784367 - Problem on non-ASCII document.cookie & document.write

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Masahiro YAMADA]

From https://twitter.com/jackmasa/status/236843727086317569

Following code writes '<img src="xx:x" onerror="alert(1)">' to document.
Is this by design or bug ?
<script>
  with(document)cookie='∼≩≭≧∯≳≲≣∽≸≸∺≸∠≯≮≥≲≲≯≲∽≡≬≥≲≴∨∱∩∾',write(cookie); 
</script>

Comment 1

[Frederik Braun [:freddy]]

line 1288 is probably causing all this:
http://dxr.lanedo.com/mozilla-central/content/html/document/src/nsHTMLDocument.cpp.html#l1288

Comment 2

[Masatoshi Kimura [:emk]]

document.cookie must be encoded/decoded as UTF-8 per spec.
http://dev.w3.org/html5/spec/single-page.html#dom-document-cookie

Comment 3

[Masatoshi Kimura [:emk]]

Attachment: encode/decode document.cookie as UTF-8 per HTML5 spec

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 654178 [details] [diff] [review]
encode/decode document.cookie as UTF-8 per HTML5 spec

r=me, but please add a test or two?

Comment 5

[Masatoshi Kimura [:emk]]

Attachment: encode/decode document.cookie as UTF-8 per HTML5 spec

Ugh, ConvertStringFromCharset("utf-8") also failed if the string is invalid as UTF-8...
> please add a test or two?
Done. one for decoding non-UTF-8 string from HTTP header, and the other for the  example in comment #0.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 657718 [details] [diff] [review]
encode/decode document.cookie as UTF-8 per HTML5 spec

Do we have an existing bug on the missing kOnError_Recover support?  If so, please link this code from that bug and add the bug number to the comment.  If we don't have one, please file one and then do the above.

r=me

Comment 7

[Masatoshi Kimura [:emk]]

Attachment: patch for check in. r=bzbarsky

I found bug 638379.

Comment 8

[Masatoshi Kimura [:emk]]

https://tbpl.mozilla.org/?tree=Try&rev=6c0769e869aa

Comment 9

[Ryan VanderMeulen [:RyanVM]]

(In reply to Masatoshi Kimura [:emk] from comment #8)
> https://tbpl.mozilla.org/?tree=Try&rev=6c0769e869aa

Green on Try.

https://hg.mozilla.org/integration/mozilla-inbound/rev/af0971ca7acd

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/af0971ca7acd

Comment 11

[Masahiro YAMADA]

-> VERIFIED
Tested at Nightly/Windows build from http://hg.mozilla.org/mozilla-central/rev/0d3b17a88d5f