⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 242378 in webkit


Ignore:
Timestamp:
Mar 4, 2019, 1:01:37 PM (7 years ago)
Author:
Brent Fulgham
Message:

Check contextIDs when handling WebContent messages
​https://bugs.webkit.org/show_bug.cgi?id=195289
<rdar://problem/48475870>

Reviewed by Alex Christensen.

The WebContent process is untrusted because it handles arbitrary markup and javascript from untrusted sources.
We should handle its messages with suspicion, and make sure the arguments are valid and usable before honoring them.

This patch hardens the message passing layer by performing MESSAGE_CHECK in places that had been overlooked.

  • UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:

(WebKit::PlaybackSessionManagerProxy::setUpPlaybackControlsManagerWithID):
(WebKit::PlaybackSessionManagerProxy::currentTimeChanged):
(WebKit::PlaybackSessionManagerProxy::bufferedTimeChanged):
(WebKit::PlaybackSessionManagerProxy::seekableRangesVectorChanged):
(WebKit::PlaybackSessionManagerProxy::canPlayFastReverseChanged):
(WebKit::PlaybackSessionManagerProxy::audioMediaSelectionOptionsChanged):
(WebKit::PlaybackSessionManagerProxy::legibleMediaSelectionOptionsChanged):
(WebKit::PlaybackSessionManagerProxy::audioMediaSelectionIndexChanged):
(WebKit::PlaybackSessionManagerProxy::legibleMediaSelectionIndexChanged):
(WebKit::PlaybackSessionManagerProxy::externalPlaybackPropertiesChanged):
(WebKit::PlaybackSessionManagerProxy::wirelessVideoPlaybackDisabledChanged):
(WebKit::PlaybackSessionManagerProxy::mutedChanged):
(WebKit::PlaybackSessionManagerProxy::volumeChanged):
(WebKit::PlaybackSessionManagerProxy::durationChanged):
(WebKit::PlaybackSessionManagerProxy::playbackStartedTimeChanged):
(WebKit::PlaybackSessionManagerProxy::rateChanged):
(WebKit::PlaybackSessionManagerProxy::pictureInPictureSupportedChanged):
(WebKit::PlaybackSessionManagerProxy::pictureInPictureActiveChanged):
(WebKit::PlaybackSessionManagerProxy::handleControlledElementIDResponse const):

  • UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp:

(WebKit::UserMediaCaptureManagerProxy::createMediaSourceForCaptureDeviceWithConstraints):
(WebKit::UserMediaCaptureManagerProxy::startProducingData):
(WebKit::UserMediaCaptureManagerProxy::stopProducingData):
(WebKit::UserMediaCaptureManagerProxy::end):
(WebKit::UserMediaCaptureManagerProxy::capabilities):
(WebKit::UserMediaCaptureManagerProxy::setMuted):
(WebKit::UserMediaCaptureManagerProxy::applyConstraints):

  • UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:

(WebKit::VideoFullscreenManagerProxy::setupFullscreenWithID):
(WebKit::VideoFullscreenManagerProxy::setHasVideo):
(WebKit::VideoFullscreenManagerProxy::setVideoDimensions):
(WebKit::VideoFullscreenManagerProxy::enterFullscreen):
(WebKit::VideoFullscreenManagerProxy::exitFullscreen):
(WebKit::VideoFullscreenManagerProxy::exitFullscreenWithoutAnimationToMode):
(WebKit::VideoFullscreenManagerProxy::setInlineRect):
(WebKit::VideoFullscreenManagerProxy::setHasVideoContentLayer):
(WebKit::VideoFullscreenManagerProxy::cleanupFullscreen):
(WebKit::VideoFullscreenManagerProxy::preparedToReturnToInline):
(WebKit::VideoFullscreenManagerProxy::preparedToExitFullscreen):

  • UIProcess/ios/EditableImageController.mm:

(WebKit::EditableImageController::didCreateEditableImage):
(WebKit::EditableImageController::didDestroyEditableImage):
(WebKit::EditableImageController::associateWithAttachment):

Location:
trunk/Source/WebKit
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r242377 r242378  
     12019-03-04  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Check contextIDs when handling WebContent messages
     4        https://bugs.webkit.org/show_bug.cgi?id=195289
     5        <rdar://problem/48475870>
     6
     7        Reviewed by Alex Christensen.
     8
     9        The WebContent process is untrusted because it handles arbitrary markup and javascript from untrusted sources.
     10        We should handle its messages with suspicion, and make sure the arguments are valid and usable before honoring them.
     11
     12        This patch hardens the message passing layer by performing MESSAGE_CHECK in places that had been overlooked.
     13
     14        * UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:
     15        (WebKit::PlaybackSessionManagerProxy::setUpPlaybackControlsManagerWithID):
     16        (WebKit::PlaybackSessionManagerProxy::currentTimeChanged):
     17        (WebKit::PlaybackSessionManagerProxy::bufferedTimeChanged):
     18        (WebKit::PlaybackSessionManagerProxy::seekableRangesVectorChanged):
     19        (WebKit::PlaybackSessionManagerProxy::canPlayFastReverseChanged):
     20        (WebKit::PlaybackSessionManagerProxy::audioMediaSelectionOptionsChanged):
     21        (WebKit::PlaybackSessionManagerProxy::legibleMediaSelectionOptionsChanged):
     22        (WebKit::PlaybackSessionManagerProxy::audioMediaSelectionIndexChanged):
     23        (WebKit::PlaybackSessionManagerProxy::legibleMediaSelectionIndexChanged):
     24        (WebKit::PlaybackSessionManagerProxy::externalPlaybackPropertiesChanged):
     25        (WebKit::PlaybackSessionManagerProxy::wirelessVideoPlaybackDisabledChanged):
     26        (WebKit::PlaybackSessionManagerProxy::mutedChanged):
     27        (WebKit::PlaybackSessionManagerProxy::volumeChanged):
     28        (WebKit::PlaybackSessionManagerProxy::durationChanged):
     29        (WebKit::PlaybackSessionManagerProxy::playbackStartedTimeChanged):
     30        (WebKit::PlaybackSessionManagerProxy::rateChanged):
     31        (WebKit::PlaybackSessionManagerProxy::pictureInPictureSupportedChanged):
     32        (WebKit::PlaybackSessionManagerProxy::pictureInPictureActiveChanged):
     33        (WebKit::PlaybackSessionManagerProxy::handleControlledElementIDResponse const):
     34        * UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp:
     35        (WebKit::UserMediaCaptureManagerProxy::createMediaSourceForCaptureDeviceWithConstraints):
     36        (WebKit::UserMediaCaptureManagerProxy::startProducingData):
     37        (WebKit::UserMediaCaptureManagerProxy::stopProducingData):
     38        (WebKit::UserMediaCaptureManagerProxy::end):
     39        (WebKit::UserMediaCaptureManagerProxy::capabilities):
     40        (WebKit::UserMediaCaptureManagerProxy::setMuted):
     41        (WebKit::UserMediaCaptureManagerProxy::applyConstraints):
     42        * UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:
     43        (WebKit::VideoFullscreenManagerProxy::setupFullscreenWithID):
     44        (WebKit::VideoFullscreenManagerProxy::setHasVideo):
     45        (WebKit::VideoFullscreenManagerProxy::setVideoDimensions):
     46        (WebKit::VideoFullscreenManagerProxy::enterFullscreen):
     47        (WebKit::VideoFullscreenManagerProxy::exitFullscreen):
     48        (WebKit::VideoFullscreenManagerProxy::exitFullscreenWithoutAnimationToMode):
     49        (WebKit::VideoFullscreenManagerProxy::setInlineRect):
     50        (WebKit::VideoFullscreenManagerProxy::setHasVideoContentLayer):
     51        (WebKit::VideoFullscreenManagerProxy::cleanupFullscreen):
     52        (WebKit::VideoFullscreenManagerProxy::preparedToReturnToInline):
     53        (WebKit::VideoFullscreenManagerProxy::preparedToExitFullscreen):
     54        * UIProcess/ios/EditableImageController.mm:
     55        (WebKit::EditableImageController::didCreateEditableImage):
     56        (WebKit::EditableImageController::didDestroyEditableImage):
     57        (WebKit::EditableImageController::associateWithAttachment):
     58
    1592019-03-04  Alex Christensen  <achristensen@webkit.org>
    260

  • trunk/Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.mm

    r239535 r242378  
    3434#import "WebProcessProxy.h"
    3535
     36#define MESSAGE_CHECK_CONTEXTID(contextID) MESSAGE_CHECK_BASE(m_contextMap.isValidKey(contextId), m_page->process().connection())
     37
    3638namespace WebKit {
    3739using namespace WebCore;
    … …  
    372374void PlaybackSessionManagerProxy::setUpPlaybackControlsManagerWithID(uint64_t contextId)
    373375{
     376    MESSAGE_CHECK_CONTEXTID(contextID);
    374377    if (m_controlsManagerContextId == contextId)
    375378        return;
    … …  
    397400void PlaybackSessionManagerProxy::currentTimeChanged(uint64_t contextId, double currentTime, double hostTime)
    398401{
     402    MESSAGE_CHECK_CONTEXTID(contextID);
    399403    ensureModel(contextId).currentTimeChanged(currentTime);
    400404}
    … …  
    402406void PlaybackSessionManagerProxy::bufferedTimeChanged(uint64_t contextId, double bufferedTime)
    403407{
     408    MESSAGE_CHECK_CONTEXTID(contextID);
    404409    ensureModel(contextId).bufferedTimeChanged(bufferedTime);
    405410}
    … …  
    407412void PlaybackSessionManagerProxy::seekableRangesVectorChanged(uint64_t contextId, Vector<std::pair<double, double>> ranges, double lastModifiedTime, double liveUpdateInterval)
    408413{
     414    MESSAGE_CHECK_CONTEXTID(contextID);
    409415    Ref<TimeRanges> timeRanges = TimeRanges::create();
    410416    for (const auto& range : ranges) {
    … …  
    420426void PlaybackSessionManagerProxy::canPlayFastReverseChanged(uint64_t contextId, bool value)
    421427{
     428    MESSAGE_CHECK_CONTEXTID(contextID);
    422429    ensureModel(contextId).canPlayFastReverseChanged(value);
    423430}
    … …  
    425432void PlaybackSessionManagerProxy::audioMediaSelectionOptionsChanged(uint64_t contextId, Vector<MediaSelectionOption> options, uint64_t selectedIndex)
    426433{
     434    MESSAGE_CHECK_CONTEXTID(contextID);
    427435    ensureModel(contextId).audioMediaSelectionOptionsChanged(options, selectedIndex);
    428436}
    … …  
    430438void PlaybackSessionManagerProxy::legibleMediaSelectionOptionsChanged(uint64_t contextId, Vector<MediaSelectionOption> options, uint64_t selectedIndex)
    431439{
     440    MESSAGE_CHECK_CONTEXTID(contextID);
    432441    ensureModel(contextId).legibleMediaSelectionOptionsChanged(options, selectedIndex);
    433442}
    … …  
    435444void PlaybackSessionManagerProxy::audioMediaSelectionIndexChanged(uint64_t contextId, uint64_t selectedIndex)
    436445{
     446    MESSAGE_CHECK_CONTEXTID(contextID);
    437447    ensureModel(contextId).audioMediaSelectionIndexChanged(selectedIndex);
    438448}
    … …  
    440450void PlaybackSessionManagerProxy::legibleMediaSelectionIndexChanged(uint64_t contextId, uint64_t selectedIndex)
    441451{
     452    MESSAGE_CHECK_CONTEXTID(contextID);
    442453    ensureModel(contextId).legibleMediaSelectionIndexChanged(selectedIndex);
    443454}
    … …  
    445456void PlaybackSessionManagerProxy::externalPlaybackPropertiesChanged(uint64_t contextId, bool enabled, uint32_t targetType, String localizedDeviceName)
    446457{
     458    MESSAGE_CHECK_CONTEXTID(contextID);
    447459    PlaybackSessionModel::ExternalPlaybackTargetType type = static_cast<PlaybackSessionModel::ExternalPlaybackTargetType>(targetType);
    448460    ASSERT(type == PlaybackSessionModel::TargetTypeAirPlay || type == PlaybackSessionModel::TargetTypeTVOut || type == PlaybackSessionModel::TargetTypeNone);
    … …  
    453465void PlaybackSessionManagerProxy::wirelessVideoPlaybackDisabledChanged(uint64_t contextId, bool disabled)
    454466{
     467    MESSAGE_CHECK_CONTEXTID(contextID);
    455468    ensureModel(contextId).wirelessVideoPlaybackDisabledChanged(disabled);
    456469}
    … …  
    458471void PlaybackSessionManagerProxy::mutedChanged(uint64_t contextId, bool muted)
    459472{
     473    MESSAGE_CHECK_CONTEXTID(contextID);
    460474    ensureModel(contextId).mutedChanged(muted);
    461475}
    … …  
    463477void PlaybackSessionManagerProxy::volumeChanged(uint64_t contextId, double volume)
    464478{
     479    MESSAGE_CHECK_CONTEXTID(contextID);
    465480    ensureModel(contextId).volumeChanged(volume);
    466481}
    … …  
    468483void PlaybackSessionManagerProxy::durationChanged(uint64_t contextId, double duration)
    469484{
     485    MESSAGE_CHECK_CONTEXTID(contextID);
    470486    ensureModel(contextId).durationChanged(duration);
    471487}
    … …  
    473489void PlaybackSessionManagerProxy::playbackStartedTimeChanged(uint64_t contextId, double playbackStartedTime)
    474490{
     491    MESSAGE_CHECK_CONTEXTID(contextID);
    475492    ensureModel(contextId).playbackStartedTimeChanged(playbackStartedTime);
    476493}
    … …  
    478495void PlaybackSessionManagerProxy::rateChanged(uint64_t contextId, bool isPlaying, double rate)
    479496{
     497    MESSAGE_CHECK_CONTEXTID(contextID);
    480498    ensureModel(contextId).rateChanged(isPlaying, rate);
    481499}
    … …  
    483501void PlaybackSessionManagerProxy::pictureInPictureSupportedChanged(uint64_t contextId, bool supported)
    484502{
     503    MESSAGE_CHECK_CONTEXTID(contextID);
    485504    ensureModel(contextId).pictureInPictureSupportedChanged(supported);
    486505}
    … …  
    488507void PlaybackSessionManagerProxy::pictureInPictureActiveChanged(uint64_t contextId, bool active)
    489508{
     509    MESSAGE_CHECK_CONTEXTID(contextID);
    490510    ensureModel(contextId).pictureInPictureActiveChanged(active);
    491511}
    … …  
    493513void PlaybackSessionManagerProxy::handleControlledElementIDResponse(uint64_t contextId, String identifier) const
    494514{
     515    MESSAGE_CHECK_CONTEXTID(contextID);
    495516#if PLATFORM(MAC)
    496517    if (contextId == m_controlsManagerContextId)
    … …  
    608629} // namespace WebKit
    609630
     631#undef MESSAGE_CHECK_CONTEXTID
     632
    610633#endif // PLATFORM(IOS_FAMILY) || (PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))

  • trunk/Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp

    r241145 r242378  
    4040#include <wtf/UniqueRef.h>
    4141
     42#define MESSAGE_CHECK_CONTEXTID(id) MESSAGE_CHECK_BASE(m_proxies.isValidKey(id), m_process.connection())
     43
    4244namespace WebKit {
    4345using namespace WebCore;
    … …  
    140142void UserMediaCaptureManagerProxy::createMediaSourceForCaptureDeviceWithConstraints(uint64_t id, const CaptureDevice& device, String&& hashSalt, const MediaConstraints& constraints, bool& succeeded, String& invalidConstraints, WebCore::RealtimeMediaSourceSettings& settings)
    141143{
     144    MESSAGE_CHECK_CONTEXTID(id);
     145
    142146    CaptureSourceOrError sourceOrError;
    143147    switch (device.type()) {
    … …  
    170174void UserMediaCaptureManagerProxy::startProducingData(uint64_t id)
    171175{
     176    MESSAGE_CHECK_CONTEXTID(id);
    172177    auto iter = m_proxies.find(id);
    173178    if (iter != m_proxies.end())
    … …  
    177182void UserMediaCaptureManagerProxy::stopProducingData(uint64_t id)
    178183{
     184    MESSAGE_CHECK_CONTEXTID(id);
    179185    auto iter = m_proxies.find(id);
    180186    if (iter != m_proxies.end())
    … …  
    184190void UserMediaCaptureManagerProxy::end(uint64_t id)
    185191{
     192    MESSAGE_CHECK_CONTEXTID(id);
    186193    m_proxies.remove(id);
    187194}
    … …  
    189196void UserMediaCaptureManagerProxy::capabilities(uint64_t id, WebCore::RealtimeMediaSourceCapabilities& capabilities)
    190197{
     198    MESSAGE_CHECK_CONTEXTID(id);
    191199    auto iter = m_proxies.find(id);
    192200    if (iter != m_proxies.end())
    … …  
    196204void UserMediaCaptureManagerProxy::setMuted(uint64_t id, bool muted)
    197205{
     206    MESSAGE_CHECK_CONTEXTID(id);
    198207    auto iter = m_proxies.find(id);
    199208    if (iter != m_proxies.end())
    … …  
    203212void UserMediaCaptureManagerProxy::applyConstraints(uint64_t id, const WebCore::MediaConstraints& constraints)
    204213{
     214    MESSAGE_CHECK_CONTEXTID(id);
    205215    auto iter = m_proxies.find(id);
    206216    if (iter == m_proxies.end())
    … …  
    222232}
    223233
     234#undef MESSAGE_CHECK_CONTEXTID
     235
    224236#endif

  • trunk/Source/WebKit/UIProcess/Cocoa/VideoFullscreenManagerProxy.mm

    r241745 r242378  
    122122#endif
    123123
     124#define MESSAGE_CHECK_CONTEXTID(contextID) MESSAGE_CHECK_BASE(m_contextMap.isValidKey(contextId), m_page->process().connection())
     125
    124126namespace WebKit {
    125127using namespace WebCore;
    … …  
    469471void VideoFullscreenManagerProxy::setupFullscreenWithID(uint64_t contextId, uint32_t videoLayerID, const WebCore::IntRect& initialRect, float hostingDeviceScaleFactor, HTMLMediaElementEnums::VideoFullscreenMode videoFullscreenMode, bool allowsPictureInPicture, bool standby)
    470472{
     473    MESSAGE_CHECK_CONTEXTID(contextId);
     474
    471475    ASSERT(videoLayerID);
    472476    RefPtr<VideoFullscreenModelContext> model;
    … …  
    505509void VideoFullscreenManagerProxy::setHasVideo(uint64_t contextId, bool hasVideo)
    506510{
     511    MESSAGE_CHECK_CONTEXTID(contextId);
    507512    ensureInterface(contextId).hasVideoChanged(hasVideo);
    508513}
    … …  
    510515void VideoFullscreenManagerProxy::setVideoDimensions(uint64_t contextId, const FloatSize& videoDimensions)
    511516{
     517    MESSAGE_CHECK_CONTEXTID(contextId);
    512518    ensureInterface(contextId).videoDimensionsChanged(videoDimensions);
    513519}
    … …  
    515521void VideoFullscreenManagerProxy::enterFullscreen(uint64_t contextId)
    516522{
     523    MESSAGE_CHECK_CONTEXTID(contextId);
     524
    517525    auto& interface = ensureInterface(contextId);
    518526    interface.enterFullscreen();
    … …  
    532540void VideoFullscreenManagerProxy::exitFullscreen(uint64_t contextId, WebCore::IntRect finalRect)
    533541{
     542    MESSAGE_CHECK_CONTEXTID(contextId);
     543
    534544    ASSERT(m_contextMap.contains(contextId));
    535545    if (!m_contextMap.contains(contextId))
    … …  
    548558void VideoFullscreenManagerProxy::exitFullscreenWithoutAnimationToMode(uint64_t contextId, WebCore::HTMLMediaElementEnums::VideoFullscreenMode targetMode)
    549559{
     560    MESSAGE_CHECK_CONTEXTID(contextId);
    550561    ensureInterface(contextId).exitFullscreenWithoutAnimationToMode(targetMode);
    551562}
    … …  
    556567void VideoFullscreenManagerProxy::setInlineRect(uint64_t contextId, const WebCore::IntRect& inlineRect, bool visible)
    557568{
     569    MESSAGE_CHECK_CONTEXTID(contextId);
    558570    ensureInterface(contextId).setInlineRect(inlineRect, visible);
    559571}
    … …  
    561573void VideoFullscreenManagerProxy::setHasVideoContentLayer(uint64_t contextId, bool value)
    562574{
     575    MESSAGE_CHECK_CONTEXTID(contextId);
    563576    ensureInterface(contextId).setHasVideoContentLayer(value);
    564577}
    … …  
    580593void VideoFullscreenManagerProxy::cleanupFullscreen(uint64_t contextId)
    581594{
     595    MESSAGE_CHECK_CONTEXTID(contextId);
    582596    ensureInterface(contextId).cleanupFullscreen();
    583597}
    … …  
    585599void VideoFullscreenManagerProxy::preparedToReturnToInline(uint64_t contextId, bool visible, WebCore::IntRect inlineRect)
    586600{
     601    MESSAGE_CHECK_CONTEXTID(contextId);
    587602    m_page->fullscreenMayReturnToInline();
    588603
    … …  
    598613void VideoFullscreenManagerProxy::preparedToExitFullscreen(uint64_t contextId)
    599614{
     615    MESSAGE_CHECK_CONTEXTID(contextId);
    600616    ensureInterface(contextId).preparedToExitFullscreen();
    601617}
    … …  
    698714} // namespace WebKit
    699715
     716#undef MESSAGE_CHECK_CONTEXTID
     717
    700718#endif // PLATFORM(IOS_FAMILY) || (PLATFORM(MAC) && ENABLE(VIDEO_PRESENTATION_MODE))

  • trunk/Source/WebKit/UIProcess/ios/EditableImageController.mm

    r239628 r242378  
    3939#import <wtf/RetainPtr.h>
    4040
     41#define MESSAGE_CHECK_VIEWID(embeddedViewID) MESSAGE_CHECK_BASE(m_editableImages.isValidKey(embeddedViewID), connection())
     42
    4143namespace WebKit {
    4244
    … …  
    7476void EditableImageController::didCreateEditableImage(WebCore::GraphicsLayer::EmbeddedViewID embeddedViewID)
    7577{
     78    MESSAGE_CHECK_VIEWID(embeddedViewID);
    7679    ensureEditableImage(embeddedViewID);
    7780}
    … …  
    7982void EditableImageController::didDestroyEditableImage(WebCore::GraphicsLayer::EmbeddedViewID embeddedViewID)
    8083{
     84    MESSAGE_CHECK_VIEWID(embeddedViewID);
    8185    m_editableImages.remove(embeddedViewID);
    8286}
    … …  
    8488void EditableImageController::associateWithAttachment(WebCore::GraphicsLayer::EmbeddedViewID embeddedViewID, const String& attachmentID)
    8589{
     90    MESSAGE_CHECK_VIEWID(embeddedViewID);
    8691    if (!m_webPageProxy)
    8792        return;
    … …  
    151156} // namespace WebKit
    152157
     158#undef MESSAGE_CHECK_VIEWID
     159
    153160#endif // HAVE(PENCILKIT)
Note: See TracChangeset for help on using the changeset viewer.