Changeset 230359 in webkit

Timestamp:

Apr 6, 2018 4:53:30 PM (6 years ago)

Author:

rniwa@webkit.org

Message:

Make all sync IPCs during ScriptDisallowedScope set DoNotProcessIncomingMessagesWhenWaitingForSyncReply
​https://bugs.webkit.org/show_bug.cgi?id=182449
<rdar://problem/39222541>

Reviewed by Chris Dumez.

Release assert that a sync IPC inside ScriptDisallowedScope sets DoNotProcessIncomingMessagesWhenWaitingForSyncReply
to avoid executing arbitrary scripts as a result of processing incoming sync IPCs.

• Platform/IPC/Connection.h:

(IPC::Connection::sendSync): Added the release assertion.

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• Platform/IPC/Connection.h (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2018-04-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Make all sync IPCs during ScriptDisallowedScope set DoNotProcessIncomingMessagesWhenWaitingForSyncReply
+        https://bugs.webkit.org/show_bug.cgi?id=182449
+        <rdar://problem/39222541>
+
+        Reviewed by Chris Dumez.
+
+        Release assert that a sync IPC inside ScriptDisallowedScope sets DoNotProcessIncomingMessagesWhenWaitingForSyncReply
+        to avoid executing arbitrary scripts as a result of processing incoming sync IPCs.
+
+        * Platform/IPC/Connection.h:
+        (IPC::Connection::sendSync): Added the release assertion.
+
 2018-04-05  Youenn Fablet  <youenn@apple.com>
 

trunk/Source/WebKit/Platform/IPC/Connection.h

@@ -33 +33 @@
 #include "HandleMessage.h"
 #include "MessageReceiver.h"
+#include <WebCore/ScriptDisallowedScope.h>
 #include <atomic>
 #include <wtf/Condition.h>
@@ -388 +389 @@
     COMPILE_ASSERT(T::isSync, SyncMessageExpected);
 
+    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(sendSyncOptions.contains(SendSyncOption::DoNotProcessIncomingMessagesWhenWaitingForSyncReply)
+        || WebCore::ScriptDisallowedScope::isEventAllowedInMainThread());
+
     uint64_t syncRequestID = 0;
     std::unique_ptr<Encoder> encoder = createSyncMessageEncoder(T::receiverName(), T::name(), destinationID, syncRequestID);