Changeset 274153 in webkit

Timestamp:

Mar 9, 2021, 9:37:44 AM (5 years ago)

Author:

Chris Dumez

Message:

[IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
​https://bugs.webkit.org/show_bug.cgi?id=222955
<rdar://problem/75195062>

Reviewed by Anders Carlsson.

The Strings passed in textFieldValues are used as keys in a HashMap later on so we need
to validate them.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::willSubmitForm):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/WebPageProxy.cpp (modified) (2 diffs)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2021-03-09  Chris Dumez  <cdumez@apple.com>
+
+        [IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
+        https://bugs.webkit.org/show_bug.cgi?id=222955
+        <rdar://problem/75195062>
+
+        Reviewed by Anders Carlsson.
+
+        The Strings passed in textFieldValues are used as keys in a HashMap later on so we need
+        to validate them.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::willSubmitForm):
+
 2021-03-09  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/UIProcess/WebPageProxy.cpp

@@ -32 +32 @@
 #include "APIContentWorld.h"
 #include "APIContextMenuClient.h"
+#include "APIDictionary.h"
 #include "APIFindClient.h"
 #include "APIFindMatchesClient.h"
@@ -5439 +5440 @@
     MESSAGE_CHECK(m_process, sourceFrame);
 
+    for (auto& pair : textFieldValues)
+        MESSAGE_CHECK(m_process, API::Dictionary::MapType::isValidKey(pair.first));
+
     m_formClient->willSubmitForm(*this, *frame, *sourceFrame, textFieldValues, m_process->transformHandlesToObjects(userData.object()).get(), [this, protectedThis = makeRef(*this), frameID, listenerID]() {
         send(Messages::WebPage::ContinueWillSubmitForm(frameID, listenerID));