Bug 1747102 - Handle ill-formed local storage keys. r=dom-storage-reviewers,asuth

Differential Revision: https://phabricator.services.mozilla.com/D134292

dom/localstorage/LSSnapshot.cpp

@@ -182,6 +182,8 @@ nsresult LSSnapshot::Init(const nsAString& aKey,
   MOZ_ASSERT(!mInitialized);
   MOZ_ASSERT(!mSentFinish);
 
+  QM_TRY(OkIf(Utf16ValidUpTo(aKey) == aKey.Length()), NS_ERROR_ILLEGAL_VALUE);
+
   mSelfRef = this;
 
   LoadState loadState = aInitInfo.loadState();
@@ -616,6 +618,8 @@ nsresult LSSnapshot::GetItemInternal(const nsAString& aKey,
   MOZ_ASSERT(mInitialized);
   MOZ_ASSERT(!mSentFinish);
 
+  QM_TRY(OkIf(Utf16ValidUpTo(aKey) == aKey.Length()), NS_ERROR_ILLEGAL_VALUE);
+
   nsString result;
 
   switch (mLoadState) {

dom/localstorage/test/unit/test_snapshotting.js

@@ -318,6 +318,12 @@ async function testSteps() {
 
       // 9th snapshot
 
+      try {
+        storage.setItem(String.fromCharCode(0xdbff), "dummy");
+      } catch (e) {
+        is(e.name, "NS_ERROR_ILLEGAL_VALUE", "Key is text");
+      }
+
       info("Clearing");
 
       storage.clear();

dom/tests/mochitest/localstorage/test_brokenUTF-16.html

@@ -42,16 +42,26 @@ function startTest()
   localStorage.setItem(k, v);
   is(localStorage.getItem(k), v, "broken value results from getItem");
 
-  localStorage.setItem(v, "a value");
-  is(localStorage.getItem(v), "a value", "value result using broken key from getItem");
+  try {
+    localStorage.setItem(v, "a value");
+    ok(false, "Exception for localStorage.setItem, illegal key");
+  }
+  catch (ex) {
+    is(ex.name, "NS_ERROR_ILLEGAL_VALUE", "Exception for localStorage.setItem, illegal key");
+  }
 
   localStorage.clear();
 
   localStorage[k] = v;
   is(localStorage[k], v, "broken value results from []");
 
-  localStorage[v] = "a value";
-  is(localStorage[v], "a value", "value result using broken key from []");
+  try {
+    localStorage[v] = "a value";
+    ok(false, "Exception for localStorage.setItem, illegal key");
+  }
+  catch (ex) {
+    is(ex.name, "NS_ERROR_ILLEGAL_VALUE", "Exception for localStorage.setItem, illegal key");
+  }
 
   localStorage.clear();