| Summary: | [GStreamer][EME][Thunder] Do not sanitize CENC init data | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Xabier Rodríguez Calvar <calvaris> | ||||||
| Component: | New Bugs | Assignee: | Xabier Rodríguez Calvar <calvaris> | ||||||
| Status: | RESOLVED INVALID | ||||||||
| Severity: | Normal | CC: | cgarcia, commit-queue, eric.carlson, ews-watchlist, glenn, gustavo, jer.noble, menard, philipj, pnormand, sergio, vjaquez, webkit-bug-importer | ||||||
| Priority: | P2 | Keywords: | InRadar | ||||||
| Version: | WebKit Nightly Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Bug Depends on: | 233630 | ||||||||
| Bug Blocks: | |||||||||
| Attachments: |
|
||||||||
|
Description
Xabier Rodríguez Calvar
2020-10-26 06:05:30 PDT
Created attachment 412311 [details]
Patch
Created attachment 412322 [details]
Patch
Comment on attachment 412322 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=412322&action=review > Source/WebCore/platform/encryptedmedia/CDMPrivate.h:77 > + WEBCORE_EXPORT virtual RefPtr<SharedBuffer> sanitizeInitData(const AtomString& initDataType, const SharedBuffer& initData) const; Why the WEBCORE_EXPORT? Because the former patch failed to build without it when linking with the Mock in the tests. Failed how? Link error cause the mock is in the tests and that is not in WebCore Committed r269103: <https://trac.webkit.org/changeset/269103> I'm afraid this actually goes against the spec: https://www.w3.org/TR/encrypted-media/#dom-mediakeysession-generaterequest (step 10.2 quoted below) --- Let sanitized init data be a validated and sanitized version of init data. The user agent must thoroughly validate the Initialization Data before passing it to the CDM. This includes verifying that the length and values of fields are reasonable, verifying that values are within reasonable limits, and stripping irrelevant, unsupported, or unknown data or fields. It is recommended that user agents pre-parse, sanitize, and/or generate a fully sanitized version of the Initialization Data. If the Initialization Data format specified by initDataType supports multiple entries, the user agent should remove entries that are not needed by the CDM. The user agent must not re-order entries within the Initialization Data. --- I think the real issue is in the app side. Let's revert this patch? Re-opened since this is blocked by bug 233630 |