725440 - Filter strings script inserts into SVGStringList, and throw more

Status: NEW

(Core :: SVG, defect)

Description

[Jonathan Watt [:jwatt]]

When the SVGStringList methods initialize(), insertItemBefore(), replaceItem() and appendItem() are used to insert bad things into a string list, we should really throw. After bug 724993's fix we'll throw for null and the empty string. We should:

* probably also throw for strings containing whitespace (list items are supposed to be separated by whitespace, so allowing this breaks round-tripping)
* maybe throw for strings containing any control characters, and maybe containing any non-ASCII characters?

It would be handy if nsAString had a 'find_first_of'-like method to assist with this. Alternatively we could convert the nsAString to a C-string and use strpbrk.

We should probably get the desired behavior clarified in the spec too.

Comment 1

[Robert Longson [:longsonr]]

systemLanguage is separated by commas, the others are space separated.

Comment 2

[Jonathan Watt [:jwatt]]

We can just add a flag to the stringListInfo (or somewhere) saying what's allowed. In the case of systemLanguage it seems like we'd want to ban commas too then.

Comment 3

[Robert Longson [:longsonr]]

we have a flag already but yes commas should not be allowed in systemLanguage

Comment 4

[Cameron McCormack (:heycam)]

Sounds good to me.  Filed https://www.w3.org/Graphics/SVG/WG/track/issues/2437 on the spec.

Comment 5

[Robert Longson [:longsonr]]

Filed an updated issue in the new tracker: https://github.com/w3c/svgwg/issues/930