RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 20:52:45 +00:00
Code Issues Activity Actions

LibWeb: Do not blindly create File objects when adding FormData entries

Browse source 
We were unconditionally creating new File objects for all Blob-type
values passed to `FormData.append`. We should only do so if the value is
not already a File object (or if the `filename` attribute is present).

We must also carry MIME type information forward from the underlying
Blob object.
This commit is contained in:
Timothy Flynn 2024-03-13 16:42:09 -04:00 • committed by Andreas Kling
parent f55471333b
commit bb38cc1010
3 changed files with 35 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Tests/LibWeb/Text/expected/HTML/FormData-append-blob-with-type.txt Normal file
View file

@ -0,0 +1,2 @@
Name: test.txt
Type: text/plain

13
Tests/LibWeb/Text/input/HTML/FormData-append-blob-with-type.html Normal file
View file

@ -0,0 +1,13 @@
<script src="../include.js"></script>
<script>
test(() => {
const blob = new Blob(["Hi Blob!"], { type: "text/plain" });
const formData = new FormData();
formData.append("test", blob, "test.txt");
const file = formData.get("test");
println(`Name: ${file.name}`);
println(`Type: ${file.type}`);
});
</script>

29
Userland/Libraries/LibWeb/HTML/FormControlInfrastructure.cpp
View file

@ -30,15 +30,26 @@ WebIDL::ExceptionOr<XHR::FormDataEntry> create_entry(JS::Realm& realm, String co
return TRY_OR_THROW_OOM(vm, Infra::convert_to_scalar_value_string(string));
},
// 3. Otherwise:
[&](JS::NonnullGCPtr<FileAPI::Blob> const& blob) -> WebIDL::ExceptionOr<Variant<JS::Handle<FileAPI::File>, String>> {
// 1. If value is not a File object, then set value to a new File object, representing the same bytes, whose name attribute value is "blob".
// 2. If filename is given, then set value to a new File object, representing the same bytes, whose name attribute is filename.
String name_attribute;
if (filename.has_value())
name_attribute = filename.value();
else
name_attribute = "blob"_string;
return JS::make_handle(TRY(FileAPI::File::create(realm, { JS::make_handle(*blob) }, move(name_attribute), {})));
[&](JS::NonnullGCPtr<FileAPI::Blob> blob) -> WebIDL::ExceptionOr<Variant<JS::Handle<FileAPI::File>, String>> {
// 1. If value is not a File object, then set value to a new File object, representing the same bytes, whose
// name attribute value is "blob".
if (!is<FileAPI::File>(*blob)) {
FileAPI::FilePropertyBag options {};
options.type = blob->type();
blob = TRY(FileAPI::File::create(realm, { JS::make_handle(*blob) }, "blob"_string, move(options)));
}
// 2. If filename is given, then set value to a new File object, representing the same bytes, whose name
// attribute is filename.
if (filename.has_value()) {
FileAPI::FilePropertyBag options {};
options.type = blob->type();
blob = TRY(FileAPI::File::create(realm, { JS::make_handle(*blob) }, *filename, move(options)));
}
return JS::make_handle(verify_cast<FileAPI::File>(*blob));
}));
// 4. Return an entry whose name is name and whose value is value.