It holds bare references (KURL&, String&), and we are storing a stale reference sometimes (see ErrorParameter::Create for example). This is basically an UAF.
Maybe we could change the references to pointers? If callers of the constructor had to explicitly use the & operator it might encourage them to think about object lifetimes.
>#2
Maybe. Or we may want to overhaul the pattern. I continue to own this issue in order not to forget about it, but if anyone want to make refactoring changes feel free to assign yourself.
Comment 1 by yhirano@chromium.org
, Jun 13 2018ErrorParameter ErrorParameter::Create( const network::CORSErrorStatus& error_status, const KURL& first_url, const KURL& second_url, const int status_code, const HTTPHeaderMap& header_map, const SecurityOrigin& origin, const WebURLRequest::RequestContext context) { String hint; // <========== THIS switch (error_status.cors_error) { case network::mojom::CORSError::kMethodDisallowedByPreflightResponse: case network::mojom::CORSError::kHeaderDisallowedByPreflightResponse: DCHECK(!error_status.failed_parameter.empty()); hint = String(error_status.failed_parameter.c_str()); break; default: break; } return ErrorParameter(error_status.cors_error, first_url, second_url, status_code, header_map, origin, context, hint, false); }