Changeset 251358 in webkit


Ignore:
Timestamp:
Oct 20, 2019, 6:55:11 PM (6 years ago)
Author:
Brent Fulgham
Message:

Improve serialization logic
​https://bugs.webkit.org/show_bug.cgi?id=203039
<rdar://problem/55631691>

Reviewed by Alex Christensen.

Check that the SecItemRequestData only contains relevant types for
CFNetwork uses.

  • Platform/spi/Cocoa/SecItemSPI.h: Added.
  • Shared/mac/SecItemRequestData.cpp:

(WebKit::arrayContainsInvalidType): Added.
(WebKit::dictionaryContainsInvalidType): Added.
(WebKit::validTypeIDs): Added.
(WebKit::isValidType): Added.
(WebKit::SecItemRequestData::decode): Check types during decode.

  • Shared/mac/SecItemRequestData.h:
  • WebKit.xcodeproj/project.pbxproj:
Location:
trunk/Source/WebKit
Files:
4 edited
1 copied

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r251326 r251358  
     12019-10-20  Brent Fulgham  <bfulgham@apple.com>
     2
     3        Improve serialization logic
     4        https://bugs.webkit.org/show_bug.cgi?id=203039
     5        <rdar://problem/55631691>
     6
     7        Reviewed by Alex Christensen.
     8
     9        Check that the SecItemRequestData only contains relevant types for
     10        CFNetwork uses.
     11
     12        * Platform/spi/Cocoa/SecItemSPI.h: Added.
     13        * Shared/mac/SecItemRequestData.cpp:
     14        (WebKit::arrayContainsInvalidType): Added.
     15        (WebKit::dictionaryContainsInvalidType): Added.
     16        (WebKit::validTypeIDs): Added.
     17        (WebKit::isValidType): Added.
     18        (WebKit::SecItemRequestData::decode): Check types during decode.
     19        * Shared/mac/SecItemRequestData.h:
     20        * WebKit.xcodeproj/project.pbxproj:
     21
    1222019-10-19  Adrian Perez de Castro  <aperez@igalia.com>
    223

  • trunk/Source/WebKit/Platform/spi/Cocoa/SecItemSPI.h

    r251357 r251358  
    11/*
    2  * Copyright (C) 2011 Apple Inc. All rights reserved.
     2 * Copyright (C) 2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2424 */
    2525
    26 #ifndef SecItemRequestData_h
    27 #define SecItemRequestData_h
     26#pragma once
    2827
    29 #include <wtf/RetainPtr.h>
     28#include <Security/SecAccessControl.h>
     29#include <Security/SecBase.h>
     30#include <Security/SecCertificate.h>
     31#include <Security/SecIdentity.h>
     32#include <Security/SecPolicy.h>
     33#include <Security/SecTrust.h>
    3034
    31 namespace IPC {
    32 class Decoder;
    33 class Encoder;
     35#if PLATFORM(MAC)
     36#include <Security/SecACL.h>
     37#include <Security/SecAccess.h>
     38#include <Security/SecTrustedApplication.h>
     39#endif
     40
     41#if USE(APPLE_INTERNAL_SDK)
     42
     43#include <Security/SecCode.h>
     44#include <Security/SecRequirement.h>
     45#include <Security/SecStaticCode.h>
     46
     47#else
     48
     49#ifdef __cplusplus
     50extern "C" {
     51#endif
     52
     53CF_ASSUME_NONNULL_BEGIN
     54
     55CFTypeID SecCodeGetTypeID();
     56CFTypeID SecRequirementGetTypeID();
     57CFTypeID SecStaticCodeGetTypeID();
     58
     59CF_ASSUME_NONNULL_END
     60
     61#ifdef __cplusplus
    3462}
     63#endif
    3564
    36 namespace WebKit {
    37    
    38 class SecItemRequestData {
    39 public:
    40     enum Type {
    41         Invalid,
    42         CopyMatching,
    43         Add,
    44         Update,
    45         Delete,
    46     };
    47 
    48     SecItemRequestData();
    49     SecItemRequestData(Type, CFDictionaryRef query);
    50     SecItemRequestData(Type, CFDictionaryRef query, CFDictionaryRef attributesToMatch);
    51 
    52     void encode(IPC::Encoder&) const;
    53     static bool decode(IPC::Decoder&, SecItemRequestData&);
    54 
    55     Type type() const { return m_type; }
    56 
    57     CFDictionaryRef query() const { return m_queryDictionary.get(); }
    58     CFDictionaryRef attributesToMatch() const { return m_attributesToMatch.get(); }
    59 
    60 private:
    61     Type m_type;
    62     RetainPtr<CFDictionaryRef> m_queryDictionary;
    63     RetainPtr<CFDictionaryRef> m_attributesToMatch;
    64 };
    65    
    66 } // namespace WebKit
    67 
    68 #endif // SecItemRequestData_h
     65#endif // USE(APPLE_INTERNAL_SDK)

  • trunk/Source/WebKit/Shared/mac/SecItemRequestData.cpp

    r204668 r251358  
    11/*
    2  * Copyright (C) 2011 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2929#include "ArgumentCoders.h"
    3030#include "ArgumentCodersCF.h"
     31#include "SecItemSPI.h"
     32#include <CoreFoundation/CoreFoundation.h>
    3133
    3234namespace WebKit {
    … …  
    6365}
    6466
     67static bool isValidType(CFTypeRef);
     68
     69static bool arrayContainsInvalidType(CFArrayRef array)
     70{
     71    CFIndex entryCount = CFArrayGetCount(array);
     72
     73    for (CFIndex entry = 0; entry < entryCount; ++entry) {
     74        CFTypeRef value = reinterpret_cast<CFTypeRef>(CFArrayGetValueAtIndex(array, entry));
     75        if (!isValidType(value))
     76            return true;
     77    }
     78
     79    return false;
     80}
     81
     82static bool dictionaryContainsInvalidType(CFDictionaryRef dict)
     83{
     84    CFIndex entryCount = CFDictionaryGetCount(dict);
     85
     86    Vector<const void*> keys(entryCount);
     87    Vector<const void*> values(entryCount);
     88    CFDictionaryGetKeysAndValues(dict, keys.data(), values.data());
     89
     90    for (CFIndex entry = 0; entry < entryCount; ++entry) {
     91        CFTypeRef key = reinterpret_cast<CFTypeRef>(keys[entry]);
     92        if (!isValidType(key))
     93            return true;
     94
     95        CFTypeRef value = reinterpret_cast<CFTypeRef>(values[entry]);
     96        if (!isValidType(value))
     97            return true;
     98    }
     99
     100    return false;
     101}
     102
     103#if PLATFORM(MAC)
     104typedef std::array<CFTypeID, 16> ValidTypes;
     105#else
     106typedef std::array<CFTypeID, 13> ValidTypes;
     107#endif
     108
     109static const ValidTypes& validTypeIDs()
     110{
     111    static ValidTypes types = {{
     112        CFBooleanGetTypeID(), CFDataGetTypeID(), CFStringGetTypeID(), CFNullGetTypeID(), CFNumberGetTypeID(),
     113        SecAccessControlGetTypeID(), SecCertificateGetTypeID(), SecCodeGetTypeID(), SecIdentityGetTypeID(),
     114        SecPolicyGetTypeID(), SecRequirementGetTypeID(), SecStaticCodeGetTypeID(), SecTrustGetTypeID()
     115#if PLATFORM(MAC)
     116        , SecACLGetTypeID(), SecAccessGetTypeID(), SecTrustedApplicationGetTypeID()
     117#endif
     118    }};
     119
     120    static dispatch_once_t onceToken;
     121    dispatch_once(&onceToken, ^{
     122        std::sort(types.begin(), types.end());
     123    });
     124
     125    return types;
     126}
     127
     128static bool isValidType(CFTypeRef type)
     129{
     130    auto typeID = CFGetTypeID(type);
     131    if (typeID == CFDictionaryGetTypeID())
     132        return !dictionaryContainsInvalidType(reinterpret_cast<CFDictionaryRef>(type));
     133
     134    if (typeID == CFArrayGetTypeID())
     135        return !arrayContainsInvalidType(reinterpret_cast<CFArrayRef>(type));
     136
     137    const auto& validTypes = validTypeIDs();
     138   
     139    bool validType = std::binary_search(validTypes.begin(), validTypes.end(), typeID);
     140    if (!validType) {
     141        String typeName { adoptCF(CFCopyTypeIDDescription(typeID)).get() };
     142        WTFLogAlways("SecItemRequestData::decode: Attempted to serialized invalid type %s", typeName.utf8().data());
     143    }
     144    return validType;
     145}
     146
    65147bool SecItemRequestData::decode(IPC::Decoder& decoder, SecItemRequestData& secItemRequestData)
    66148{
    … …  
    72154        return false;
    73155
    74     if (expectQuery && !IPC::decode(decoder, secItemRequestData.m_queryDictionary))
    75         return false;
     156    if (expectQuery) {
     157        if (!IPC::decode(decoder, secItemRequestData.m_queryDictionary))
     158            return false;
     159
     160        if (dictionaryContainsInvalidType(secItemRequestData.m_queryDictionary.get()))
     161            return false;
     162    }
    76163   
    77164    bool expectAttributes;
    … …  
    79166        return false;
    80167   
    81     if (expectAttributes && !IPC::decode(decoder, secItemRequestData.m_attributesToMatch))
    82         return false;
    83    
     168    if (expectAttributes) {
     169        if (!IPC::decode(decoder, secItemRequestData.m_attributesToMatch))
     170            return false;
     171
     172        if (dictionaryContainsInvalidType(secItemRequestData.m_attributesToMatch.get()))
     173            return false;
     174    }
     175
    84176    return true;
    85177}

  • trunk/Source/WebKit/Shared/mac/SecItemRequestData.h

    r204668 r251358  
    11/*
    2  * Copyright (C) 2011 Apple Inc. All rights reserved.
     2 * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2424 */
    2525
    26 #ifndef SecItemRequestData_h
    27 #define SecItemRequestData_h
     26#pragma once
    2827
    2928#include <wtf/RetainPtr.h>
    … …  
    6564   
    6665} // namespace WebKit
    67 
    68 #endif // SecItemRequestData_h

  • trunk/Source/WebKit/WebKit.xcodeproj/project.pbxproj

    r251320 r251358  
    11791179                7A8A9D5A1EF13029009801AE /* APIInjectedBundleBundleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A8A9D591EF13020009801AE /* APIInjectedBundleBundleClient.h */; };
    11801180                7A8A9D5C1EF14598009801AE /* APIInjectedBundlePageResourceLoadClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A8A9D5B1EF1458E009801AE /* APIInjectedBundlePageResourceLoadClient.h */; };
     1181                7AA746D523593D8100095050 /* SecItemSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AA746D42359308400095050 /* SecItemSPI.h */; };
    11811182                7AB6EA451EEAAE3800037B2B /* APIIconDatabaseClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AB6EA441EEAAE2300037B2B /* APIIconDatabaseClient.h */; };
    11821183                7AB6EA471EEAB6B800037B2B /* APIGeolocationProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AB6EA461EEAB6B000037B2B /* APIGeolocationProvider.h */; };
    … …  
    37683769                7A8A9D591EF13020009801AE /* APIInjectedBundleBundleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIInjectedBundleBundleClient.h; sourceTree = "<group>"; };
    37693770                7A8A9D5B1EF1458E009801AE /* APIInjectedBundlePageResourceLoadClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIInjectedBundlePageResourceLoadClient.h; sourceTree = "<group>"; };
     3771                7AA746D42359308400095050 /* SecItemSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecItemSPI.h; sourceTree = "<group>"; };
    37703772                7AB4EA3F22777C460085BBAA /* SandboxExtensionCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SandboxExtensionCocoa.mm; sourceTree = "<group>"; };
    37713773                7AB4EA4122777FC70085BBAA /* SandboxInitialiationParametersCocoa.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = SandboxInitialiationParametersCocoa.mm; sourceTree = "<group>"; };
    … …  
    62706272                                57B826402304EB3E00B72EB0 /* NearFieldSPI.h */,
    62716273                                3754D5441B3A29FD003A4C7F /* NSInvocationSPI.h */,
     6274                                0E97D74C200E8FF300BF6643 /* SafeBrowsingSPI.h */,
     6275                                7AA746D42359308400095050 /* SecItemSPI.h */,
    62726276                                37B47E2C1D64DB76005F4EFF /* objcSPI.h */,
    6273                                 0E97D74C200E8FF300BF6643 /* SafeBrowsingSPI.h */,
    62746277                        );
    62756278                        path = Cocoa;
    … …  
    94079410                                1A4D664818A2D91A00D82E21 /* APIUIClient.h in Headers */,
    94089411                                BCDB86C11200FB97007254BE /* APIURL.h in Headers */,
     9412                                7AA746D523593D8100095050 /* SecItemSPI.h in Headers */,
    94099413                                BCE2315D122C30CA00D5C35A /* APIURLRequest.h in Headers */,
    94109414                                BC90A1D2122DD55E00CC8C50 /* APIURLResponse.h in Headers */,
Note: See TracChangeset for help on using the changeset viewer.