[Webkit-unassigned] [Bug 37327] New: String::format() does not support UTF-8, yet used with UTF-8 strings

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Fri Apr 9 06:01:44 PDT 2010


           Summary: String::format() does not support UTF-8, yet used with
                    UTF-8 strings
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: caseq at chromium.org

String::format() creates resulting string applying StringImpl::create() to
narrow char buffer resulting from vsnprintf(). StringImpl::create() treats
input data as ASCII, performing conversion to UChars by simply expanding bytes
to words, thus mangling whatever UTF-8 strings might result from vsnprintf. The
below is an incomplete list of calls where we pass UTF-8 data to

>find . -type d -name .svn -prune -o -type f | xargs grep String::format.*utf8

./inspector/InspectorController.cpp:    String message =
String::format("Profile \"webkit-profile://%s/%s#%d\" finished.",
CPUProfileType, encodeWithURLEscapeSequences(profile->title()).utf8().data(),
./inspector/InspectorController.cpp:    String message =
String::format("Profile \"webkit-profile://%s/%s#0\" started.", CPUProfileType,
./inspector/InspectorController.cpp:    String identifier = title +
String::format("@%s:%d", sourceID.utf8().data(), lineNumber);
./inspector/InspectorController.cpp:    String message = String::format("%s:
%d", title.utf8().data(), count);
./page/XSSAuditor.cpp:        String consoleMessage = String::format("Refused
to load an object. URL found within request: \"%s\".\n", url.utf8().data());
./platform/graphics/cg/ImageBufferCG.cpp:    return
String::format("data:%s;base64,%s", mimeType.utf8().data(), out.data());
./platform/graphics/qt/ImageBufferQt.cpp:    return
String::format("data:%s;base64,%s", mimeType.utf8().data(),

Note that some of the above may be harmless, as utf8() is called on the string
that is supposed to be in ASCII subset.
I suggest we introduce a version of format() that uses String::fromUTF8() to
produce resulting wide string and replace the calls above with the calls to
UTF8-aware version.

Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

More information about the webkit-unassigned mailing list