387511 - CSS scanner causes parse error for URLs starting with a codepoint > 255

Status: RESOLVED FIXED

(Core :: CSS Parsing and Computation, defect)

Description

[Eli Friedman]

data:text/html;charset=utf-8,<div style="background: url(%E3%81%82.gif) blue">asdf

Expected results: the div is blue.

Actual results: the div has no background color.

The patch is quite straightforward; there's just a stray "if (ch < 256) {" in nsCSSScanner::NextURL.  Not sure how to write tests for this.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

URL parsing is seriously broken in many other ways.  See bug 337287, which I never had a chance to finish.

Comment 2

[Eli Friedman]

Bleh, the whole thing is really confusing... the spec seems to say that url(/**/a.gif) actually refers "/**/a.gif", i.e. a.gif in the directory "**".  If that's not intended, the spec really needs to be made clearer.  (My reasoning: a URI is pretty clearly specified as just sweeping up everything between the parentheses, and comments are only allowed between tokens.)

In any case, that's a different issue... this is a very straightforward fix (which I haven't gotten around to posting because it conflicts with another patch in my tree.)

Comment 3

[Eli Friedman]

Attachment: Patch

Straightforward fix; I'll also attach a diff -w to make this more reviewable.

I'll add a test for this with Bug 390399.

Comment 4

[Eli Friedman]

Attachment: Real patch

Sorry for the bugspam; I didn't mean to attach the previous.

Comment 5

[Eli Friedman]

Attachment: diff -w

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 275497 [details] [diff] [review]
Real patch

Looks reasonable, but please check in a test for this.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Comment on attachment 275497 [details] [diff] [review]
Real patch

a1.9=dbaron, although this code has many other problems (see patches in bug 337287)

Comment 8

[Eli Friedman]

Checked in with test.