Closed
Bug 730531
Opened 13 years ago
Closed 6 years ago
escape document titles in sessionstore
Categories
(Firefox :: Session Restore, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: zpao, Unassigned)
References
Details
(Keywords: sec-moderate, Whiteboard: [sg:moderate])
Attachments
(1 file, 1 obsolete file)
|
(deleted),
patch
|
dietrich
:
review+
|
Details | Diff | Splinter Review |
We could just encode/decodeURIComponent or do some simple regex replacement.
|
||
Updated•13 years ago
|
Whiteboard: [sg:moderate]
|
Reporter | |
Comment 1•13 years ago
|
||
This has breaking effects, but would have the least perf impact. I wanted to filter at JSON.stringify but that was a pretty bad hit last time. The breakage is that the data we export from our APIs will have title encoded so will have to be decoded on the consumer end.
I haven't touched the internal consumers yet. I know there are least a couple (sync, history menu).
Assignee: nobody → paul
Attachment #601851 -
Flags: feedback?(dietrich)
|
||
Comment 2•13 years ago
|
||
Comment on attachment 601851 [details] [diff] [review]
Patch v0.1 (WIP)
Review of attachment 601851 [details] [diff] [review]:
-----------------------------------------------------------------
looks fine. should test it in final patch.
Attachment #601851 -
Flags: feedback?(dietrich) → feedback+
|
|
Reporter | |
Comment 3•13 years ago
|
||
Attachment #601851 -
Attachment is obsolete: true
Attachment #617979 -
Flags: review?(dietrich)
|
|
||
Comment 4•13 years ago
|
||
Comment on attachment 617979 [details] [diff] [review]
Patch v0.2
Review of attachment 617979 [details] [diff] [review]:
-----------------------------------------------------------------
per talk IRL, r=me with a simple api regression test added.
Attachment #617979 -
Flags: review?(dietrich) → review+
|
||
Updated•13 years ago
|
Keywords: sec-moderate
|
|
Reporter | |
Updated•11 years ago
|
Assignee: paul → nobody
|
||
Updated•9 years ago
|
Group: core-security → firefox-core-security
|
||
Comment 5•6 years ago
|
||
Since we're now compressing the sessionstore file, which includes form data, this is not an issue anymore.
Gijs, can you remove the sec group from this one too?
Status: NEW → RESOLVED
Closed: 6 years ago
Depends on: 934967
Flags: needinfo?(gijskruitbosch+bugs)
Resolution: --- → WORKSFORME
|
||
Updated•6 years ago
|
Group: firefox-core-security
Flags: needinfo?(gijskruitbosch+bugs)
You need to log in
before you can comment on or make changes to this bug.
Description
•