Modified: trunk/Source/WebCore/ChangeLog (185002 => 185003)
--- trunk/Source/WebCore/ChangeLog 2015-05-29 20:26:37 UTC (rev 185002)
+++ trunk/Source/WebCore/ChangeLog 2015-05-29 20:59:20 UTC (rev 185003)
@@ -1,3 +1,19 @@
+2015-05-29 Brady Eidson <beid...@apple.com>
+
+ WebSQL default functions can bypass authorizer.
+ <rdar://problem/21048994> and https://bugs.webkit.org/show_bug.cgi?id=145463
+
+ Reviewed by Sam Weinig and Alexey Proskuryakov.
+
+ No new tests yet.
+
+ * platform/sql/SQLiteDatabase.cpp:
+ (WebCore::unauthorizedSQLFunction): Function to install into SQLite to override some built-in functions.
+ (WebCore::SQLiteDatabase::open):
+ (WebCore::SQLiteDatabase::overrideUnauthorizedFunctions): Install function overrides for functions that
+ take arbitrary input that are also meant to be disabled by virtue of them not being whitelisted.
+ * platform/sql/SQLiteDatabase.h:
+
2015-05-29 Roger Fong <roger_f...@apple.com>
Unreviewed. Shift fullscreen controls down 20px.
Modified: trunk/Source/WebCore/platform/sql/SQLiteDatabase.cpp (185002 => 185003)
--- trunk/Source/WebCore/platform/sql/SQLiteDatabase.cpp 2015-05-29 20:26:37 UTC (rev 185002)
+++ trunk/Source/WebCore/platform/sql/SQLiteDatabase.cpp 2015-05-29 20:59:20 UTC (rev 185003)
@@ -40,6 +40,13 @@
static const char notOpenErrorMessage[] = "database is not open";
+static void unauthorizedSQLFunction(sqlite3_context *context, int, sqlite3_value **)
+{
+ const char* functionName = (const char*)sqlite3_user_data(context);
+ String errorMessage = String::format("Function %s is unauthorized", functionName);
+ sqlite3_result_error(context, errorMessage.utf8().data(), -1);
+}
+
SQLiteDatabase::SQLiteDatabase()
: m_db(0)
, m_pageSize(-1)
@@ -72,6 +79,8 @@
return false;
}
+ overrideUnauthorizedFunctions();
+
m_openError = sqlite3_extended_result_codes(m_db, 1);
if (m_openError != SQLITE_OK) {
m_openErrorMessage = sqlite3_errmsg(m_db);
@@ -123,6 +132,22 @@
m_openErrorMessage = CString();
}
+void SQLiteDatabase::overrideUnauthorizedFunctions()
+{
+ std::pair<const char*, int> functionParameters[] = {
+ { "rtreenode", 2 },
+ { "rtreedepth", 1 },
+ { "eval", 1 },
+ { "eval", 2 },
+ { "printf", -1 },
+ { "fts3_tokenizer", 1 },
+ { "fts3_tokenizer", 2 },
+ };
+
+ for (auto& functionParameter : functionParameters)
+ sqlite3_create_function(m_db, functionParameter.first, functionParameter.second, SQLITE_UTF8, (void*)functionParameter.first, unauthorizedSQLFunction, 0, 0);
+}
+
void SQLiteDatabase::interrupt()
{
m_interrupted = true;
Modified: trunk/Source/WebCore/platform/sql/SQLiteDatabase.h (185002 => 185003)
--- trunk/Source/WebCore/platform/sql/SQLiteDatabase.h 2015-05-29 20:26:37 UTC (rev 185002)
+++ trunk/Source/WebCore/platform/sql/SQLiteDatabase.h 2015-05-29 20:59:20 UTC (rev 185003)
@@ -140,7 +140,9 @@
void enableAuthorizer(bool enable);
int pageSize();
-
+
+ void overrideUnauthorizedFunctions();
+
sqlite3* m_db;
int m_pageSize;
