary: String::format() does not support UTF-8, yet used with
                    UTF-8 strings
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: caseq at chromium.org


String::format() creates resulting string applying StringImpl::create() to
narrow char buffer resulting from vsnprintf(). StringImpl::create() treats
input data as ASCII, performing conversion to UChars by simply expanding bytes
to words, thus mangling whatever UTF-8 strings might result from vsnprintf. The
below is an incomplete list of calls where we pass UTF-8 data to
String::format():

>find . -type d -name .svn -prune -o -type f | xargs grep String::format.*utf8

./inspector/InspectorController.cpp:    String message =
String::format("Profile \"webkit-profile://%s/%s#%d\" finished.",
CPUProfileType, encodeWithURLEscapeSequences(profile->title()).utf8().data(),
profile->uid());
./inspector/InspectorController.cpp:    String message =
String::format("Profile \"webkit-profile://%s/%s#0\" started.", CPUProfileType,
encodeWithURLEscapeSequences(title).utf8().data());
./inspector/InspectorController.cpp:    String identifier = title +
String::format("@%s:%d", sourceID.utf8().data(), lineNumber);
./inspector/InspectorController.cpp:    String message = String::format("%s:
%d", title.utf8().data(), count);
./page/XSSAuditor.cpp:        String consoleMessage = String::format("Refused
to load an object. URL found within request: \"%s\".\n", url.utf8().data());
./platform/graphics/cg/ImageBufferCG.cpp:    return
String::format("data:%s;base64,%s", mimeType.utf8().data(), out.data());
./platform/graphics/qt/ImageBufferQt.cpp:    return
String::format("data:%s;base64,%s", mimeType.utf8().data(),
data.toBase64().data());

Note that some of the above may be harmless, as utf8() is called on the string
that is supposed to be in ASCII subset.
I suggest we introduce a version of format() that uses String::fromUTF8() to
produce resulting wide string and replace the calls above with the calls to
UTF8-aware version.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.