New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 673263 link

Starred by 4 users

Issue metadata

Status: Fixed
Owner: ----
Closed: Jan 2017
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

Some DOM.getDocument result can't be parsed due to too much nesting.

Project Member Reported by alexclarke@chromium.org, Dec 12 2016

Issue description

On some pages DOM.getDocument results in a JSON message that cannot be parsed by the JSON reader because of too many levels of nesting:

E.g. http://www.ebay.com/itm/Vintage-1985-Pictionary-First-Edition-The-Game-of-Quick-Draw-/281636988595

 
Cc: tmarek@google.com
This also impacts chrome.debugger.sendCommand. If the result has too much nesting then the API fails silently.

This is both due to json_parser.cc have a recursion limit of 100, and the IPC serialization code having a similar limit.

Fix at https://codereview.chromium.org/2570113002. I wonder if this can have any security implications though.
Cc: joaodasilva@chromium.org
Project Member

Comment 3 by bugdroid1@chromium.org, Jan 10 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/383b174a3c321fc6963c50515745d559222ba709

commit 383b174a3c321fc6963c50515745d559222ba709
Author: joaodasilva <joaodasilva@chromium.org>
Date: Tue Jan 10 09:55:36 2017

Increase the depth limit of JSONParser and IPC serialization from 100 to 200.

This impacts extension APIs and the debug protocol. Some webpages
have over 100 levels of nested elements. Some internal representations
further use 2 levels per node to represent the DOM data (e.g. one
DictionaryValue for the node and a ListValue containing the children.)

The affected APIs fail silently when this limit is reached.

Percentiles over ~90M random pages:
  Max depth: go/html-depth
  Iframes found at depth: go/html-iframe-depth

To support 99.9% of pages we need (62 + 35) * 2 == 194 levels of nesting.

BUG= 673263 

Review-Url: https://codereview.chromium.org/2570113002
Cr-Commit-Position: refs/heads/master@{#442542}

[modify] https://crrev.com/383b174a3c321fc6963c50515745d559222ba709/base/json/json_parser.cc
[modify] https://crrev.com/383b174a3c321fc6963c50515745d559222ba709/base/json/json_parser_unittest.cc
[modify] https://crrev.com/383b174a3c321fc6963c50515745d559222ba709/components/safe_json/android/java/src/org/chromium/components/safejson/JsonSanitizer.java
[modify] https://crrev.com/383b174a3c321fc6963c50515745d559222ba709/components/safe_json/json_sanitizer_unittest.cc
[modify] https://crrev.com/383b174a3c321fc6963c50515745d559222ba709/ipc/ipc_message_utils.cc

Status: Fixed (was: Available)

Sign in to add a comment