131767 2014-04-16 15:12:54 -0700 Local files should not be allowed to read pasteboard data during drag 2014-04-27 10:23:23 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 131770 1 ap ap commit-queue darin oldest_to_newest 1001356 0 ap 2014-04-16 15:12:54 -0700 As implemented in <http://trac.webkit.org/changeset/6840> for Dashboard, local files are allowed to read pasteboard data during drag, while normal documents can only do that during drop even handling. Even local documents should not be allowed to sniff content simply dragged over them, they are not that trusted. I'm going to make this a Dashboard quirk instead. 1004164 1 230191 ap 2014-04-25 12:43:14 -0700 Created attachment 230191 proposed patch 1004370 2 230191 commit-queue 2014-04-26 19:48:47 -0700 Comment on attachment 230191 proposed patch Clearing flags on attachment: 230191 Committed r167850: <http://trac.webkit.org/changeset/167850> 1004371 3 commit-queue 2014-04-26 19:48:50 -0700 All reviewed patches have been landed. Closing bug. 1004415 4 230191 darin 2014-04-27 10:23:23 -0700 Comment on attachment 230191 proposed patch View in context: https://bugs.webkit.org/attachment.cgi?id=230191&action=review > Source/WebCore/page/DragController.cpp:186 > + DataTransferAccessPolicy::Readable : DataTransferAccessPolicy::TypesReadable; Missing indentation here. I normally find that this: <long line> ? x : y; Is more readable than: <long line> ? x : y; But the code above is: <long line> ? x : y; 230191 2014-04-25 12:43:14 -0700 2014-04-27 10:23:23 -0700 proposed patch DashboardFiles.txt text/plain 7194 ap SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE2NzgxMykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBACisyMDE0LTA0LTI1ICBBbGV4ZXkg UHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgorCisgICAgICAgIExvY2FsIGZpbGVzIHNob3Vs ZCBub3QgYmUgYWxsb3dlZCB0byByZWFkIHBhc3RlYm9hcmQgZGF0YSBkdXJpbmcgZHJhZworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTMxNzY3CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdDogZmFzdC9m aWxlcy9sb2NhbC1maWxlLWRyYWctc2VjdXJpdHkuaHRtbAorCisgICAgICAgICogcGFnZS9EcmFn Q29udHJvbGxlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpEcmFnQ29udHJvbGxlcjo6ZHJhZ0V4 aXRlZCk6CisgICAgICAgIChXZWJDb3JlOjpEcmFnQ29udHJvbGxlcjo6dHJ5REhUTUxEcmFnKToK KyAgICAgICAgTWFrZSBhbiBvbGQgRGFzaGJvYXJkIHF1aXJrIHJlYWxseSBEYXNoYm9hcmQgb25s eS4KKwogMjAxNC0wNC0yNSAgQW5kcmVhcyBLbGluZyAgPGFrbGluZ0BhcHBsZS5jb20+CiAKICAg ICAgICAgTWFyayBzb21lIHRoaW5ncyB3aXRoIFdURl9NQUtFX0ZBU1RfQUxMT0NBVEVELgpJbmRl eDogU291cmNlL1dlYkNvcmUvcGFnZS9EcmFnQ29udHJvbGxlci5jcHAKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL1dlYkNvcmUvcGFnZS9EcmFnQ29udHJvbGxlci5jcHAJKHJldmlzaW9uIDE2NzgwOCkK KysrIFNvdXJjZS9XZWJDb3JlL3BhZ2UvRHJhZ0NvbnRyb2xsZXIuY3BwCSh3b3JraW5nIGNvcHkp CkBAIC0xODEsNyArMTgxLDEyIEBAIERyYWdPcGVyYXRpb24gRHJhZ0NvbnRyb2xsZXI6OmRyYWdF bnRlcmUKIHZvaWQgRHJhZ0NvbnRyb2xsZXI6OmRyYWdFeGl0ZWQoRHJhZ0RhdGEmIGRyYWdEYXRh KQogewogICAgIGlmIChSZWZQdHI8RnJhbWVWaWV3PiB2ID0gbV9wYWdlLm1haW5GcmFtZSgpLnZp ZXcoKSkgewotICAgICAgICBEYXRhVHJhbnNmZXJBY2Nlc3NQb2xpY3kgcG9saWN5ID0gKCFtX2Rv Y3VtZW50VW5kZXJNb3VzZSB8fCBtX2RvY3VtZW50VW5kZXJNb3VzZS0+c2VjdXJpdHlPcmlnaW4o KS0+aXNMb2NhbCgpKSA/IERhdGFUcmFuc2ZlckFjY2Vzc1BvbGljeTo6UmVhZGFibGUgOiBEYXRh VHJhbnNmZXJBY2Nlc3NQb2xpY3k6OlR5cGVzUmVhZGFibGU7CisjaWYgRU5BQkxFKERBU0hCT0FS RF9TVVBQT1JUKQorICAgICAgICBEYXRhVHJhbnNmZXJBY2Nlc3NQb2xpY3kgcG9saWN5ID0gKG1f cGFnZS5tYWluRnJhbWUoKS5zZXR0aW5ncygpLnVzZXNEYXNoYm9hcmRCYWNrd2FyZENvbXBhdGli aWxpdHlNb2RlKCkgJiYgKCFtX2RvY3VtZW50VW5kZXJNb3VzZSB8fCBtX2RvY3VtZW50VW5kZXJN b3VzZS0+c2VjdXJpdHlPcmlnaW4oKS0+aXNMb2NhbCgpKSkgPworICAgICAgICBEYXRhVHJhbnNm ZXJBY2Nlc3NQb2xpY3k6OlJlYWRhYmxlIDogRGF0YVRyYW5zZmVyQWNjZXNzUG9saWN5OjpUeXBl c1JlYWRhYmxlOworI2Vsc2UKKyAgICAgICAgRGF0YVRyYW5zZmVyQWNjZXNzUG9saWN5IHBvbGlj eSA9IERhdGFUcmFuc2ZlckFjY2Vzc1BvbGljeTo6VHlwZXNSZWFkYWJsZTsKKyNlbmRpZgogICAg ICAgICBSZWZQdHI8RGF0YVRyYW5zZmVyPiBkYXRhVHJhbnNmZXIgPSBEYXRhVHJhbnNmZXI6OmNy ZWF0ZUZvckRyYWdBbmREcm9wKHBvbGljeSwgZHJhZ0RhdGEpOwogICAgICAgICBkYXRhVHJhbnNm ZXItPnNldFNvdXJjZU9wZXJhdGlvbihkcmFnRGF0YS5kcmFnZ2luZ1NvdXJjZU9wZXJhdGlvbk1h c2soKSk7CiAgICAgICAgIG1fcGFnZS5tYWluRnJhbWUoKS5ldmVudEhhbmRsZXIoKS5jYW5jZWxE cmFnQW5kRHJvcChjcmVhdGVNb3VzZUV2ZW50KGRyYWdEYXRhKSwgZGF0YVRyYW5zZmVyLmdldCgp KTsKQEAgLTU4Nyw3ICs1OTIsMTIgQEAgYm9vbCBEcmFnQ29udHJvbGxlcjo6dHJ5REhUTUxEcmFn KERyYWdEYQogICAgIGlmICghdmlld1Byb3RlY3RvcikKICAgICAgICAgcmV0dXJuIGZhbHNlOwog Ci0gICAgRGF0YVRyYW5zZmVyQWNjZXNzUG9saWN5IHBvbGljeSA9IG1fZG9jdW1lbnRVbmRlck1v dXNlLT5zZWN1cml0eU9yaWdpbigpLT5pc0xvY2FsKCkgPyBEYXRhVHJhbnNmZXJBY2Nlc3NQb2xp Y3k6OlJlYWRhYmxlIDogRGF0YVRyYW5zZmVyQWNjZXNzUG9saWN5OjpUeXBlc1JlYWRhYmxlOwor I2lmIEVOQUJMRShEQVNIQk9BUkRfU1VQUE9SVCkKKyAgICBEYXRhVHJhbnNmZXJBY2Nlc3NQb2xp Y3kgcG9saWN5ID0gKG1haW5GcmFtZS0+c2V0dGluZ3MoKS51c2VzRGFzaGJvYXJkQmFja3dhcmRD b21wYXRpYmlsaXR5TW9kZSgpICYmIG1fZG9jdW1lbnRVbmRlck1vdXNlLT5zZWN1cml0eU9yaWdp bigpLT5pc0xvY2FsKCkpID8KKyAgICAgICAgRGF0YVRyYW5zZmVyQWNjZXNzUG9saWN5OjpSZWFk YWJsZSA6IERhdGFUcmFuc2ZlckFjY2Vzc1BvbGljeTo6VHlwZXNSZWFkYWJsZTsKKyNlbHNlCisg ICAgRGF0YVRyYW5zZmVyQWNjZXNzUG9saWN5IHBvbGljeSA9IERhdGFUcmFuc2ZlckFjY2Vzc1Bv bGljeTo6VHlwZXNSZWFkYWJsZTsKKyNlbmRpZgogICAgIFJlZlB0cjxEYXRhVHJhbnNmZXI+IGRh dGFUcmFuc2ZlciA9IERhdGFUcmFuc2Zlcjo6Y3JlYXRlRm9yRHJhZ0FuZERyb3AocG9saWN5LCBk cmFnRGF0YSk7CiAgICAgRHJhZ09wZXJhdGlvbiBzcmNPcE1hc2sgPSBkcmFnRGF0YS5kcmFnZ2lu Z1NvdXJjZU9wZXJhdGlvbk1hc2soKTsKICAgICBkYXRhVHJhbnNmZXItPnNldFNvdXJjZU9wZXJh dGlvbihzcmNPcE1hc2spOwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTY3ODEzKQorKysgTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTQtMDQtMjUg IEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBsZS5jb20+CisKKyAgICAgICAgTG9jYWwgZmls ZXMgc2hvdWxkIG5vdCBiZSBhbGxvd2VkIHRvIHJlYWQgcGFzdGVib2FyZCBkYXRhIGR1cmluZyBk cmFnCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzE3 NjcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGZh c3QvZmlsZXMvbG9jYWwtZmlsZS1kcmFnLXNlY3VyaXR5LWV4cGVjdGVkLnR4dDogQWRkZWQuCisg ICAgICAgICogZmFzdC9maWxlcy9sb2NhbC1maWxlLWRyYWctc2VjdXJpdHkuaHRtbDogQWRkZWQu CisgICAgICAgICogcGxhdGZvcm0vd2syL1Rlc3RFeHBlY3RhdGlvbnM6CisKIDIwMTQtMDQtMjUg IFRpbSBIb3J0b24gIDx0aW1vdGh5X2hvcnRvbkBhcHBsZS5jb20+CiAKICAgICAgICAgUkVHUkVT U0lPTihyMTY3Nzk5KTogQVNTRVJUSU9OIGluIHBhcnNlR3JpZFRlbXBsYXRlU2hvcnRoYW5kIGlu IGZhc3QvY3NzLWdyaWQtbGF5b3V0L2dyaWQtdGVtcGxhdGUtc2hvcnRoYW5kLWdldC1zZXQuaHRt bApJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9sb2NhbC1maWxlLWRyYWctc2VjdXJpdHkt ZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvZmlsZXMvbG9jYWwt ZmlsZS1kcmFnLXNlY3VyaXR5LWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRl c3RzL2Zhc3QvZmlsZXMvbG9jYWwtZmlsZS1kcmFnLXNlY3VyaXR5LWV4cGVjdGVkLnR4dAkod29y a2luZyBjb3B5KQpAQCAtMCwwICsxLDkgQEAKK1Rlc3QgdGhhdCBmaWxlcyBhcmUgbm90IGFjY2Vz c2libGUgd2hpbGUgZHJhZ2dpbmcuIFRvIHRlc3QgbWFudWFsbHksIGRyb3AgYW4gSFRNTCBmaWxl IG9uIHRoZSBib3ggYmVsb3cuCisKK09uIHN1Y2Nlc3MsIHlvdSB3aWxsIHNlZSBhIHNlcmllcyBv ZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJURVNUIENPTVBMRVRFIi4KKworUEFTUyBl dmVudC5kYXRhVHJhbnNmZXIuZmlsZXMubGVuZ3RoIGlzIDAKK1BBU1Mgc3VjY2Vzc2Z1bGx5UGFy c2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlv dXRUZXN0cy9mYXN0L2ZpbGVzL2xvY2FsLWZpbGUtZHJhZy1zZWN1cml0eS1leHBlY3RlZC50eHQK X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXwpBZGRlZDogc3ZuOm1pbWUtdHlwZQojIyAtMCwwICsxICMjCit0ZXh0L3BsYWlu ClwgTm8gbmV3bGluZSBhdCBlbmQgb2YgcHJvcGVydHkKQWRkZWQ6IHN2bjplb2wtc3R5bGUKIyMg LTAsMCArMSAjIworbmF0aXZlClwgTm8gbmV3bGluZSBhdCBlbmQgb2YgcHJvcGVydHkKSW5kZXg6 IExheW91dFRlc3RzL2Zhc3QvZmlsZXMvbG9jYWwtZmlsZS1kcmFnLXNlY3VyaXR5Lmh0bWwKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9maWxlcy9sb2NhbC1maWxlLWRyYWctc2VjdXJp dHkuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvZmlsZXMvbG9jYWwtZmls ZS1kcmFnLXNlY3VyaXR5Lmh0bWwJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSw1MyBAQAorPCFE T0NUWVBFIGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQgc3JjPSIuLi8uLi9yZXNvdXJjZXMvanMtdGVz dC1wcmUuanMiPjwvc2NyaXB0PgorPHN0eWxlPgorI2Ryb3BUYXJnZXQgeyB0ZXh0LWFsaWduOiBj ZW50ZXI7IGRpc3BsYXk6IHRhYmxlLWNlbGw7IHZlcnRpY2FsLWFsaWduOiBtaWRkbGUgfQorI2Ry b3BUYXJnZXQge3dpZHRoOiAyNTZweDsgaGVpZ2h0OiAyNTZweDsgYm9yZGVyOiAxcHggZGFzaGVk fQorPC9zdHlsZT4KKzwvaGVhZD4KKzxib2R5PgorPGRpdiBpZD1kZXNjcmlwdGlvbj48L2Rpdj4K KzxkaXYgaWQ9ZHJvcFRhcmdldCB3ZWJraXRkcm9wem9uZT0ibW92ZSBmaWxlOnRleHQvaHRtbCI+ PC9kaXY+Cis8ZGl2IGlkPWNvbnNvbGU+PC9kaXY+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0 UnVubmVyKQorICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworCitkZXNjcmlwdGlvbigiVGVz dCB0aGF0IGZpbGVzIGFyZSBub3QgYWNjZXNzaWJsZSB3aGlsZSBkcmFnZ2luZy4gVG8gdGVzdCBt YW51YWxseSwgZHJvcCBhbiBIVE1MIGZpbGUgb24gdGhlIGJveCBiZWxvdy4iKTsKK2pzVGVzdElz QXN5bmMgPSB0cnVlOworCit3aW5kb3cub25sb2FkID0gZnVuY3Rpb24oKQoreworICAgIHZhciBk cm9wVGFyZ2V0ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImRyb3BUYXJnZXQiKTsKKworICAg IGRyb3BUYXJnZXQuYWRkRXZlbnRMaXN0ZW5lcigiZHJhZ292ZXIiLCBvbmRyYWdvdmVyLCB0cnVl KTsKKyAgICBkcm9wVGFyZ2V0LmFkZEV2ZW50TGlzdGVuZXIoImRyb3AiLCBvbmRyb3AsIHRydWUp OworICAgICAgICAKKyAgICAgaWYgKCF3aW5kb3cuZXZlbnRTZW5kZXIpCisgICAgICAgIHJldHVy bjsKKworICAgIHZhciBlbmRYID0gZHJvcFRhcmdldC5vZmZzZXRMZWZ0ICsgZHJvcFRhcmdldC5v ZmZzZXRXaWR0aCAvIDI7CisgICAgdmFyIGVuZFkgPSBkcm9wVGFyZ2V0Lm9mZnNldFRvcCArIGRy b3BUYXJnZXQub2Zmc2V0SGVpZ2h0IC8gMgorICAgIAorICAgIGV2ZW50U2VuZGVyLmJlZ2luRHJh Z1dpdGhGaWxlcyhbInJlc291cmNlcy9maWxlLXJlYWRlci1yZWFsLmh0bWwiXSk7CisgICAgZXZl bnRTZW5kZXIubW91c2VNb3ZlVG8oZW5kWCwgZW5kWSk7CisgICAgZXZlbnRTZW5kZXIubW91c2VV cCgpOworCisgICAgZG9jdW1lbnQuYm9keS5yZW1vdmVDaGlsZChkcm9wVGFyZ2V0KTsKKyAgICBm aW5pc2hKU1Rlc3QoKTsKK30KKworZnVuY3Rpb24gb25kcmFnb3ZlcihldmVudCkKK3sKKyAgICBz aG91bGRCZSgiZXZlbnQuZGF0YVRyYW5zZmVyLmZpbGVzLmxlbmd0aCIsICIwIik7Cit9CisKK2Z1 bmN0aW9uIG9uZHJvcChldmVudCkKK3sKKyAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOworfQor PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0iLi4vLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+ PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRU ZXN0cy9mYXN0L2ZpbGVzL2xvY2FsLWZpbGUtZHJhZy1zZWN1cml0eS5odG1sCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K QWRkZWQ6IHN2bjptaW1lLXR5cGUKIyMgLTAsMCArMSAjIwordGV4dC9odG1sClwgTm8gbmV3bGlu ZSBhdCBlbmQgb2YgcHJvcGVydHkKSW5kZXg6IExheW91dFRlc3RzL3BsYXRmb3JtL3drMi9UZXN0 RXhwZWN0YXRpb25zCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL3BsYXRmb3JtL3drMi9UZXN0 RXhwZWN0YXRpb25zCShyZXZpc2lvbiAxNjc4MDgpCisrKyBMYXlvdXRUZXN0cy9wbGF0Zm9ybS93 azIvVGVzdEV4cGVjdGF0aW9ucwkod29ya2luZyBjb3B5KQpAQCAtNjYwLDYgKzY2MCw3IEBAIGZh c3QvZmlsZXMvZmlsZS1saXN0LXRlc3QuaHRtbAogZmFzdC9maWxlcy9maWxlLXJlYWRlci1hYm9y dC5odG1sCiBmYXN0L2ZpbGVzL2ZpbGUtcmVhZGVyLWRpcmVjdG9yeS1jcmFzaC5odG1sCiBmYXN0 L2ZpbGVzL2ZpbGUtcmVhZGVyLWV2ZW50LWxpc3RlbmVyLmh0bWwKK2Zhc3QvZmlsZXMvbG9jYWwt ZmlsZS1kcmFnLXNlY3VyaXR5Lmh0bWwKIGZhc3QvZmlsZXMvbnVsbC1vcmlnaW4tc3RyaW5nLmh0 bWwKIGZhc3QvZmlsZXMvcmVhZC1ibG9iLWFzeW5jLmh0bWwKIGZhc3QvZmlsZXMvcmVhZC1maWxl LWFzeW5jLmh0bWwK