1189349 - Use mozilla::Tokenizer here and there

Status: NEW

(Core :: General, defect)

Comment 1

[Honza Bambas (:mayhemer)]

Not actively working on this right now, but once would love to.

Comment 2

[Swapnesh Kumar Sahoo [:swapneshks]]

Hi.. I would like to work on this bug.
I'm a beginner and still catching up to things...

Comment 3

[Honza Bambas (:mayhemer)]

(In reply to swapneshks from comment #2)
> Hi.. I would like to work on this bug.
> I'm a beginner and still catching up to things...

Thank you.  Unfortunatelly there is currently no one who would give you a guidance/mentoring right now, since all teams, specially the Necko (networking) team are pretty busy with priority projects.

This bug has a very low priority, it's only about a code cleanup.

If you write patches for this bug, there will probably be nobody to give you quickly a good feedback.

Thanks.

Comment 4

[Videet Singhai]

Is this issue active?

Comment 5

[Honza Bambas (:mayhemer)]

(In reply to Videet Singhai from comment #4)
> Is this issue active?

Nobody is actively working on it, but it's good to keep it on the list of open bugs.  When resources are available (=a developer has a spare time) it's worth to act.

Comment 6

[Videet Singhai]

Can you explain what is to be done?

Comment 7

[Honza Bambas (:mayhemer)]

(In reply to Videet Singhai from comment #6)
> Can you explain what is to be done?

Sure.  On many places in the code we have to parse some input, being it a HTTP response header, or any arbitrary input parsing, we may still use strstr, strchr, strcmp etc C function, which are unsafe and making the code potentially vulnerable, plus making such a code hard to maintain and change.

I used to have a list of things to change, but unfortunately can't find it right now.  If you are willing to wait a day or so, I can provide it with some instructions and example how to migrate to using the modern Tokenizer API.

Thank you.

Comment 8

[vinf100]

Do the changes need to be done in a specific component, or is just all over the place?

Comment 9

[Honza Bambas (:mayhemer)]

(In reply to vinf100 from comment #8)
> Do the changes need to be done in a specific component, or is just all over
> the place?

Sorry for late answer.  I think I can say this can effect the whole platform, so - all over the place, yes.

Comment 10

[vinf100]

(In reply to (away till 13.8.) Honza Bambas (:mayhemer) from comment #7)
> (In reply to Videet Singhai from comment #6)
> > Can you explain what is to be done?
> 
> Sure.  On many places in the code we have to parse some input, being it a
> HTTP response header, or any arbitrary input parsing, we may still use
> strstr, strchr, strcmp etc C function, which are unsafe and making the code
> potentially vulnerable, plus making such a code hard to maintain and change.
> 
> I used to have a list of things to change, but unfortunately can't find it
> right now.  If you are willing to wait a day or so, I can provide it with
> some instructions and example how to migrate to using the modern Tokenizer
> API.
> 
> Thank you.

Do you still have the list of necessary changes, as well as the instructions?

Comment 11

[Srujana Peddinti [:srujana121]]

Hi, I want to work on this bug. Is this still active?

Comment 12

[Honza Bambas (:mayhemer)]

(In reply to Srujana Peddinti from comment #11)

Hi, I want to work on this bug. Is this still active?

Yes. Thanks! I just filed bug 1542293, which you can freely take. I can feedback any early patches and give advises.

Comment 13

[Srujana Peddinti [:srujana121]]

(In reply to Honza Bambas (:mayhemer) from comment #12)

Yes. Thanks! I just filed bug 1542293, which you can freely take. I can feedback any early patches and give advises.

Sure, thank you. I have commented there. Sorry for the late reply, I was occupied with a couple of other things last week.