Bug 129960. Special characters in computed URI values should be backslash escaped. r=hixie, sr=jst, a=asa

git-svn-id: svn://10.0.0.236/trunk@117627 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/html/style/src/nsROCSSPrimitiveValue.cpp

@@ -42,6 +42,7 @@
 #include "nsDOMError.h"
 #include "prprf.h"
 #include "nsContentUtils.h"
+#include "nsXPIDLString.h"
 
 nsROCSSPrimitiveValue::nsROCSSPrimitiveValue(nsISupports *aOwner, float aT2P)
   : mType(CSS_PX), mOwner(aOwner), mT2P(aT2P)
@@ -56,6 +57,39 @@ nsROCSSPrimitiveValue::~nsROCSSPrimitiveValue()
   Reset();
 }
 
+void
+nsROCSSPrimitiveValue::GetEscapedURI(PRUnichar *aURI, PRUnichar **aReturn)
+{
+  PRUint16 length = nsCRT::strlen(aURI);
+  PRUnichar *escaped = (PRUnichar *)nsMemory::Alloc(length * 2 * sizeof(PRUnichar) + sizeof(PRUnichar('\0')));
+
+  if (escaped) {
+    PRUnichar *ptr = escaped;
+
+    for (PRUint16 i = 0; i < length; ++i) {
+      switch (aURI[i]) {
+        case ' ' : // space
+        case '\t': // tab
+        case '(' : // opening parenthesis
+        case ')' : // closing parenthesis
+        case '\'': // single quote
+        case '"' : // double quote
+        case ',' : // comma
+        case '\\': // backslash
+          // We have one of the above special characters.
+          // Prepend it with a backslash.
+          *ptr++ = '\\';
+          break;
+        default:
+          break;
+      }
+      *ptr++ = aURI[i];
+    }
+    *ptr = 0;
+  }
+  *aReturn = escaped;
+}
+
 
 NS_IMPL_ADDREF(nsROCSSPrimitiveValue);
 NS_IMPL_RELEASE(nsROCSSPrimitiveValue);
@@ -124,8 +158,10 @@ nsROCSSPrimitiveValue::GetCssText(nsAString& aCssText)
       }
     case CSS_URI :
       {
+        nsXPIDLString uri;
+        GetEscapedURI(mValue.mString, getter_Copies(uri));
         tmpStr.Assign(NS_LITERAL_STRING("url(") +
-                      nsDependentString(mValue.mString) +
+                      uri +
                       NS_LITERAL_STRING(")"));
         break;
       }
@@ -365,12 +401,8 @@ nsROCSSPrimitiveValue::GetStringValue(nsAString& aReturn)
   switch (mType) {
     case CSS_IDENT:
     case CSS_STRING:
-      aReturn.Assign(mValue.mString);
-      break;
     case CSS_URI:
-      aReturn.Assign(NS_LITERAL_STRING("url(") +
-                     nsDependentString(mValue.mString) +
-                     NS_LITERAL_STRING(")"));
+      aReturn.Assign(mValue.mString);
       break;
     case CSS_ATTR:
     default:

mozilla/content/html/style/src/nsROCSSPrimitiveValue.h

@@ -180,6 +180,8 @@ public:
   }
 
 private:
+  void GetEscapedURI(PRUnichar *aURI, PRUnichar **aReturn);
+
   PRUint16 mType;
 
   union {

mozilla/layout/style/nsROCSSPrimitiveValue.cpp

@@ -42,6 +42,7 @@
 #include "nsDOMError.h"
 #include "prprf.h"
 #include "nsContentUtils.h"
+#include "nsXPIDLString.h"
 
 nsROCSSPrimitiveValue::nsROCSSPrimitiveValue(nsISupports *aOwner, float aT2P)
   : mType(CSS_PX), mOwner(aOwner), mT2P(aT2P)
@@ -56,6 +57,39 @@ nsROCSSPrimitiveValue::~nsROCSSPrimitiveValue()
   Reset();
 }
 
+void
+nsROCSSPrimitiveValue::GetEscapedURI(PRUnichar *aURI, PRUnichar **aReturn)
+{
+  PRUint16 length = nsCRT::strlen(aURI);
+  PRUnichar *escaped = (PRUnichar *)nsMemory::Alloc(length * 2 * sizeof(PRUnichar) + sizeof(PRUnichar('\0')));
+
+  if (escaped) {
+    PRUnichar *ptr = escaped;
+
+    for (PRUint16 i = 0; i < length; ++i) {
+      switch (aURI[i]) {
+        case ' ' : // space
+        case '\t': // tab
+        case '(' : // opening parenthesis
+        case ')' : // closing parenthesis
+        case '\'': // single quote
+        case '"' : // double quote
+        case ',' : // comma
+        case '\\': // backslash
+          // We have one of the above special characters.
+          // Prepend it with a backslash.
+          *ptr++ = '\\';
+          break;
+        default:
+          break;
+      }
+      *ptr++ = aURI[i];
+    }
+    *ptr = 0;
+  }
+  *aReturn = escaped;
+}
+
 
 NS_IMPL_ADDREF(nsROCSSPrimitiveValue);
 NS_IMPL_RELEASE(nsROCSSPrimitiveValue);
@@ -124,8 +158,10 @@ nsROCSSPrimitiveValue::GetCssText(nsAString& aCssText)
       }
     case CSS_URI :
       {
+        nsXPIDLString uri;
+        GetEscapedURI(mValue.mString, getter_Copies(uri));
         tmpStr.Assign(NS_LITERAL_STRING("url(") +
-                      nsDependentString(mValue.mString) +
+                      uri +
                       NS_LITERAL_STRING(")"));
         break;
       }
@@ -365,12 +401,8 @@ nsROCSSPrimitiveValue::GetStringValue(nsAString& aReturn)
   switch (mType) {
     case CSS_IDENT:
     case CSS_STRING:
-      aReturn.Assign(mValue.mString);
-      break;
     case CSS_URI:
-      aReturn.Assign(NS_LITERAL_STRING("url(") +
-                     nsDependentString(mValue.mString) +
-                     NS_LITERAL_STRING(")"));
+      aReturn.Assign(mValue.mString);
       break;
     case CSS_ATTR:
     default:

mozilla/layout/style/nsROCSSPrimitiveValue.h

@@ -180,6 +180,8 @@ public:
   }
 
 private:
+  void GetEscapedURI(PRUnichar *aURI, PRUnichar **aReturn);
+
   PRUint16 mType;
 
   union {

mozilla/xpfe/communicator/resources/content/nsContextMenu.js

@@ -287,7 +287,7 @@ nsContextMenu.prototype = {
                if ( bodyElt ) {
                  var attr = bodyElt.getAttribute( "background" );
                  if ( attr ||
-                      ( attr = this.getComputedURL( bodyElt, "background-image" ) ) != "none" ) {
+                      ( attr = this.getComputedURL( bodyElt, "background-image" ) ) ) {
                    this.hasBGImage = true;
                    this.bgImageURL = this.makeURLAbsolute( bodyElt.baseURI,
                                                            attr );
@@ -390,7 +390,7 @@ nsContextMenu.prototype = {
                 if ( !this.hasBGImage &&
                      ( ( localname.search( /^(?:TD|TH|TABLE|BODY)$/ ) != -1 &&
                          ( bgImgUrl = elem.getAttribute( "background" ) ) ) ||
-                       ( bgImgUrl = this.getComputedURL( elem, "background-image" ) ) != "none" ) ) {
+                       ( bgImgUrl = this.getComputedURL( elem, "background-image" ) ) ) ) {
                     this.hasBGImage = true;
                     this.bgImageURL = this.makeURLAbsolute( elem.baseURI,
                                                             bgImgUrl );
@@ -400,13 +400,13 @@ nsContextMenu.prototype = {
         }
     },
     // Returns the computed style attribute for the given element.
-    getComputedStyle: function( elem, attr ) {
-         return elem.ownerDocument.defaultView.getComputedStyle( elem, '' ).getPropertyValue( attr );
+    getComputedStyle: function( elem, prop ) {
+         return elem.ownerDocument.defaultView.getComputedStyle( elem, '' ).getPropertyValue( prop );
     },
     // Returns a "url"-type computed style attribute value, with the url() stripped.
-    getComputedURL: function( elem, attr ) {
-         var url = this.getComputedStyle( elem, attr );
-         return ( url == "none" ) ? url : url.replace( /^url\("?([^")]+)"?\)/i, "$1" );
+    getComputedURL: function( elem, prop ) {
+         var url = elem.ownerDocument.defaultView.getComputedStyle( elem, '' ).getPropertyCSSValue( prop );
+         return ( url.primitiveType == CSSPrimitiveValue.CSS_URI ) ? url.getStringValue() : null;
     },
     // Returns true iff clicked on link is saveable.
     isLinkSaveable : function ( link ) {