Title: [280836] releases/WebKitGTK/webkit-2.32/Source/WebKit
- Revision
- 280836
- Author
- [email protected]
- Date
- 2021-08-10 02:29:58 -0700 (Tue, 10 Aug 2021)
Log Message
Merge r274153 - [IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
https://bugs.webkit.org/show_bug.cgi?id=222955
<rdar://problem/75195062>
Reviewed by Anders Carlsson.
The Strings passed in textFieldValues are used as keys in a HashMap later on so we need
to validate them.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::willSubmitForm):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog (280835 => 280836)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:28:47 UTC (rev 280835)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/ChangeLog 2021-08-10 09:29:58 UTC (rev 280836)
@@ -1,3 +1,17 @@
+2021-03-09 Chris Dumez <[email protected]>
+
+ [IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
+ https://bugs.webkit.org/show_bug.cgi?id=222955
+ <rdar://problem/75195062>
+
+ Reviewed by Anders Carlsson.
+
+ The Strings passed in textFieldValues are used as keys in a HashMap later on so we need
+ to validate them.
+
+ * UIProcess/WebPageProxy.cpp:
+ (WebKit::WebPageProxy::willSubmitForm):
+
2021-03-05 Chris Dumez <[email protected]>
[IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
Modified: releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp (280835 => 280836)
--- releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp 2021-08-10 09:28:47 UTC (rev 280835)
+++ releases/WebKitGTK/webkit-2.32/Source/WebKit/UIProcess/WebPageProxy.cpp 2021-08-10 09:29:58 UTC (rev 280836)
@@ -31,6 +31,7 @@
#include "APIAttachment.h"
#include "APIContentWorld.h"
#include "APIContextMenuClient.h"
+#include "APIDictionary.h"
#include "APIFindClient.h"
#include "APIFindMatchesClient.h"
#include "APIFormClient.h"
@@ -5445,6 +5446,9 @@
WebFrameProxy* sourceFrame = m_process->webFrame(sourceFrameID);
MESSAGE_CHECK(m_process, sourceFrame);
+ for (auto& pair : textFieldValues)
+ MESSAGE_CHECK(m_process, API::Dictionary::MapType::isValidKey(pair.first));
+
m_formClient->willSubmitForm(*this, *frame, *sourceFrame, textFieldValues, m_process->transformHandlesToObjects(userData.object()).get(), [this, protectedThis = makeRef(*this), frameID, listenerID]() {
send(Messages::WebPage::ContinueWillSubmitForm(frameID, listenerID));
});
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
