Aliaksandr Kalenik 69cede4a0f AK+LibWeb: Make StringBase::bytes() lvalue-only ...

Disallow calling `StringBase::bytes()` on temporaries to avoid returning
`ReadonlyBytes` that outlive the underlying string.

With this change, we catch a real UAF:
`load_result.data = maybe_response.release_value().bytes();`
All other updated call sites were already safe, they just needed to use
an intermediate named variable to satisfy the new lvalue-only
requirement.

2025-11-25 13:02:20 -05:00

59 KiB

Raw Blame History

View Raw