Changeset 258744 in webkit

Timestamp:

Mar 19, 2020 4:48:18 PM (4 years ago)

Author:

commit-queue@webkit.org

Message:

ScriptDisallowedScope should disable isEventAllowedInMainThread and isEventDispatchAllowedInSubtree asserts in WebKit1
​https://bugs.webkit.org/show_bug.cgi?id=209165

Patch by Sunny He <​sunny_he@apple.com> on 2020-03-19
Reviewed by Ryosuke Niwa.

Under very intricate sequences of event dispatch in WebKit1, it is
possible for security asserts to be triggered even if there is no
underlying security issue soley due to the design patterns of
WebKit1.

No new tests since the conditions for reproduction are very delicate
and difficult to reliably capture in a test case.

• dom/ScriptDisallowedScope.h:

(WebCore::ScriptDisallowedScope::isEventAllowedInMainThread):
(WebCore::ScriptDisallowedScope::InMainThread::isEventDispatchAllowedInSubtree):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/ScriptDisallowedScope.h (modified) (3 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-03-19  Sunny He  <sunny_he@apple.com>
+
+        ScriptDisallowedScope should disable isEventAllowedInMainThread and isEventDispatchAllowedInSubtree asserts in WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=209165
+
+        Reviewed by Ryosuke Niwa.
+
+        Under very intricate sequences of event dispatch in WebKit1, it is
+        possible for security asserts to be triggered even if there is no
+        underlying security issue soley due to the design patterns of
+        WebKit1.
+
+        No new tests since the conditions for reproduction are very delicate
+        and difficult to reliably capture in a test case.
+
+        * dom/ScriptDisallowedScope.h:
+        (WebCore::ScriptDisallowedScope::isEventAllowedInMainThread):
+        (WebCore::ScriptDisallowedScope::InMainThread::isEventDispatchAllowedInSubtree):
+
 2020-03-19  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebCore/dom/ScriptDisallowedScope.h

@@ -25 +25 @@
 
 #include "ContainerNode.h"
+#include "RuntimeApplicationChecks.h"
 #include <wtf/MainThread.h>
 
@@ -63 +64 @@
     static bool isEventAllowedInMainThread()
     {
-        return !isMainThread() || !s_count;
+        return !isInWebProcess() || !isMainThread() || !s_count;
     }
 
@@ -86 +87 @@
         {
 #if ASSERT_ENABLED || ENABLE(SECURITY_ASSERTIONS)
-            return isScriptAllowed() || EventAllowedScope::isAllowedNode(node);
+            return !isInWebProcess() || isScriptAllowed() || EventAllowedScope::isAllowedNode(node);
 #else
             UNUSED_PARAM(node);