1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

QCborValue: check parsing of invalid URL

Browse Source 
QUrl will reject invalid URLs for us, so we don't get normalization. The
original junk should be retrievable, of course.

Change-Id: Ibdc95e9af7bd456a94ecfffd160610f5b2c8e1a2
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
This commit is contained in:
Thiago Macieira 2020-04-15 15:16:06 -03:00
parent 8366c06d46
commit 821e71fded
2 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/corelib/serialization/qcborvalue.cpp
View File

@ -827,9 +827,11 @@ static QCborValue::Type convertToExtendedType(QCborContainerPrivate *d)
// normalize to a short (decoded) form, so as to save space // normalize to a short (decoded) form, so as to save space
QUrl url(e.flags & Element::StringIsUtf16 ? QUrl url(e.flags & Element::StringIsUtf16 ?
b->asQStringRaw() : b->asQStringRaw() :
b->toUtf8String()); b->toUtf8String(), QUrl::StrictMode);
QByteArray encoded = url.toString(QUrl::DecodeReserved).toUtf8(); if (url.isValid()) {
replaceByteData(encoded, encoded.size(), {}); QByteArray encoded = url.toString(QUrl::DecodeReserved).toUtf8();
replaceByteData(encoded, encoded.size(), {});
}
} }
return QCborValue::Url; return QCborValue::Url;
} }

8
tests/auto/corelib/serialization/qcborvalue/tst_qcborvalue.cpp
View File

@ -2053,6 +2053,14 @@ void tst_QCborValue::extendedTypeValidation_data()
qSwap(c, dt[i]); qSwap(c, dt[i]);
} }
} }
// Improperly-encoded URLs
{
const char badurl[] = "%zz";
QTest::newRow("Url:Invalid")
<< encode(0xd8, int(QCborKnownTags::Url), 0x60 + int(strlen(badurl)), badurl)
<< QCborValue(QCborKnownTags::Url, QLatin1String(badurl));
}
} }
void tst_QCborValue::extendedTypeValidation() void tst_QCborValue::extendedTypeValidation()