Diff
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/ChangeLog 2015-05-11 13:32:39 UTC (rev 184092)
@@ -1,3 +1,43 @@
+2015-04-21 Chris Dumez <[email protected]>
+
+ Use ASSERT_WITH_SECURITY_IMPLICATION() for NoEventDispatchAssertion
+ https://bugs.webkit.org/show_bug.cgi?id=143971
+
+ Reviewed by Darin Adler.
+
+ Use ASSERT_WITH_SECURITY_IMPLICATION() for NoEventDispatchAssertion as
+ firing JS events can cause arbitrary JS execution which often leads to
+ security bugs when event firing is forbidden. For e.g. firing events
+ from ActiveDOMObject::suspend() means JS can construct or destroy
+ ActiveDOMObjects while we are iterating over them.
+
+ * dom/ContainerNode.cpp:
+ (WebCore::dispatchChildInsertionEvents):
+ (WebCore::dispatchChildRemovalEvents):
+ * dom/ContainerNodeAlgorithms.h:
+ (WebCore::ChildNodeInsertionNotifier::notify):
+ * dom/Document.cpp:
+ (WebCore::Document::dispatchWindowEvent):
+ (WebCore::Document::dispatchWindowLoadEvent):
+ * dom/Element.cpp:
+ (WebCore::Element::dispatchFocusInEvent):
+ (WebCore::Element::dispatchFocusOutEvent):
+ * dom/EventDispatcher.cpp:
+ (WebCore::EventDispatcher::dispatchEvent):
+ * dom/EventTarget.cpp:
+ (WebCore::EventTarget::fireEventListeners):
+ * dom/Node.cpp:
+ (WebCore::Node::dispatchSubtreeModifiedEvent):
+ (WebCore::Node::dispatchDOMActivateEvent):
+ * dom/ScriptExecutionContext.cpp:
+ (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjectsForPageCache):
+ (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
+ (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
+ (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
+ (WebCore::ScriptExecutionContext::willDestroyActiveDOMObject):
+ * dom/WebKitNamedFlow.cpp:
+ (WebCore::WebKitNamedFlow::dispatchRegionOversetChangeEvent):
+
2015-04-20 Simon Fraser <[email protected]>
REGRESSION (r177494): -webkit-mask-image: with data URI fails on non-local files
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ContainerNode.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ContainerNode.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ContainerNode.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -799,7 +799,7 @@
if (child.isInShadowTree())
return;
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
RefPtr<Node> c = &child;
Ref<Document> document(child.document());
@@ -821,7 +821,7 @@
return;
}
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
willCreatePossiblyOrphanedTreeByRemoval(&child);
InspectorInstrumentation::willRemoveDOMNode(child.document(), child);
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ContainerNodeAlgorithms.h (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ContainerNodeAlgorithms.h 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ContainerNodeAlgorithms.h 2015-05-11 13:32:39 UTC (rev 184092)
@@ -214,7 +214,7 @@
inline void ChildNodeInsertionNotifier::notify(Node& node)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
InspectorInstrumentation::didInsertDOMNode(node.document(), node);
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Document.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Document.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Document.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -3810,7 +3810,7 @@
void Document::dispatchWindowEvent(PassRefPtr<Event> event, PassRefPtr<EventTarget> target)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
if (!m_domWindow)
return;
m_domWindow->dispatchEvent(event, target);
@@ -3818,7 +3818,7 @@
void Document::dispatchWindowLoadEvent()
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
if (!m_domWindow)
return;
m_domWindow->dispatchLoadEvent();
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Element.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Element.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Element.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -2071,14 +2071,14 @@
void Element::dispatchFocusInEvent(const AtomicString& eventType, RefPtr<Element>&& oldFocusedElement)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
ASSERT(eventType == eventNames().focusinEvent || eventType == eventNames().DOMFocusInEvent);
dispatchScopedEvent(FocusEvent::create(eventType, true, false, document().defaultView(), 0, WTF::move(oldFocusedElement)));
}
void Element::dispatchFocusOutEvent(const AtomicString& eventType, RefPtr<Element>&& newFocusedElement)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
ASSERT(eventType == eventNames().focusoutEvent || eventType == eventNames().DOMFocusOutEvent);
dispatchScopedEvent(FocusEvent::create(eventType, true, false, document().defaultView(), 0, WTF::move(newFocusedElement)));
}
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/EventDispatcher.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/EventDispatcher.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/EventDispatcher.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -319,7 +319,7 @@
bool EventDispatcher::dispatchEvent(Node* origin, PassRefPtr<Event> prpEvent)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
if (!prpEvent)
return true;
@@ -341,7 +341,7 @@
ChildNodesLazySnapshot::takeChildNodesLazySnapshot();
event->setTarget(&eventTargetRespectingTargetRules(*node));
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
ASSERT(event->target());
WindowEventContext windowEventContext(node.get(), eventPath.lastContextIfExists());
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/EventTarget.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/EventTarget.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/EventTarget.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -189,7 +189,7 @@
bool EventTarget::fireEventListeners(Event* event)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
ASSERT(event && !event->type().isEmpty());
EventTargetData* d = eventTargetData();
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Node.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Node.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/Node.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -2022,7 +2022,7 @@
if (isInShadowTree())
return;
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
if (!document().hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
return;
@@ -2035,7 +2035,7 @@
bool Node::dispatchDOMActivateEvent(int detail, PassRefPtr<Event> underlyingEvent)
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
RefPtr<UIEvent> event = UIEvent::create(eventNames().DOMActivateEvent, true, true, document().defaultView(), detail);
event->setUnderlyingEvent(underlyingEvent);
dispatchScopedEvent(event);
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ScriptExecutionContext.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ScriptExecutionContext.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/ScriptExecutionContext.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -187,8 +187,9 @@
// We assume that m_activeDOMObjects will not change during iteration: canSuspend
// functions should not add new active DOM objects, nor execute arbitrary _javascript_.
- // An ASSERT or RELEASE_ASSERT will fire if this happens, but it's important to code
+ // An ASSERT_WITH_SECURITY_IMPLICATION or RELEASE_ASSERT will fire if this happens, but it's important to code
// canSuspend functions so it will not happen!
+ NoEventDispatchAssertion assertNoEventDispatch;
for (auto* activeDOMObject : m_activeDOMObjects) {
if (!activeDOMObject->canSuspend()) {
canSuspend = false;
@@ -225,7 +226,7 @@
// We assume that m_activeDOMObjects will not change during iteration: suspend
// functions should not add new active DOM objects, nor execute arbitrary _javascript_.
- // An ASSERT or RELEASE_ASSERT will fire if this happens, but it's important to code
+ // An ASSERT_WITH_SECURITY_IMPLICATION or RELEASE_ASSERT will fire if this happens, but it's important to code
// suspend functions so it will not happen!
for (auto* activeDOMObject : m_activeDOMObjects)
activeDOMObject->suspend(why);
@@ -254,7 +255,7 @@
// We assume that m_activeDOMObjects will not change during iteration: resume
// functions should not add new active DOM objects, nor execute arbitrary _javascript_.
- // An ASSERT or RELEASE_ASSERT will fire if this happens, but it's important to code
+ // An ASSERT_WITH_SECURITY_IMPLICATION or RELEASE_ASSERT will fire if this happens, but it's important to code
// resume functions so it will not happen!
for (auto* activeDOMObject : m_activeDOMObjects)
activeDOMObject->resume();
@@ -281,7 +282,7 @@
// We assume that new objects will not be added to m_activeDOMObjects during iteration:
// stop functions should not add new active DOM objects, nor execute arbitrary _javascript_.
- // A RELEASE_ASSERT will fire if this happens, but it's important to code stop functions
+ // An ASSERT_WITH_SECURITY_IMPLICATION or RELEASE_ASSERT will fire if this happens, but it's important to code stop functions
// so it will not happen!
for (auto* activeDOMObject : possibleActiveDOMObjects) {
// Check if this object was deleted already. If so, just skip it.
@@ -323,7 +324,7 @@
void ScriptExecutionContext::willDestroyActiveDOMObject(ActiveDOMObject& activeDOMObject)
{
- ASSERT(!m_activeDOMObjectRemovalForbidden);
+ ASSERT_WITH_SECURITY_IMPLICATION(!m_activeDOMObjectRemovalForbidden);
m_activeDOMObjects.remove(&activeDOMObject);
}
Modified: releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/WebKitNamedFlow.cpp (184091 => 184092)
--- releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/WebKitNamedFlow.cpp 2015-05-11 13:31:21 UTC (rev 184091)
+++ releases/WebKitGTK/webkit-2.8/Source/WebCore/dom/WebKitNamedFlow.cpp 2015-05-11 13:32:39 UTC (rev 184092)
@@ -210,7 +210,7 @@
void WebKitNamedFlow::dispatchRegionOversetChangeEvent()
{
- ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
+ ASSERT_WITH_SECURITY_IMPLICATION(!NoEventDispatchAssertion::isEventDispatchForbidden());
// If the flow is in the "NULL" state the event should not be dispatched any more.
if (flowState() == FlowStateNull)
