Attachment #178728 for bug #96614

View Details Raw Unified Return to Bug 96614

| Differences between



2012-12-10  Michael Pruett  <michael@68k.org>

        IndexedDB: Check whether keyPath is an array before accessing as array
        https://bugs.webkit.org/show_bug.cgi?id=96614

        Reviewed by NOBODY (OOPS!).

        IDBDatabase::createObjectStore() should check whether the keyPath
        property in the options dictionary is an array before accessing the
        property as an array.

        Tests: storage/indexeddb/*

        * Modules/indexeddb/IDBDatabase.cpp:
        (WebCore::IDBDatabase::createObjectStore):
        * bindings/js/Dictionary.cpp:
        (WebCore::Dictionary::isSequence):
        (WebCore):
        * bindings/js/Dictionary.h:
        (Dictionary):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::isSequence):
        (WebCore):
        * bindings/js/JSDictionary.h:
        (JSDictionary):
        * bindings/v8/Dictionary.cpp:
        (WebCore::Dictionary::isSequence):
        (WebCore):
        * bindings/v8/Dictionary.h:
        (Dictionary):

2012-12-10  KyungTae Kim  <ktf.kim@samsung.com>

        Build fix after r137221

Lines 154-160 PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, co a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp_sec1
- a/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp -1 / +1 lines
154	if (!options.isUndefinedOrNull()) {	154	if (!options.isUndefinedOrNull()) {
155	String keyPathString;	155	String keyPathString;
156	Vector<String> keyPathArray;	156	Vector<String> keyPathArray;
157	if (options.get("keyPath", keyPathArray))	157	if (options.isSequence("keyPath") && options.get("keyPath", keyPathArray))
158	keyPath = IDBKeyPath(keyPathArray);	158	keyPath = IDBKeyPath(keyPathArray);
159	else if (options.getWithUndefinedOrNullCheck("keyPath", keyPathString))	159	else if (options.getWithUndefinedOrNullCheck("keyPath", keyPathString))
160	keyPath = IDBKeyPath(keyPathString);	160	keyPath = IDBKeyPath(keyPathString);

Lines 103-106 bool Dictionary::getWithUndefinedOrNullCheck(const String& propertyName, String& a/Source/WebCore/bindings/js/Dictionary.cpp_sec1
- a/Source/WebCore/bindings/js/Dictionary.cpp +5 lines
103	return m_dictionary.getWithUndefinedOrNullCheck(propertyName, value);	103	return m_dictionary.getWithUndefinedOrNullCheck(propertyName, value);
104	}	104	}
105		105
		106	bool Dictionary::isSequence(const String& propertyName) const
		107	{
		108	return m_dictionary.isSequence(propertyName);
		109	}
		110
106	};	111	};

Lines 64-69 public: a/Source/WebCore/bindings/js/Dictionary.h_sec1
- a/Source/WebCore/bindings/js/Dictionary.h +2 lines
64	bool getOwnPropertyNames(Vector<String>&) const;	64	bool getOwnPropertyNames(Vector<String>&) const;
65	bool getWithUndefinedOrNullCheck(const String& propertyName, String& value) const;	65	bool getWithUndefinedOrNullCheck(const String& propertyName, String& value) const;
66		66
		67	bool isSequence(const String& propertyName) const;
		68
67	private:	69	private:
68	template <typename T>	70	template <typename T>
69	JSC::JSObject* asJSObject(T*) const;	71	JSC::JSObject* asJSObject(T*) const;



    return true;
}

bool JSDictionary::isSequence(const String& propertyName) const
{
    ASSERT(isValid());
    JSValue value;
    if (tryGetProperty(propertyName.utf8().data(), value) != PropertyFound)
        return false;
    if (!value.isObject())
        return false;

    JSObject* object = value.getObject();
    JSValue lengthValue = object->get(m_exec, m_exec->propertyNames().length);
    if (m_exec->hadException())
        return false;
    if (lengthValue.isUndefinedOrNull())
        return false;
    lengthValue.toUInt32(m_exec);
    if (m_exec->hadException())
        return false;
    return true;
}

} // namespace WebCore

Lines 65-70 public: a/Source/WebCore/bindings/js/JSDictionary.h_sec1
- a/Source/WebCore/bindings/js/JSDictionary.h +2 lines
65	bool get(const char* propertyName, Result&) const;	65	bool get(const char* propertyName, Result&) const;
66	bool getWithUndefinedOrNullCheck(const String& propertyName, String& value) const;	66	bool getWithUndefinedOrNullCheck(const String& propertyName, String& value) const;
67		67
		68	bool isSequence(const String& propertyName) const;
		69
68	JSC::ExecState* execState() const { return m_exec; }	70	JSC::ExecState* execState() const { return m_exec; }
69	JSC::JSObject* initializerObject() const { return m_initializerObject.get(); }	71	JSC::JSObject* initializerObject() const { return m_initializerObject.get(); }
70	bool isValid() const { return m_exec && m_initializerObject; }	72	bool isValid() const { return m_exec && m_initializerObject; }

Lines 531-534 bool Dictionary::getOwnPropertyNames(Vector<String>& names) const a/Source/WebCore/bindings/v8/Dictionary.cpp_sec1
- a/Source/WebCore/bindings/v8/Dictionary.cpp +9 lines
531	return true;	531	return true;
532	}	532	}
533		533
		534	bool Dictionary::isSequence(const String& key) const
		535	{
		536	v8::Local<v8::Value> v8Value;
		537	if (!getKey(key, v8Value))
		538	return false;
		539
		540	return v8Value->IsArray();
		541	}
		542
534	} // namespace WebCore	543	} // namespace WebCore

Lines 97-102 public: a/Source/WebCore/bindings/v8/Dictionary.h_sec1
- a/Source/WebCore/bindings/v8/Dictionary.h -1 / +2 lines
97		97
98	PassRefPtr<EventListener> getEventListener(const String&, Notification*) const { return 0; }	98	PassRefPtr<EventListener> getEventListener(const String&, Notification*) const { return 0; }
99		99
		100	bool isSequence(const String&) const;
		101
100	private:	102	private:
101	bool getKey(const String& key, v8::Local<v8::Value>&) const;	103	bool getKey(const String& key, v8::Local<v8::Value>&) const;
102		104
103	-

Return to Bug 96614

Lines 228-231 bool JSDictionary::getWithUndefinedOrNullCheck(const String& propertyName, Strin a/Source/WebCore/bindings/js/JSDictionary.cpp_sec1
- a/Source/WebCore/bindings/js/JSDictionary.cpp +21 lines
228	return true;	228	return true;
229	}	229	}
230		230
		231	bool JSDictionary::isSequence(const String& propertyName) const
		232	{
		233	ASSERT(isValid());
		234	JSValue value;
		235	if (tryGetProperty(propertyName.utf8().data(), value) != PropertyFound)
		236	return false;
		237	if (!value.isObject())
		238	return false;
		239
		240	JSObject* object = value.getObject();
		241	JSValue lengthValue = object->get(m_exec, m_exec->propertyNames().length);
		242	if (m_exec->hadException())
		243	return false;
		244	if (lengthValue.isUndefinedOrNull())
		245	return false;
		246	lengthValue.toUInt32(m_exec);
		247	if (m_exec->hadException())
		248	return false;
		249	return true;
		250	}
		251
231	} // namespace WebCore	252	} // namespace WebCore

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +31 lines
		1	2012-12-10 Michael Pruett <michael@68k.org>
		2
		3	IndexedDB: Check whether keyPath is an array before accessing as array
		4	https://bugs.webkit.org/show_bug.cgi?id=96614
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	IDBDatabase::createObjectStore() should check whether the keyPath
		9	property in the options dictionary is an array before accessing the
		10	property as an array.
		11
		12	Tests: storage/indexeddb/*
		13
		14	* Modules/indexeddb/IDBDatabase.cpp:
		15	(WebCore::IDBDatabase::createObjectStore):
		16	* bindings/js/Dictionary.cpp:
		17	(WebCore::Dictionary::isSequence):
		18	(WebCore):
		19	* bindings/js/Dictionary.h:
		20	(Dictionary):
		21	* bindings/js/JSDictionary.cpp:
		22	(WebCore::JSDictionary::isSequence):
		23	(WebCore):
		24	* bindings/js/JSDictionary.h:
		25	(JSDictionary):
		26	* bindings/v8/Dictionary.cpp:
		27	(WebCore::Dictionary::isSequence):
		28	(WebCore):
		29	* bindings/v8/Dictionary.h:
		30	(Dictionary):
		31
1	2012-12-10 KyungTae Kim <ktf.kim@samsung.com>	32	2012-12-10 KyungTae Kim <ktf.kim@samsung.com>
2		33
3	Build fix after r137221	34	Build fix after r137221