File: browser_467409-backslashplosion.js

package info (click to toggle)
wine-gecko-2.21 2.21%2Bdfsg2-1
  • links: PTS, VCS
  • area: main
  • in suites: jessie, jessie-kfreebsd
  • size: 646,272 kB
  • ctags: 630,086
  • sloc: cpp: 2,895,786; ansic: 1,502,970; python: 156,675; asm: 115,373; java: 111,421; sh: 63,309; xml: 62,872; makefile: 58,685; perl: 19,182; objc: 3,461; yacc: 2,051; lex: 979; pascal: 929; exp: 449; php: 244; lisp: 228; awk: 211; sed: 26; csh: 21; ada: 16; ruby: 3
file content (91 lines) | stat: -rw-r--r-- 3,699 bytes parent folder | download | duplicates (7)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
/* Any copyright is dedicated to the Public Domain.
   http://creativecommons.org/publicdomain/zero/1.0/ */

// Test Summary:
// 1.  Open about:sessionrestore via setBrowserState where formdata is a JS object, not a string
// 1a. Check that #sessionData on the page is readable after JSON.parse (skipped, checking formdata is sufficient)
// 1b. Check that there are no backslashes in the formdata
// 1c. Check that formdata (via getBrowserState) doesn't require JSON.parse
//
// 2.  Use the current state (currently about:sessionrestore with data) and then open than in a new instance of about:sessionrestore
// 2a. Check that there are no backslashes in the formdata
// 2b. Check that formdata (via getBrowserState) doesn't require JSON.parse
//
// 3.  [backwards compat] Use a stringified state as formdata when opening about:sessionrestore
// 3a. Make sure there are nodes in the tree on about:sessionrestore (skipped, checking formdata is sufficient)
// 3b. Check that there are no backslashes in the formdata
// 3c. Check that formdata (via getBrowserState) doesn't require JSON.parse

function test() {
  waitForExplicitFinish();
  ignoreAllUncaughtExceptions();

  let blankState = { windows: [{ tabs: [{ entries: [{ url: "about:blank" }] }]}]};
  let crashState = { windows: [{ tabs: [{ entries: [{ url: "about:mozilla" }] }]}]};

  let pagedata = { url: "about:sessionrestore",
                   formdata: { id: {"sessionData": crashState } } };
  let state = { windows: [{ tabs: [{ entries: [pagedata] }] }] };

  // test1 calls test2 calls test3 calls finish
  test1(state);


  function test1(aState) {
    waitForBrowserState(aState, function() {
      checkState("test1", test2);
    });
  }

  function test2(aState) {
    let pagedata2 = { url: "about:sessionrestore",
                      formdata: { id: { "sessionData": aState } } };
    let state2 = { windows: [{ tabs: [{ entries: [pagedata2] }] }] };

    waitForBrowserState(state2, function() {
      checkState("test2", test3);
    });
  }

  function test3(aState) {
    let pagedata3 = { url: "about:sessionrestore",
                      formdata: { id: { "sessionData": JSON.stringify(crashState) } } };
    let state3 = { windows: [{ tabs: [{ entries: [pagedata3] }] }] };
    waitForBrowserState(state3, function() {
      // In theory we should do inspection of the treeview on about:sessionrestore,
      // but we don't actually need to. If we fail tests in checkState then
      // about:sessionrestore won't be able to turn the form value into a usable page.
      checkState("test3", function() waitForBrowserState(blankState, finish));
    });
  }

  function checkState(testName, callback) {
    let curState = JSON.parse(ss.getBrowserState());
    let formdata = curState.windows[0].tabs[0].entries[0].formdata;

    ok(formdata.id["sessionData"], testName + ": we have form data for about:sessionrestore");

    let sessionData_raw = JSON.stringify(formdata.id["sessionData"]);
    ok(!/\\/.test(sessionData_raw), testName + ": #sessionData contains no backslashes");
    info(sessionData_raw);

    let gotError = false;
    try {
      JSON.parse(formdata.id["sessionData"]);
    }
    catch (e) {
      info(testName + ": got error: " + e);
      gotError = true;
    }
    ok(gotError, testName + ": attempting to JSON.parse form data threw error");

    // Panorama sticks JSON into extData, which we stringify causing the
    // naive backslash check to fail. extData doesn't matter in the grand
    // scheme here, so we'll delete the extData so doesn't end up in future states.
    delete curState.windows[0].extData;
    delete curState.windows[0].tabs[0].extData;
    callback(curState);
  }

}