Changeset 163242 in webkit

Timestamp:

Feb 1, 2014 8:32:11 AM (10 years ago)

Author:

ddkilzer@apple.com

Message:

Add security-checked casts for all WebCore::CachedResource subclasses
<​http://webkit.org/b/127988>

Reviewed by Darin Adler.

• inspector/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::cachedResourceContent):

• inspector/InspectorResourceAgent.cpp:

(WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):

• Switch from static_cast<>() to security-checked cast.

• loader/cache/CachedCSSStyleSheet.h:

(WebCore::toCachedCSSStyleSheet): Add.

• loader/cache/CachedFont.h:

(WebCore::toCachedFont): Add.

• loader/cache/CachedImage.h: Make CachedImageManual final.

• loader/cache/CachedRawResource.cpp:

(WebCore::CachedRawResource::CachedRawResource): Add assert that
only MainResource or RawResource types are used to construct a
CachedRawResource. This may be a security issue depending on
what code exists that uses the type() value to cast to a
CachedResource subclass.
(WebCore::CachedRawResource::switchClientsToRevalidatedResource):
Switch from static_cast<>() to toCachedRawResource().

• loader/cache/CachedRawResource.h:

(WebCore::toCachedRawResource): Add.

• loader/cache/CachedResource.h:

(WebCore::CachedResource::isMainOrRawResource): Add. A
CachedRawResource could be either a MainResource or a
RawResource. Currently only used in assertions.

• loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::requestFont):
(WebCore::CachedResourceLoader::requestTextTrack):
(WebCore::CachedResourceLoader::requestCSSStyleSheet):
(WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
(WebCore::CachedResourceLoader::requestScript):
(WebCore::CachedResourceLoader::requestXSLStyleSheet):
(WebCore::CachedResourceLoader::requestSVGDocument):
(WebCore::CachedResourceLoader::requestRawResource):
(WebCore::CachedResourceLoader::requestMainResource):

• Switch from static_cast<>() to security-checked cast.

• loader/cache/CachedSVGDocument.h:

(WebCore::toCachedSVGDocument): Add.

• loader/cache/CachedScript.h:

(WebCore::toCachedScript): Add.

• loader/cache/CachedTextTrack.h:

(WebCore::toCachedTextTrack): Add.

• loader/cache/CachedXSLStyleSheet.h:

(WebCore::toCachedXSLStyleSheet): Add.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• inspector/InspectorPageAgent.cpp (modified) (1 diff)
• inspector/InspectorResourceAgent.cpp (modified) (1 diff)
• loader/cache/CachedCSSStyleSheet.h (modified) (1 diff)
• loader/cache/CachedFont.h (modified) (1 diff)
• loader/cache/CachedImage.h (modified) (1 diff)
• loader/cache/CachedRawResource.cpp (modified) (2 diffs)
• loader/cache/CachedRawResource.h (modified) (1 diff)
• loader/cache/CachedResource.h (modified) (1 diff)
• loader/cache/CachedResourceLoader.cpp (modified) (8 diffs)
• loader/cache/CachedSVGDocument.h (modified) (1 diff)
• loader/cache/CachedScript.h (modified) (1 diff)
• loader/cache/CachedTextTrack.h (modified) (1 diff)
• loader/cache/CachedXSLStyleSheet.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2014-02-01  David Kilzer  <ddkilzer@apple.com>
+
+        Add security-checked casts for all WebCore::CachedResource subclasses
+        <http://webkit.org/b/127988>
+
+        Reviewed by Darin Adler.
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        - Switch from static_cast<>() to security-checked cast.
+
+        * loader/cache/CachedCSSStyleSheet.h:
+        (WebCore::toCachedCSSStyleSheet): Add.
+        * loader/cache/CachedFont.h:
+        (WebCore::toCachedFont): Add.
+
+        * loader/cache/CachedImage.h: Make CachedImageManual final.
+
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::CachedRawResource): Add assert that
+        only MainResource or RawResource types are used to construct a
+        CachedRawResource.  This may be a security issue depending on
+        what code exists that uses the type() value to cast to a
+        CachedResource subclass.
+        (WebCore::CachedRawResource::switchClientsToRevalidatedResource):
+        Switch from static_cast<>() to toCachedRawResource().
+
+        * loader/cache/CachedRawResource.h:
+        (WebCore::toCachedRawResource): Add.
+        * loader/cache/CachedResource.h:
+        (WebCore::CachedResource::isMainOrRawResource): Add.  A
+        CachedRawResource could be either a MainResource or a
+        RawResource.  Currently only used in assertions.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::requestFont):
+        (WebCore::CachedResourceLoader::requestTextTrack):
+        (WebCore::CachedResourceLoader::requestCSSStyleSheet):
+        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
+        (WebCore::CachedResourceLoader::requestScript):
+        (WebCore::CachedResourceLoader::requestXSLStyleSheet):
+        (WebCore::CachedResourceLoader::requestSVGDocument):
+        (WebCore::CachedResourceLoader::requestRawResource):
+        (WebCore::CachedResourceLoader::requestMainResource):
+        - Switch from static_cast<>() to security-checked cast.
+
+        * loader/cache/CachedSVGDocument.h:
+        (WebCore::toCachedSVGDocument): Add.
+        * loader/cache/CachedScript.h:
+        (WebCore::toCachedScript): Add.
+        * loader/cache/CachedTextTrack.h:
+        (WebCore::toCachedTextTrack): Add.
+        * loader/cache/CachedXSLStyleSheet.h:
+        (WebCore::toCachedXSLStyleSheet): Add.
+
 2014-02-01  Xabier Rodriguez Calvar  <calvaris@igalia.com>
 

trunk/Source/WebCore/inspector/InspectorPageAgent.cpp

@@ -175 +175 @@
         switch (cachedResource->type()) {
         case CachedResource::CSSStyleSheet:
-            *result = static_cast<CachedCSSStyleSheet*>(cachedResource)->sheetText(false);
+            *result = toCachedCSSStyleSheet(cachedResource)->sheetText(false);
             return true;
         case CachedResource::Script:
-            *result = static_cast<CachedScript*>(cachedResource)->script();
+            *result = toCachedScript(cachedResource)->script();
             return true;
         case CachedResource::RawResource: {

trunk/Source/WebCore/inspector/InspectorResourceAgent.cpp

@@ -335 +335 @@
     m_resourcesData->addCachedResource(requestId, resource);
     if (resource->type() == CachedResource::RawResource) {
-        CachedRawResource* rawResource = static_cast<CachedRawResource*>(resource);
+        CachedRawResource* rawResource = toCachedRawResource(resource);
         String rawRequestId = IdentifiersFactory::requestId(rawResource->identifier());
         m_resourcesData->reuseXHRReplayData(requestId, rawRequestId);

trunk/Source/WebCore/loader/cache/CachedCSSStyleSheet.h

@@ -68 +68 @@
     };
 
+CACHED_RESOURCE_TYPE_CASTS(CachedCSSStyleSheet, CachedResource, CachedResource::CSSStyleSheet)
+
 }
 

trunk/Source/WebCore/loader/cache/CachedFont.h

@@ -79 +79 @@
 };
 
+CACHED_RESOURCE_TYPE_CASTS(CachedFont, CachedResource, CachedResource::FontResource)
+
 } // namespace WebCore
 

trunk/Source/WebCore/loader/cache/CachedImage.h

@@ -150 +150 @@
 // into CachedImage or find a better place for this class.
 // FIXME: Remove the USE(CF) once we make MemoryCache::addImageToCache() platform-independent.
-class CachedImageManual : public CachedImage {
+class CachedImageManual final : public CachedImage {
 public:
     CachedImageManual(const URL&, Image*);

trunk/Source/WebCore/loader/cache/CachedRawResource.cpp

@@ -40 +40 @@
     , m_identifier(0)
 {
+    // FIXME: The wrong CachedResource::Type here may cause a bad cast elsewhere.
+    ASSERT(isMainOrRawResource());
 }
 
@@ -182 +184 @@
     // If we're in the middle of a successful revalidation, responseReceived() hasn't been called, so we haven't set m_identifier.
     ASSERT(!m_identifier);
-    static_cast<CachedRawResource*>(resourceToRevalidate())->m_identifier = m_loader->identifier();
+    toCachedRawResource(resourceToRevalidate())->m_identifier = m_loader->identifier();
     CachedResource::switchClientsToRevalidatedResource();
 }

trunk/Source/WebCore/loader/cache/CachedRawResource.h

@@ -89 +89 @@
 };
 
+TYPE_CASTS_BASE(CachedRawResource, CachedResource, resource, resource->isMainOrRawResource(), resource.isMainOrRawResource())
+
 }
 

trunk/Source/WebCore/loader/cache/CachedResource.h

@@ -157 +157 @@
 
     bool isImage() const { return type() == ImageResource; }
+    // FIXME: CachedRawResource could be either a main resource or a raw XHR resource.
+    bool isMainOrRawResource() const { return type() == MainResource || type() == RawResource; }
     bool ignoreForRequestCount() const
     {

trunk/Source/WebCore/loader/cache/CachedResourceLoader.cpp

@@ -166 +166 @@
 CachedResourceHandle<CachedFont> CachedResourceLoader::requestFont(CachedResourceRequest& request)
 {
-    return static_cast<CachedFont*>(requestResource(CachedResource::FontResource, request).get());
+    return toCachedFont(requestResource(CachedResource::FontResource, request).get());
 }
 
@@ -172 +172 @@
 CachedResourceHandle<CachedTextTrack> CachedResourceLoader::requestTextTrack(CachedResourceRequest& request)
 {
-    return static_cast<CachedTextTrack*>(requestResource(CachedResource::TextTrackResource, request).get());
+    return toCachedTextTrack(requestResource(CachedResource::TextTrackResource, request).get());
 }
 #endif
@@ -178 +178 @@
 CachedResourceHandle<CachedCSSStyleSheet> CachedResourceLoader::requestCSSStyleSheet(CachedResourceRequest& request)
 {
-    return static_cast<CachedCSSStyleSheet*>(requestResource(CachedResource::CSSStyleSheet, request).get());
+    return toCachedCSSStyleSheet(requestResource(CachedResource::CSSStyleSheet, request).get());
 }
 
@@ -191 +191 @@
     if (CachedResource* existing = memoryCache()->resourceForRequest(request.resourceRequest())) {
         if (existing->type() == CachedResource::CSSStyleSheet)
-            return static_cast<CachedCSSStyleSheet*>(existing);
+            return toCachedCSSStyleSheet(existing);
         memoryCache()->remove(existing);
     }
@@ -209 +209 @@
 CachedResourceHandle<CachedScript> CachedResourceLoader::requestScript(CachedResourceRequest& request)
 {
-    return static_cast<CachedScript*>(requestResource(CachedResource::Script, request).get());
+    return toCachedScript(requestResource(CachedResource::Script, request).get());
 }
 
@@ -215 +215 @@
 CachedResourceHandle<CachedXSLStyleSheet> CachedResourceLoader::requestXSLStyleSheet(CachedResourceRequest& request)
 {
-    return static_cast<CachedXSLStyleSheet*>(requestResource(CachedResource::XSLStyleSheet, request).get());
+    return toCachedXSLStyleSheet(requestResource(CachedResource::XSLStyleSheet, request).get());
 }
 #endif
@@ -222 +222 @@
 CachedResourceHandle<CachedSVGDocument> CachedResourceLoader::requestSVGDocument(CachedResourceRequest& request)
 {
-    return static_cast<CachedSVGDocument*>(requestResource(CachedResource::SVGDocumentResource, request).get());
+    return toCachedSVGDocument(requestResource(CachedResource::SVGDocumentResource, request).get());
 }
 #endif
@@ -237 +237 @@
 CachedResourceHandle<CachedRawResource> CachedResourceLoader::requestRawResource(CachedResourceRequest& request)
 {
-    return static_cast<CachedRawResource*>(requestResource(CachedResource::RawResource, request).get());
+    return toCachedRawResource(requestResource(CachedResource::RawResource, request).get());
 }
 
 CachedResourceHandle<CachedRawResource> CachedResourceLoader::requestMainResource(CachedResourceRequest& request)
 {
-    return static_cast<CachedRawResource*>(requestResource(CachedResource::MainResource, request).get());
+    return toCachedRawResource(requestResource(CachedResource::MainResource, request).get());
 }
 

trunk/Source/WebCore/loader/cache/CachedSVGDocument.h

@@ -50 +50 @@
 };
 
+CACHED_RESOURCE_TYPE_CASTS(CachedSVGDocument, CachedResource, CachedResource::SVGDocumentResource)
+
 } // namespace WebCore
 

trunk/Source/WebCore/loader/cache/CachedScript.h

@@ -62 +62 @@
         RefPtr<TextResourceDecoder> m_decoder;
     };
+
+CACHED_RESOURCE_TYPE_CASTS(CachedScript, CachedResource, CachedResource::Script)
+
 }
 

trunk/Source/WebCore/loader/cache/CachedTextTrack.h

@@ -45 +45 @@
 };
 
+CACHED_RESOURCE_TYPE_CASTS(CachedTextTrack, CachedResource, CachedResource::TextTrackResource)
+
 }
 

trunk/Source/WebCore/loader/cache/CachedXSLStyleSheet.h

@@ -58 +58 @@
     };
 
+CACHED_RESOURCE_TYPE_CASTS(CachedXSLStyleSheet, CachedResource, CachedResource::XSLStyleSheet)
+
 #endif