Changeset 283952 in webkit

Timestamp:

Oct 11, 2021, 5:05:35 PM (5 years ago)

Author:

Chris Dumez

Message:

[COOP] Crash under ReportingEndpointsCache::addEndpointFromDictionary()
​https://bugs.webkit.org/show_bug.cgi?id=231537
<rdar://83530643>

Reviewed by Geoffrey Garen.

Source/WebCore:

Make sure we don't crash under addEndpointFromDictionary() when the Report-To HTTP header
contains more than one endpoint URL for a given group.

The loop inside addEndpointFromDictionary() should bail as soon as we find a viable
endpoint URL (since we don't currently support having several URLs for a given group).
The crash was due to a use-after-move of the |group|.

Test: http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html

• loader/ReportingEndpointsCache.cpp:

(WebCore::ReportingEndpointsCache::addEndpointFromDictionary):

LayoutTests:

Add layout test coverage.

• http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints-expected.txt: Added.
• http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html: Added.
• http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html.headers: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints-expected.txt (added)
• LayoutTests/http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html (added)
• LayoutTests/http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html.headers (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/loader/ReportingEndpointsCache.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-10-11  Chris Dumez  <cdumez@apple.com>
+
+        [COOP] Crash under ReportingEndpointsCache::addEndpointFromDictionary()
+        https://bugs.webkit.org/show_bug.cgi?id=231537
+        <rdar://83530643>
+
+        Reviewed by Geoffrey Garen.
+
+        Add layout test coverage.
+
+        * http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints-expected.txt: Added.
+        * http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html: Added.
+        * http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html.headers: Added.
+
 2021-10-11  Ayumi Kojima  <ayumi_kojima@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-10-11  Chris Dumez  <cdumez@apple.com>
+
+        [COOP] Crash under ReportingEndpointsCache::addEndpointFromDictionary()
+        https://bugs.webkit.org/show_bug.cgi?id=231537
+        <rdar://83530643>
+
+        Reviewed by Geoffrey Garen.
+
+        Make sure we don't crash under addEndpointFromDictionary() when the Report-To HTTP header
+        contains more than one endpoint URL for a given group.
+
+        The loop inside addEndpointFromDictionary() should bail as soon as we find a viable
+        endpoint URL (since we don't currently support having several URLs for a given group).
+        The crash was due to a use-after-move of the |group|.
+
+        Test: http/wpt/cross-origin-opener-policy/report-to-multiple-endpoints.html
+
+        * loader/ReportingEndpointsCache.cpp:
+        (WebCore::ReportingEndpointsCache::addEndpointFromDictionary):
+
 2021-10-11  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebCore/loader/ReportingEndpointsCache.cpp

@@ -158 +158 @@
         }).iterator->value;
         endpointsForOrigin.add(WTFMove(group), Endpoint(WTFMove(endpointURL), Seconds { static_cast<double>(*maxAge) }));
+        return;
     }
 }