Changeset 217051 in webkit


Ignore:
Timestamp:
May 18, 2017, 11:09:24 AM (9 years ago)
Author:
Joseph Pecoraro
Message:

Remote Inspector: Be stricter about checking message types
​https://bugs.webkit.org/show_bug.cgi?id=172259
<rdar://problem/32264839>

Reviewed by Brian Burg.

  • inspector/remote/cocoa/RemoteInspectorCocoa.mm:

(Inspector::RemoteInspector::receivedSetupMessage):
(Inspector::RemoteInspector::receivedDataMessage):
(Inspector::RemoteInspector::receivedDidCloseMessage):
(Inspector::RemoteInspector::receivedIndicateMessage):
(Inspector::RemoteInspector::receivedConnectionDiedMessage):
(Inspector::RemoteInspector::receivedAutomaticInspectionConfigurationMessage):
(Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage):
(Inspector::RemoteInspector::receivedAutomationSessionRequestMessage):

  • inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:

(Inspector::RemoteInspectorXPCConnection::deserializeMessage):
(Inspector::RemoteInspectorXPCConnection::handleEvent):
(Inspector::RemoteInspectorXPCConnection::sendMessage):
Bail if we don't receive the expected types for message data.

Location:
trunk/Source/JavaScriptCore
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r217050 r217051  
     12017-05-18  Joseph Pecoraro  <pecoraro@apple.com>
     2
     3        Remote Inspector: Be stricter about checking message types
     4        https://bugs.webkit.org/show_bug.cgi?id=172259
     5        <rdar://problem/32264839>
     6
     7        Reviewed by Brian Burg.
     8
     9        * inspector/remote/cocoa/RemoteInspectorCocoa.mm:
     10        (Inspector::RemoteInspector::receivedSetupMessage):
     11        (Inspector::RemoteInspector::receivedDataMessage):
     12        (Inspector::RemoteInspector::receivedDidCloseMessage):
     13        (Inspector::RemoteInspector::receivedIndicateMessage):
     14        (Inspector::RemoteInspector::receivedConnectionDiedMessage):
     15        (Inspector::RemoteInspector::receivedAutomaticInspectionConfigurationMessage):
     16        (Inspector::RemoteInspector::receivedAutomaticInspectionRejectMessage):
     17        (Inspector::RemoteInspector::receivedAutomationSessionRequestMessage):
     18        * inspector/remote/cocoa/RemoteInspectorXPCConnection.mm:
     19        (Inspector::RemoteInspectorXPCConnection::deserializeMessage):
     20        (Inspector::RemoteInspectorXPCConnection::handleEvent):
     21        (Inspector::RemoteInspectorXPCConnection::sendMessage):
     22        Bail if we don't receive the expected types for message data.
     23
    1242017-05-18  Filip Pizlo  <fpizlo@apple.com>
    225

  • trunk/Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorCocoa.mm

    r213356 r217051  
    4444#import <wtf/text/WTFString.h>
    4545
     46#define BAIL_IF_UNEXPECTED_TYPE(expr, classExpr)          \
     47    do {                                                  \
     48        id value = (expr);                                \
     49        id classValue = (classExpr);                      \
     50        if (![value isKindOfClass:classValue])            \
     51            return;                                       \
     52    } while (0);
     53
    4654namespace Inspector {
    4755
    … …  
    450458void RemoteInspector::receivedSetupMessage(NSDictionary *userInfo)
    451459{
    452     unsigned targetIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
     460    NSNumber *targetIdentifierNumber = userInfo[WIRTargetIdentifierKey];
     461    BAIL_IF_UNEXPECTED_TYPE(targetIdentifierNumber, [NSNumber class]);
     462
     463    NSString *connectionIdentifier = userInfo[WIRConnectionIdentifierKey];
     464    BAIL_IF_UNEXPECTED_TYPE(connectionIdentifier, [NSString class]);
     465
     466    NSString *sender = userInfo[WIRSenderKey];
     467    BAIL_IF_UNEXPECTED_TYPE(sender, [NSString class]);
     468
     469    NSNumber *automaticallyPauseNumber = userInfo[WIRAutomaticallyPause];
     470    BAIL_IF_UNEXPECTED_TYPE(automaticallyPauseNumber, [NSNumber class]);
     471    BOOL automaticallyPause = automaticallyPauseNumber.boolValue;
     472
     473    unsigned targetIdentifier = targetIdentifierNumber.unsignedIntValue;
    453474    if (!targetIdentifier)
    454         return;
    455 
    456     NSString *connectionIdentifier = [userInfo objectForKey:WIRConnectionIdentifierKey];
    457     if (!connectionIdentifier)
    458         return;
    459 
    460     NSString *sender = [userInfo objectForKey:WIRSenderKey];
    461     if (!sender)
    462475        return;
    463476
    … …  
    475488    if (is<RemoteInspectionTarget>(target)) {
    476489        bool isAutomaticInspection = m_automaticInspectionCandidateTargetIdentifier == target->targetIdentifier();
    477         bool automaticallyPause = [[userInfo objectForKey:WIRAutomaticallyPause] boolValue];
    478490
    479491        if (!connectionToTarget->setup(isAutomaticInspection, automaticallyPause)) {
    … …  
    496508void RemoteInspector::receivedDataMessage(NSDictionary *userInfo)
    497509{
    498     unsigned targetIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
     510    NSNumber *targetIdentifierNumber = userInfo[WIRTargetIdentifierKey];
     511    BAIL_IF_UNEXPECTED_TYPE(targetIdentifierNumber, [NSNumber class]);
     512
     513    NSData *data = userInfo[WIRSocketDataKey];
     514    BAIL_IF_UNEXPECTED_TYPE(data, [NSData class]);
     515
     516    unsigned targetIdentifier = targetIdentifierNumber.unsignedIntValue;
    499517    if (!targetIdentifier)
    500518        return;
    … …  
    504522        return;
    505523
    506     NSData *data = [userInfo objectForKey:WIRSocketDataKey];
    507524    RetainPtr<NSString> message = adoptNS([[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding]);
    508525    connectionToTarget->sendMessageToTarget(message.get());
    … …  
    511528void RemoteInspector::receivedDidCloseMessage(NSDictionary *userInfo)
    512529{
    513     unsigned targetIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
     530    NSNumber *targetIdentifierNumber = userInfo[WIRTargetIdentifierKey];
     531    BAIL_IF_UNEXPECTED_TYPE(targetIdentifierNumber, [NSNumber class]);
     532
     533    NSString *connectionIdentifier = userInfo[WIRConnectionIdentifierKey];
     534    BAIL_IF_UNEXPECTED_TYPE(connectionIdentifier, [NSString class]);
     535
     536    unsigned targetIdentifier = targetIdentifierNumber.unsignedIntValue;
    514537    if (!targetIdentifier)
    515         return;
    516 
    517     NSString *connectionIdentifier = [userInfo objectForKey:WIRConnectionIdentifierKey];
    518     if (!connectionIdentifier)
    519538        return;
    520539
    … …  
    539558void RemoteInspector::receivedIndicateMessage(NSDictionary *userInfo)
    540559{
    541     unsigned identifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntegerValue];
    542     if (!identifier)
    543         return;
    544 
    545     BOOL indicateEnabled = [[userInfo objectForKey:WIRIndicateEnabledKey] boolValue];
     560    NSNumber *targetIdentifierNumber = userInfo[WIRTargetIdentifierKey];
     561    BAIL_IF_UNEXPECTED_TYPE(targetIdentifierNumber, [NSNumber class]);
     562
     563    NSNumber *indicateEnabledNumber = userInfo[WIRIndicateEnabledKey];
     564    BAIL_IF_UNEXPECTED_TYPE(indicateEnabledNumber, [NSNumber class]);
     565    BOOL indicateEnabled = indicateEnabledNumber.boolValue;
     566
     567    unsigned targetIdentifier = targetIdentifierNumber.unsignedIntValue;
     568    if (!targetIdentifier)
     569        return;
    546570
    547571    callOnWebThreadOrDispatchAsyncOnMainThread(^{
    … …  
    550574            std::lock_guard<Lock> lock(m_mutex);
    551575
    552             auto findResult = m_targetMap.find(identifier);
     576            auto findResult = m_targetMap.find(targetIdentifier);
    553577            if (findResult == m_targetMap.end())
    554578                return;
    … …  
    589613void RemoteInspector::receivedConnectionDiedMessage(NSDictionary *userInfo)
    590614{
    591     NSString *connectionIdentifier = [userInfo objectForKey:WIRConnectionIdentifierKey];
    592     if (!connectionIdentifier)
    593         return;
     615    NSString *connectionIdentifier = userInfo[WIRConnectionIdentifierKey];
     616    BAIL_IF_UNEXPECTED_TYPE(connectionIdentifier, [NSString class]);
    594617
    595618    auto it = m_targetConnectionMap.begin();
    … …  
    612635void RemoteInspector::receivedAutomaticInspectionConfigurationMessage(NSDictionary *userInfo)
    613636{
    614     m_automaticInspectionEnabled = [[userInfo objectForKey:WIRAutomaticInspectionEnabledKey] boolValue];
     637    NSNumber *automaticInspectionEnabledNumber = userInfo[WIRAutomaticInspectionEnabledKey];
     638    BAIL_IF_UNEXPECTED_TYPE(automaticInspectionEnabledNumber, [NSNumber class]);
     639
     640    m_automaticInspectionEnabled = automaticInspectionEnabledNumber.boolValue;
    615641
    616642    if (!m_automaticInspectionEnabled && m_automaticInspectionPaused)
    … …  
    620646void RemoteInspector::receivedAutomaticInspectionRejectMessage(NSDictionary *userInfo)
    621647{
    622     unsigned rejectionIdentifier = [[userInfo objectForKey:WIRTargetIdentifierKey] unsignedIntValue];
    623 
    624     ASSERT(rejectionIdentifier == m_automaticInspectionCandidateTargetIdentifier);
    625     if (rejectionIdentifier == m_automaticInspectionCandidateTargetIdentifier)
     648    NSNumber *targetIdentifierNumber = userInfo[WIRTargetIdentifierKey];
     649    BAIL_IF_UNEXPECTED_TYPE(targetIdentifierNumber, [NSNumber class]);
     650
     651    unsigned targetIdentifier = targetIdentifierNumber.unsignedIntValue;
     652    if (!targetIdentifier)
     653        return;
     654
     655    ASSERT(targetIdentifier == m_automaticInspectionCandidateTargetIdentifier);
     656    if (targetIdentifier == m_automaticInspectionCandidateTargetIdentifier)
    626657        m_automaticInspectionPaused = false;
    627658}
    … …  
    629660void RemoteInspector::receivedAutomationSessionRequestMessage(NSDictionary *userInfo)
    630661{
     662    NSString *suggestedSessionIdentifier = userInfo[WIRSessionIdentifierKey];
     663    BAIL_IF_UNEXPECTED_TYPE(suggestedSessionIdentifier, [NSString class]);
     664
    631665    if (!m_client)
    632666        return;
    … …  
    635669        return;
    636670
    637     NSString *suggestedSessionIdentifier = [userInfo objectForKey:WIRSessionIdentifierKey];
    638     if (!suggestedSessionIdentifier)
    639         return;
    640 
    641671    m_client->requestAutomationSession(suggestedSessionIdentifier);
    642672}

  • trunk/Source/JavaScriptCore/inspector/remote/cocoa/RemoteInspectorXPCConnection.mm

    r212169 r217051  
    145145    RetainPtr<CFDictionaryRef> dictionary = adoptCF((CFDictionaryRef)_CFXPCCreateCFObjectFromXPCMessage(xpcDictionary));
    146146    ASSERT_WITH_MESSAGE(dictionary, "Unable to deserialize xpc message");
     147    ASSERT(CFGetTypeID(dictionary.get()) == CFDictionaryGetTypeID());
    147148    return (NSDictionary *)dictionary.autorelease();
    148149}
    … …  
    183184#endif
    184185
    185     NSDictionary *dataDictionary = deserializeMessage(object);
    186     if (!dataDictionary)
    187         return;
    188 
    189     NSString *message = [dataDictionary objectForKey:RemoteInspectorXPCConnectionMessageNameKey];
    190     NSDictionary *userInfo = [dataDictionary objectForKey:RemoteInspectorXPCConnectionUserInfoKey];
     186    NSDictionary *dictionary = deserializeMessage(object);
     187    if (![dictionary isKindOfClass:[NSDictionary class]])
     188        return;
     189
     190    NSString *message = dictionary[RemoteInspectorXPCConnectionMessageNameKey];
     191    if (![message isKindOfClass:[NSString class]])
     192        return;
     193
     194    NSDictionary *userInfo = dictionary[RemoteInspectorXPCConnectionUserInfoKey];
     195    if (userInfo && ![userInfo isKindOfClass:[NSDictionary class]])
     196        return;
     197
    191198    std::lock_guard<Lock> lock(m_mutex);
    192199    if (m_client)
    … …  
    200207        return;
    201208
    202     NSMutableDictionary *dictionary = [NSMutableDictionary dictionaryWithObject:messageName forKey:RemoteInspectorXPCConnectionMessageNameKey];
     209    RetainPtr<NSMutableDictionary> dictionary = adoptNS([[NSMutableDictionary alloc] init]);
     210    [dictionary setObject:messageName forKey:RemoteInspectorXPCConnectionMessageNameKey];
    203211    if (userInfo)
    204212        [dictionary setObject:userInfo forKey:RemoteInspectorXPCConnectionUserInfoKey];
    205213
    206     xpc_object_t xpcDictionary = _CFXPCCreateXPCMessageWithCFObject((CFDictionaryRef)dictionary);
     214    xpc_object_t xpcDictionary = _CFXPCCreateXPCMessageWithCFObject((CFDictionaryRef)dictionary.get());
    207215    ASSERT_WITH_MESSAGE(xpcDictionary && xpc_get_type(xpcDictionary) == XPC_TYPE_DICTIONARY, "Unable to serialize xpc message");
    208216    if (!xpcDictionary)
Note: See TracChangeset for help on using the changeset viewer.