16387 2007-12-10 14:15:27 -0800 Variable names can be enumerated across domains 2007-12-30 23:02:28 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Mac OS X 10.4 RESOLVED FIXED http://mapseekret.com/staticmedia/document_a.html HasReduction, InRadar P1 Normal --- 1 hmason webkit-unassigned ggaren ian sam oldest_to_newest 63862 0 hmason 2007-12-10 14:15:27 -0800 WebKit currently allows for enumeration of all the property names in window object via a JavaScript "for .. in " loop, even when the window object is from a foreign domain. This could cause a security problem if a JavaScript author made the mistake of storing a password in a variable name or something. I've posted a demonstration of this problem to this bug's URL. Document B sets a global variable named "superSecretThing", document A embeds document B in an iframe, and is able to see the secret variable name from a foreign domain. 63882 1 mrowe 2007-12-10 20:20:23 -0800 <rdar://problem/5640454> 65790 2 ian 2007-12-30 21:19:26 -0800 This can, e.g., leak whether a user is logged in on another domain, if that domain initialises variables after the user logs in. 65806 3 18204 sam 2007-12-30 22:54:29 -0800 Created attachment 18204 patch 65808 4 sam 2007-12-30 23:02:28 -0800 Landed in r29044. 18204 2007-12-30 22:54:29 -0800 2007-12-30 22:58:11 -0800 patch xssEnumeration.diff text/plain 6334 sam SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAyOTA0MikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTcgQEAKKzIwMDctMTItMzAgIFNhbSBXZWluaWcgIDxzYW1Ad2Via2l0Lm9yZz4K KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGaXggZm9y IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2Mzg3CisgICAgICAgIFZh cmlhYmxlIG5hbWVzIGNhbiBiZSBlbnVtZXJhdGVkIGFjcm9zcyBkb21haW5zCisgICAgICAgIDxy ZGFyOi8vcHJvYmxlbS81NjQwNDU0PgorCisgICAgICAgIFRlc3Q6IGh0dHAvdGVzdHMvc2VjdXJp dHkvY3Jvc3MtZnJhbWUtYWNjZXNzLWVudW1lcmF0aW9uLmh0bWwKKworICAgICAgICAqIGJpbmRp bmdzL2pzL2tqc193aW5kb3cuY3BwOgorICAgICAgICAoS0pTOjpXaW5kb3c6OmdldFByb3BlcnR5 TmFtZXMpOiBPdmVycmlkZSBtZXRob2QgdG8gdGVzdCBzYW1lLW9yaWdpbiBwb2xpY3kuCisgICAg ICAgICogYmluZGluZ3MvanMva2pzX3dpbmRvdy5oOgorCiAyMDA3LTEyLTMwICBTYW0gV2Vpbmln ICA8c2FtQHdlYmtpdC5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgT2xpdmVyIEh1bnQuCklu ZGV4OiBXZWJDb3JlL2JpbmRpbmdzL2pzL2tqc193aW5kb3cuY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdl YkNvcmUvYmluZGluZ3MvanMva2pzX3dpbmRvdy5jcHAJKHJldmlzaW9uIDI5MDMzKQorKysgV2Vi Q29yZS9iaW5kaW5ncy9qcy9ranNfd2luZG93LmNwcAkod29ya2luZyBjb3B5KQpAQCAtODY1LDYg Kzg2NSwxMyBAQCBib29sIFdpbmRvdzo6c2hvdWxkSW50ZXJydXB0U2NyaXB0KCkgY29uCiAgICAg cmV0dXJuIHBhZ2UtPmNocm9tZSgpLT5zaG91bGRJbnRlcnJ1cHRKYXZhU2NyaXB0KCk7CiB9CiAK K3ZvaWQgV2luZG93OjpnZXRQcm9wZXJ0eU5hbWVzKEV4ZWNTdGF0ZSogZXhlYywgUHJvcGVydHlO YW1lQXJyYXkmIHByb3BlcnR5TmFtZXMpCit7CisgICAgaWYgKCFhbGxvd3NBY2Nlc3NGcm9tKGV4 ZWMpKQorICAgICAgICByZXR1cm47CisgICAgQmFzZTo6Z2V0UHJvcGVydHlOYW1lcyhleGVjLCBw cm9wZXJ0eU5hbWVzKTsKK30KKwogdm9pZCBXaW5kb3c6OnNldExpc3RlbmVyKEV4ZWNTdGF0ZSog ZXhlYywgY29uc3QgQXRvbWljU3RyaW5nJiBldmVudFR5cGUsIEpTVmFsdWUqIGZ1bmMpCiB7CiAg ICAgQVNTRVJUKGltcGwoKS0+ZnJhbWUoKSk7CkluZGV4OiBXZWJDb3JlL2JpbmRpbmdzL2pzL2tq c193aW5kb3cuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2JpbmRpbmdzL2pzL2tqc193aW5kb3cu aAkocmV2aXNpb24gMjkwMzMpCisrKyBXZWJDb3JlL2JpbmRpbmdzL2pzL2tqc193aW5kb3cuaAko d29ya2luZyBjb3B5KQpAQCAtMTI4LDYgKzEyOCw4IEBAIG5hbWVzcGFjZSBLSlMgewogICAgIHZp cnR1YWwgYm9vbCBhbGxvd3NBY2Nlc3NGcm9tKGNvbnN0IEpTR2xvYmFsT2JqZWN0KikgY29uc3Q7 CiAgICAgYm9vbCBhbGxvd3NBY2Nlc3NGcm9tKEV4ZWNTdGF0ZSogZXhlYykgY29uc3QgeyByZXR1 cm4gYWxsb3dzQWNjZXNzRnJvbShleGVjLT5keW5hbWljR2xvYmFsT2JqZWN0KCkpOyB9CiAKKyAg ICB2aXJ0dWFsIHZvaWQgZ2V0UHJvcGVydHlOYW1lcyhFeGVjU3RhdGUqLCBQcm9wZXJ0eU5hbWVB cnJheSYpOworCiAgICAgZW51bSB7CiAgICAgICAgIC8vIEF0dHJpYnV0ZXMKICAgICAgICAgQ3J5 cHRvLCBFdmVudF8sIExvY2F0aW9uXywgTmF2aWdhdG9yXywKSW5kZXg6IExheW91dFRlc3RzL0No YW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDI5 MDQyKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEs MTMgQEAKKzIwMDctMTItMzAgIFNhbSBXZWluaWcgIDxzYW1Ad2Via2l0Lm9yZz4KKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0IGZvciBodHRwOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjM4NworCisgICAgICAgICogaHR0cC90 ZXN0cy9zZWN1cml0eS9jcm9zcy1mcmFtZS1hY2Nlc3MtZW51bWVyYXRpb24tZXhwZWN0ZWQudHh0 OiBBZGRlZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5L2Nyb3NzLWZyYW1lLWFjY2Vz cy1lbnVtZXJhdGlvbi5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBodHRwL3Rlc3RzL3NlY3VyaXR5 L3Jlc291cmNlcy9jcm9zcy1mcmFtZS1pZnJhbWUtZm9yLWVudW1lcmF0aW9uLXRlc3QuaHRtbDog QWRkZWQuCisKIDIwMDctMTItMzAgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29tPgogCiAg ICAgICAgIC0gYWRkZWQgbWlzc2luZyByZXN1bHRzIGZpbGUKSW5kZXg6IExheW91dFRlc3RzL2h0 dHAvdGVzdHMvc2VjdXJpdHkvY3Jvc3MtZnJhbWUtYWNjZXNzLWVudW1lcmF0aW9uLWV4cGVjdGVk LnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2Nyb3Nz LWZyYW1lLWFjY2Vzcy1lbnVtZXJhdGlvbi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBM YXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2Nyb3NzLWZyYW1lLWFjY2Vzcy1lbnVtZXJh dGlvbi1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNyBAQAorQ09OU09MRSBN RVNTQUdFOiBsaW5lIDE6IFVuc2FmZSBKYXZhU2NyaXB0IGF0dGVtcHQgdG8gYWNjZXNzIGZyYW1l IHdpdGggVVJMIGh0dHA6Ly9sb2NhbGhvc3Q6ODAwMC9zZWN1cml0eS9yZXNvdXJjZXMvY3Jvc3Mt ZnJhbWUtaWZyYW1lLWZvci1lbnVtZXJhdGlvbi10ZXN0IGZyb20gZnJhbWUgd2l0aCBVUkwgaHR0 cDovLzEyNy4wLjAuMTo4MDAwL3NlY3VyaXR5L2Nyb3NzLWZyYW1lLWFjY2Vzcy1lbnVtZXJhdGlv bi5odG1sLiBEb21haW5zLCBwcm90b2NvbHMgYW5kIHBvcnRzIG11c3QgbWF0Y2guCisKK1RoaXMg dGVzdHMgdGhhdCB2YXJpYWJsZSBuYW1lcyBjYW4ndCBiZSBlbnVtZXJhdGVkIGNyb3NzIGRvbWFp biAoc2VlIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2Mzg3KQorCisK K1BBU1M6IENyb3NzIGZyYW1lIGFjY2VzcyBieSBlbnVtZXJhdGluZyB0aGUgd2luZG93IG9iamVj dCB3YXMgZGVuaWVkLgorCkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2Ny b3NzLWZyYW1lLWFjY2Vzcy1lbnVtZXJhdGlvbi5odG1sCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl c3RzL2h0dHAvdGVzdHMvc2VjdXJpdHkvY3Jvc3MtZnJhbWUtYWNjZXNzLWVudW1lcmF0aW9uLmh0 bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L2Nyb3Nz LWZyYW1lLWFjY2Vzcy1lbnVtZXJhdGlvbi5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDU0 IEBACis8aHRtbD4KKzxoZWFkPgorICAgIDxzY3JpcHQgc3JjPSJyZXNvdXJjZXMvY3Jvc3MtZnJh bWUtYWNjZXNzLmpzIj48L3NjcmlwdD4KKyAgICA8c2NyaXB0PgorICAgICAgICB3aW5kb3cub25s b2FkID0gZnVuY3Rpb24oKQorICAgICAgICB7CisgICAgICAgICAgICBpZiAod2luZG93LmxheW91 dFRlc3RDb250cm9sbGVyKSB7CisgICAgICAgICAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIu ZHVtcEFzVGV4dCgpOworICAgICAgICAgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRV bnRpbERvbmUoKTsKKyAgICAgICAgICAgIH0KKworICAgICAgICAgICAgaWYgKHdpbmRvdy5sYXlv dXRUZXN0Q29udHJvbGxlcikgeworICAgICAgICAgICAgICAgIHNldFRpbWVvdXQocG9sbEZvclRl c3QsIDEpOworICAgICAgICAgICAgfSBlbHNlIHsKKyAgICAgICAgICAgICAgICBsb2coIlRvIHJ1 biB0aGUgdGVzdCwgY2xpY2sgdGhlIGJ1dHRvbiBiZWxvdyB3aGVuIHRoZSBmcmFtZSBmaW5pc2hl cyBsb2FkaW5nLiIpOworICAgICAgICAgICAgICAgIHZhciBidXR0b24gPSBkb2N1bWVudC5jcmVh dGVFbGVtZW50KCJidXR0b24iKTsKKyAgICAgICAgICAgICAgICBidXR0b24uYXBwZW5kQ2hpbGQo ZG9jdW1lbnQuY3JlYXRlVGV4dE5vZGUoIlJ1biBUZXN0IikpOworICAgICAgICAgICAgICAgIGJ1 dHRvbi5vbmNsaWNrID0gcnVuVGVzdDsKKyAgICAgICAgICAgICAgICBkb2N1bWVudC5ib2R5LmFw cGVuZENoaWxkKGJ1dHRvbik7CisgICAgICAgICAgICB9CisgICAgICAgIH0KKyAgICAKKyAgICAg ICAgcG9sbEZvclRlc3QgPSBmdW5jdGlvbigpCisgICAgICAgIHsKKyAgICAgICAgICAgIGlmICgh bGF5b3V0VGVzdENvbnRyb2xsZXIuZ2xvYmFsRmxhZykgeworICAgICAgICAgICAgICAgIHNldFRp bWVvdXQocG9sbEZvclRlc3QsIDEpOworICAgICAgICAgICAgICAgIHJldHVybjsKKyAgICAgICAg ICAgIH0KKyAgICAgICAgICAgIHJ1blRlc3QoKTsKKyAgICAgICAgICAgIGxheW91dFRlc3RDb250 cm9sbGVyLm5vdGlmeURvbmUoKTsKKyAgICAgICAgfQorCisgICAgICAgIHJ1blRlc3QgPSBmdW5j dGlvbigpCisgICAgICAgIHsKKyAgICAgICAgICAgIHZhciBiX3dpbiA9IGRvY3VtZW50LmdldEVs ZW1lbnRzQnlUYWdOYW1lKCJpZnJhbWUiKVswXS5jb250ZW50V2luZG93OworICAgICAgICAgICAg dHJ5IHsKKyAgICAgICAgICAgICAgICBmb3IgKHZhciBrIGluIGJfd2luKSB7CisgICAgICAgICAg ICAgICAgICAgIGlmIChrID09ICJjdXN0b21Qcm9wZXJ0eSIpIHsKKyAgICAgICAgICAgICAgICAg ICAgICAgIGxvZygiRkFJTDogQ3Jvc3MgZnJhbWUgYWNjZXNzIGJ5IGVudW1lcmF0aW5nIHRoZSB3 aW5kb3cgb2JqZWN0IHdhcyBhbGxvd2VkLiIpOworICAgICAgICAgICAgICAgICAgICAgICAgcmV0 dXJuOworICAgICAgICAgICAgICAgICAgICB9CisgICAgICAgICAgICAgICAgfQorICAgICAgICAg ICAgfSBjYXRjaCAoZSkgeworICAgICAgICAgICAgfQorICAgICAgICAgICAgbG9nKCJQQVNTOiBD cm9zcyBmcmFtZSBhY2Nlc3MgYnkgZW51bWVyYXRpbmcgdGhlIHdpbmRvdyBvYmplY3Qgd2FzIGRl bmllZC4iKTsKKyAgICAgICAgfQorICAgIDwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHk+CisgICAg PHA+VGhpcyB0ZXN0cyB0aGF0IHZhcmlhYmxlIG5hbWVzIGNhbid0IGJlIGVudW1lcmF0ZWQgY3Jv c3MgZG9tYWluIChzZWUgaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTYz ODcpPC9wPgorICAgIDxpZnJhbWUgc3JjPSJodHRwOi8vbG9jYWxob3N0OjgwMDAvc2VjdXJpdHkv cmVzb3VyY2VzL2Nyb3NzLWZyYW1lLWlmcmFtZS1mb3ItZW51bWVyYXRpb24tdGVzdCI+PC9pZnJh bWU+CisgICAgPHByZSBpZD0iY29uc29sZSI+PC9wcmU+Cis8L2JvZHk+Cis8L2h0bWw+CkluZGV4 OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9jcm9zcy1mcmFtZS1p ZnJhbWUtZm9yLWVudW1lcmF0aW9uLXRlc3QuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9odHRwL3Rlc3RzL3NlY3VyaXR5L3Jlc291cmNlcy9jcm9zcy1mcmFtZS1pZnJhbWUtZm9yLWVu dW1lcmF0aW9uLXRlc3QuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVz dHMvc2VjdXJpdHkvcmVzb3VyY2VzL2Nyb3NzLWZyYW1lLWlmcmFtZS1mb3ItZW51bWVyYXRpb24t dGVzdC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDkgQEAKKzxzY3JpcHQ+CisgICAgd2lu ZG93LmN1c3RvbVByb3BlcnR5ID0gMTsKKworICAgIHdpbmRvdy5vbmxvYWQgPSBmdW5jdGlvbigp CisgICAgeworICAgICAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgICAg ICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZ2xvYmFsRmxhZyA9IHRydWU7CisgICAgfQorPC9z Y3JpcHQ+Cg==