Title: [95488] trunk
- Revision
- 95488
- Author
- aba...@webkit.org
- Date
- 2011-09-19 15:56:22 -0700 (Mon, 19 Sep 2011)
Log Message
Named property confusion with __proto__
https://bugs.webkit.org/show_bug.cgi?id=68221
Reviewed by Eric Seidel.
Source/WebCore:
The __proto__ property is super magical because it's not a real named
property and it has higher precedence than even interceptors. This
confuses this check, which is meant to detech which names will get
handled by our interceptor.
Test: http/tests/security/window-named-proto.html
* bindings/v8/custom/V8DOMWindowCustom.cpp:
(WebCore::V8DOMWindow::namedSecurityCheck):
LayoutTests:
* http/tests/security/resources/innocent-victim-with-iframe.html: Added.
* http/tests/security/window-named-proto-expected.txt: Added.
* http/tests/security/window-named-proto.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (95487 => 95488)
--- trunk/LayoutTests/ChangeLog 2011-09-19 22:54:53 UTC (rev 95487)
+++ trunk/LayoutTests/ChangeLog 2011-09-19 22:56:22 UTC (rev 95488)
@@ -1,3 +1,14 @@
+2011-09-19 Adam Barth <aba...@webkit.org>
+
+ Named property confusion with __proto__
+ https://bugs.webkit.org/show_bug.cgi?id=68221
+
+ Reviewed by Eric Seidel.
+
+ * http/tests/security/resources/innocent-victim-with-iframe.html: Added.
+ * http/tests/security/window-named-proto-expected.txt: Added.
+ * http/tests/security/window-named-proto.html: Added.
+
2011-09-19 John Bauman <jbau...@chromium.org>
Fix nonpremultiplied webgl toDataURL to jpeg
Added: trunk/LayoutTests/http/tests/security/resources/innocent-victim-with-iframe.html (0 => 95488)
--- trunk/LayoutTests/http/tests/security/resources/innocent-victim-with-iframe.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/resources/innocent-victim-with-iframe.html 2011-09-19 22:56:22 UTC (rev 95488)
@@ -0,0 +1,6 @@
+<html>
+<body>
+This page doesn't do anything special except have an iframe:<br>
+<iframe src=""
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt (0 => 95488)
--- trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/security/window-named-proto-expected.txt 2011-09-19 22:56:22 UTC (rev 95488)
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: line 1: Unsafe _javascript_ attempt to access frame with URL http://localhost:8080/security/resources/innocent-victim-with-iframe.html from frame with URL data:text/html,<script>(function () { setTimeout(function() { if (window.layoutTestController) layoutTestController.notifyDone(); }, 0); window.name = "__proto__"; parent.__proto__.alert.constructor("alert(document.body.innerHTML)")(); })()</script>. Domains, protocols and ports must match.
+
+CONSOLE MESSAGE: line 1: Uncaught TypeError: Cannot read property 'alert' of undefined
+
Added: trunk/LayoutTests/http/tests/security/window-named-proto.html (0 => 95488)
--- trunk/LayoutTests/http/tests/security/window-named-proto.html (rev 0)
+++ trunk/LayoutTests/http/tests/security/window-named-proto.html 2011-09-19 22:56:22 UTC (rev 95488)
@@ -0,0 +1,26 @@
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+}
+
+window._onload_ = function()
+{
+ frame = document.body.appendChild(document.createElement("iframe"));
+ frame.src = ""
+ frame._onload_ = function() {
+ frame._onload_ = null;
+
+ frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
+
+ setTimeout(function() {
+ if (window.layoutTestController)
+ layoutTestController.notifyDone();
+ }, 0);
+
+ window.name = "__proto__";
+ parent.__proto__.alert.constructor("alert(document.body.innerHTML)")();
+ } + ")()</scr" + "ipt>";
+ }
+}
+</script>
Modified: trunk/Source/WebCore/ChangeLog (95487 => 95488)
--- trunk/Source/WebCore/ChangeLog 2011-09-19 22:54:53 UTC (rev 95487)
+++ trunk/Source/WebCore/ChangeLog 2011-09-19 22:56:22 UTC (rev 95488)
@@ -1,5 +1,22 @@
2011-09-19 Adam Barth <aba...@webkit.org>
+ Named property confusion with __proto__
+ https://bugs.webkit.org/show_bug.cgi?id=68221
+
+ Reviewed by Eric Seidel.
+
+ The __proto__ property is super magical because it's not a real named
+ property and it has higher precedence than even interceptors. This
+ confuses this check, which is meant to detech which names will get
+ handled by our interceptor.
+
+ Test: http/tests/security/window-named-proto.html
+
+ * bindings/v8/custom/V8DOMWindowCustom.cpp:
+ (WebCore::V8DOMWindow::namedSecurityCheck):
+
+2011-09-19 Adam Barth <aba...@webkit.org>
+
Rename ENABLE(OPENTYPE_SANITIZER) to USE(OPENTYPE_SANITIZER)
https://bugs.webkit.org/show_bug.cgi?id=68292
Modified: trunk/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp (95487 => 95488)
--- trunk/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp 2011-09-19 22:54:53 UTC (rev 95487)
+++ trunk/Source/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp 2011-09-19 22:56:22 UTC (rev 95488)
@@ -560,12 +560,17 @@
return false;
if (key->IsString()) {
+ DEFINE_STATIC_LOCAL(AtomicString, nameOfProtoProperty, ("__proto__"));
+
String name = toWebCoreString(key);
// Notice that we can't call HasRealNamedProperty for ACCESS_HAS
// because that would generate infinite recursion.
if (type == v8::ACCESS_HAS && target->tree()->child(name))
return true;
- if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()))
+ // We need to explicitly compare against nameOfProtoProperty because
+ // V8's JSObject::LocalLookup finds __proto__ before
+ // interceptors and even when __proto__ isn't a "real named property".
+ if (type == v8::ACCESS_GET && target->tree()->child(name) && !host->HasRealNamedProperty(key->ToString()) && name != nameOfProtoProperty)
return true;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes