mirror of
https://github.com/servo/servo.git
synced 2025-08-06 06:00:15 +01:00
dom: Always replace unpaired surrogates when handling page text (#35381)
Background: > JavaScript strings are potentially ill-formed UTF-16 (arbitrary > Vec<u16>) and can contain unpaired surrogates. Rust’s String type is > well-formed UTF-8 and can not contain any surrogate. Surrogates are > never emitted when decoding bytes from the network, but they can sneak > in through document.write, the Element.innerHtml setter, or other DOM > APIs. In 2015, Servo launched an experiment to see if unpaired surrogates cropped up in page content. That experiment caused Servo to panic if unpaired surrogates were encountered with a request to report the page to bug #6564. During that time several pages were reported with unpaired surrogates, causing Servo to panic. In addition, when running the WPT tests Servo will never panic due to the `-Z replace-surrogates` option being passed by the test driver. Motivation: After this 10 year experiment, it's clear that unpaired surrogates are a real concern in page content. Several reports were filed of Servo panicking after encountering them in real world pages. A complete fix for this issue would be to somehow maintain unpaired surrogates in the DOM, but that is a much larger task than simply emitting U+FFD instead of an unpaired surrogate. Since it is clear that this kind of content exists, it is better for Servo to try its best to handle the content rather than crash as production browsers should not crash due to user content when possible. In this change, I modify Servo to always replace unpaired surrogates. It would have been ideal to only crash when debug assertions are enabled, but debug assertions are enabled by default in release mode -- so this wouldn't be effective for WPT tests. Signed-off-by: Martin Robinson <mrobinson@igalia.com>
This commit is contained in:
parent
b483cdb786
commit
75cf3d7265
10 changed files with 17 additions and 90 deletions
|
@ -174,11 +174,9 @@ pub fn is_token(s: &[u8]) -> bool {
|
|||
/// unpaired surrogates.
|
||||
///
|
||||
/// The hypothesis is that it does not matter much how exactly those values are
|
||||
/// transformed, because passing unpaired surrogates into the DOM is very rare.
|
||||
/// In order to test this hypothesis, Servo will panic when encountering any
|
||||
/// unpaired surrogates on conversion to `DOMString` by default. (The command
|
||||
/// line option `-Z replace-surrogates` instead causes Servo to replace the
|
||||
/// unpaired surrogate by a U+FFFD replacement character.)
|
||||
/// transformed, because passing unpaired surrogates into the DOM is very rare.
|
||||
/// Instead Servo withh replace the unpaired surrogate by a U+FFFD replacement
|
||||
/// character.
|
||||
///
|
||||
/// Currently, the lack of crash reports about this issue provides some
|
||||
/// evidence to support the hypothesis. This evidence will hopefully be used to
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue