diff options
author | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-04-01 05:51:57 +0000 |
---|---|---|
committer | cevans@chromium.org <cevans@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2010-04-01 05:51:57 +0000 |
commit | 2694360972967479c10a345f16f716ac850f78b3 (patch) | |
tree | 425c9ddf63ee46bff90aade4bb9677573981fb69 /chrome/common/chrome_constants.cc | |
parent | ad627cde795ce0f294e37f8c83aa2d5101b43711 (diff) | |
download | chromium_src-2694360972967479c10a345f16f716ac850f78b3.zip chromium_src-2694360972967479c10a345f16f716ac850f78b3.tar.gz chromium_src-2694360972967479c10a345f16f716ac850f78b3.tar.bz2 |
Make the browser survive massive data: URIs, via various techniques:
1) Drop the URL limit from 10MB to 2MB. The browser survives without this,
but that final tweaks makes the whole data: URI attack fairly smooth (on my
admittedly powerful machine).
2) Elide the title string at kMaxTitleChars. We already have a hard title limit
but there was a path whereby the title is implied by the URL (e.g. file: and
data: etc).
3) For massive URLs, limit the length shown in URL bar. We need to support them,
because someone might redirect to a data: URI with e.g. an image in it.
However, attempting to show them would kill the browser. We can't elide them
because eliding URLs is a security risk (and would lead to correctness issues
with an edit/press enter cycle). So we show at least the origin (minus path) or
just the scheme for data: URIs
BUG=33952
TEST=NONE
Review URL: http://codereview.chromium.org/1569011
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@43319 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'chrome/common/chrome_constants.cc')
-rw-r--r-- | chrome/common/chrome_constants.cc | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/chrome/common/chrome_constants.cc b/chrome/common/chrome_constants.cc index a6ad651..47745f4 100644 --- a/chrome/common/chrome_constants.cc +++ b/chrome/common/chrome_constants.cc @@ -118,7 +118,8 @@ const int kStatsMaxThreads = 32; const int kStatsMaxCounters = 300; const size_t kMaxTitleChars = 4 * 1024; -const size_t kMaxURLChars = 10 * 1024 * 1024; +const size_t kMaxURLChars = 2 * 1024 * 1024; +const size_t kMaxURLDisplayChars = 32 * 1024; // We don't enable record mode in the released product because users could // potentially be tricked into running a product in record mode without |