180307 2017-12-01 22:50:16 -0800 IPC code doesn't understand NSDictionaries with non-NSString keys 2018-09-10 19:56:17 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=188008 InRadar P2 Normal --- 1 mmaxfield mmaxfield achristensen andersca ap beidson bfulgham commit-queue webkit-bug-importer oldest_to_newest 1377245 0 mmaxfield 2017-12-01 22:50:16 -0800 IPC code doesn't understand NSDictionaries with non-NSString keys 1377246 1 328214 mmaxfield 2017-12-01 22:50:35 -0800 Created attachment 328214 Needs test 1377248 2 mmaxfield 2017-12-01 22:51:23 -0800 <rdar://problem/35812382> 1377249 3 mmaxfield 2017-12-01 22:52:43 -0800 Is there a direct way to test these? Or do I have to use EventSender? 1377336 4 ap 2017-12-02 11:42:29 -0800 We usually send WTF objects over CoreIPC. Sending Foundation objects just has too many pitfalls, including correctness, performance and security. I recommend looking into removing the existing code here, not into extending it. 1377374 5 beidson 2017-12-02 15:14:08 -0800 Without even looking at the patch, I agree with Alexey. Attempts to serialize Cocoa types are often wrought with problems and are not entirely within our control. Better to use WTF/WebCore/WebKit types when possible 1377716 6 mmaxfield 2017-12-04 09:26:35 -0800 So it's better to convert to WTF types, send across the wire, then convert back to NS types, rather than just fixing a bug in our existing converters? 1377754 7 ap 2017-12-04 10:23:09 -0800 Yes. Or better yet, not use NS types in WebCore at all. The security aspect of it is not just about what you do, but also about what malicious code running in WebContent can do to escape the sandbox. Any deserialization of NS types performed in UI process adds a large attack surface. 1377760 8 ap 2017-12-04 10:30:39 -0800 Oh wait, this doesn't actually use Foundation serialization. What I said is mostly irrelevant, I should have studied the patch more closely. Freaked out because of the recent NSSecureCoding fixes. 1380827 9 329151 mmaxfield 2017-12-12 13:58:34 -0800 Created attachment 329151 Patch 1380876 10 329151 commit-queue 2017-12-12 15:11:23 -0800 Comment on attachment 329151 Patch Clearing flags on attachment: 329151 Committed r225811: <https://trac.webkit.org/changeset/225811> 1380877 11 commit-queue 2017-12-12 15:11:25 -0800 All reviewed patches have been landed. Closing bug. 328214 2017-12-01 22:50:35 -0800 2017-12-12 13:58:33 -0800 Needs test bug-180307-20171201225034.patch text/plain 2057 mmaxfield U3VidmVyc2lvbiBSZXZpc2lvbjogMjI1NDM2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDc2YzIyZTAxYmQ0Mzg1M2I5 NDU5NDM3MGRlMzAyMjJjMWI1Yjc1YzAuLmZjNjMxMDBmMjMwZWJlMzFiNDNiOTkwMzAzZWM4MGVj YWYzZTI4ODAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTctMTItMDEgIE15bGVzIEMu IE1heGZpZWxkICA8bW1heGZpZWxkQGFwcGxlLmNvbT4KKworICAgICAgICBJUEMgY29kZSBkb2Vz bid0IHVuZGVyc3RhbmQgTlNEaWN0aW9uYXJpZXMgd2l0aCBub24tTlNTdHJpbmcga2V5cworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTgwMzA3CisgICAg ICAgIDxyZGFyOi8vcHJvYmxlbS8zNTgxMjM4Mj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICAqIFNoYXJlZC9tYWMvQXJndW1lbnRDb2RlcnNNYWMubW06 CisgICAgICAgIChJUEM6OmVuY29kZSk6CisgICAgICAgIChJUEM6OmRlY29kZSk6CisKIDIwMTct MTItMDEgIERhbmllbCBCYXRlcyAgPGRhYmF0ZXNAYXBwbGUuY29tPgogCiAgICAgICAgIEFsdGVy bmF0aXZlIFByZXNlbnRhdGlvbiBCdXR0b246IFByb3ZpZGUgYSB3YXkgdG8gcXVlcnkgZm9yIHRo ZSByZXBsYWNlZCBlbGVtZW50cwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9TaGFyZWQvbWFj L0FyZ3VtZW50Q29kZXJzTWFjLm1tIGIvU291cmNlL1dlYktpdC9TaGFyZWQvbWFjL0FyZ3VtZW50 Q29kZXJzTWFjLm1tCmluZGV4IDAwNmQzNzUyZmE4NjYxYTI0NTE4ZGI2N2QzMTA2Njk5OGEzNWVj ZDYuLjMxNzBlZWUyMGE0ODdkMGIxZDRjYjZiZjYxNThkNTI5MWQxMDRiYzIgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJLaXQvU2hhcmVkL21hYy9Bcmd1bWVudENvZGVyc01hYy5tbQorKysgYi9Tb3Vy Y2UvV2ViS2l0L1NoYXJlZC9tYWMvQXJndW1lbnRDb2RlcnNNYWMubW0KQEAgLTM2Nyw3ICszNjcs NiBAQCB2b2lkIGVuY29kZShFbmNvZGVyJiBlbmNvZGVyLCBOU0RpY3Rpb25hcnkgKmRpY3Rpb25h cnkpCiAgICAgICAgIGlkIGtleSA9IFtrZXlzIG9iamVjdEF0SW5kZXg6aV07CiAgICAgICAgIGlk IHZhbHVlID0gW3ZhbHVlcyBvYmplY3RBdEluZGV4OmldOwogICAgICAgICBBU1NFUlQoa2V5KTsK LSAgICAgICAgQVNTRVJUKFtrZXkgaXNLaW5kT2ZDbGFzczpbTlNTdHJpbmcgY2xhc3NdXSk7CiAg ICAgICAgIEFTU0VSVCh2YWx1ZSk7CiAgICAgICAgIEFTU0VSVChpc1NlcmlhbGl6YWJsZVZhbHVl KHZhbHVlKSk7CiAKQEAgLTM3NSw3ICszNzQsNyBAQCB2b2lkIGVuY29kZShFbmNvZGVyJiBlbmNv ZGVyLCBOU0RpY3Rpb25hcnkgKmRpY3Rpb25hcnkpCiAgICAgICAgIGlmICh0eXBlRnJvbU9iamVj dCh2YWx1ZSkgPT0gTlNUeXBlOjpVbmtub3duKQogICAgICAgICAgICAgY29udGludWU7CiAKLSAg ICAgICAgZW5jb2RlKGVuY29kZXIsIChOU1N0cmluZyAqKWtleSk7CisgICAgICAgIGVuY29kZShl bmNvZGVyLCBrZXkpOwogICAgICAgICBlbmNvZGUoZW5jb2RlciwgdmFsdWUpOwogICAgIH0KIH0K QEAgLTM4OSw3ICszODgsNyBAQCBib29sIGRlY29kZShEZWNvZGVyJiBkZWNvZGVyLCBSZXRhaW5Q dHI8TlNEaWN0aW9uYXJ5PiYgcmVzdWx0KQogICAgIFJldGFpblB0cjxOU011dGFibGVEaWN0aW9u YXJ5PiBkaWN0aW9uYXJ5ID0gYWRvcHROUyhbW05TTXV0YWJsZURpY3Rpb25hcnkgYWxsb2NdIGlu aXRXaXRoQ2FwYWNpdHk6c2l6ZV0pOwogICAgIGZvciAodWludDY0X3QgaSA9IDA7IGkgPCBzaXpl OyArK2kpIHsKICAgICAgICAgLy8gVHJ5IHRvIGRlY29kZSB0aGUga2V5IG5hbWUuCi0gICAgICAg IFJldGFpblB0cjxOU1N0cmluZz4ga2V5OworICAgICAgICBSZXRhaW5QdHI8aWQ+IGtleTsKICAg ICAgICAgaWYgKCFkZWNvZGUoZGVjb2Rlciwga2V5KSkKICAgICAgICAgICAgIHJldHVybiBmYWxz ZTsKIAo= 329151 2017-12-12 13:58:34 -0800 2017-12-12 15:11:23 -0800 Patch bug-180307-20171212135833.patch text/plain 4607 mmaxfield U3VidmVyc2lvbiBSZXZpc2lvbjogMjI1NzU0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGUzYjE2MTk3ODIwNzNkYTY5 Mjc0NDQ5MDk4OGY5MjE2Zjc1NWRkMDkuLjA5MmVhNmY2ZjRhNTk4YmE0NDQ1NjU2OTVhMjRhOWJk MmNkNGVhMzAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMTctMTItMTIgIE15bGVzIEMu IE1heGZpZWxkICA8bW1heGZpZWxkQGFwcGxlLmNvbT4KKworICAgICAgICBJUEMgY29kZSBkb2Vz bid0IHVuZGVyc3RhbmQgTlNEaWN0aW9uYXJpZXMgd2l0aCBub24tTlNTdHJpbmcga2V5cworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTgwMzA3CisgICAg ICAgIDxyZGFyOi8vcHJvYmxlbS8zNTgxMjM4Mj4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBWYXJpYWJsZSBmb250cyBoYXZlIGEgZGljdGlvbmFyeSBp bnNpZGUgaXRzIGRlc2NyaXB0b3Igd2hpY2ggcmVwcmVzZW50cyB0aGUgdmFsdWVzCisgICAgICAg IG9mIGFsbCB0aGUgYXhlcyBvZiB0aGUgdmFyaWFibGUgZm9udC4gT3VyIElQQyBjb2RlIHdhc24n dCBleHBlY3RpbmcgdGhpcy4KKworICAgICAgICAqIFNoYXJlZC9tYWMvQXJndW1lbnRDb2RlcnNN YWMubW06CisgICAgICAgIChJUEM6OmVuY29kZSk6CisgICAgICAgIChJUEM6OmRlY29kZSk6CisK IDIwMTctMTItMTEgIEJyZW50IEZ1bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CiAKICAgICAg ICAgW2lPU10gRG9uJ3QgaW1wb3J0ICdVSUtpdC1hcHBzLnNiJyB0byB0aGUgV2ViQ29udGVudCBw cm9jZXNzIHNhbmRib3gKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvU2hhcmVkL21hYy9Bcmd1 bWVudENvZGVyc01hYy5tbSBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL21hYy9Bcmd1bWVudENvZGVy c01hYy5tbQppbmRleCAwMDZkMzc1MmZhODY2MWEyNDUxOGRiNjdkMzEwNjY5OThhMzVlY2Q2Li4z MTcwZWVlMjBhNDg3ZDBiMWQ0Y2I2YmY2MTU4ZDUyOTFkMTA0YmMyIDEwMDY0NAotLS0gYS9Tb3Vy Y2UvV2ViS2l0L1NoYXJlZC9tYWMvQXJndW1lbnRDb2RlcnNNYWMubW0KKysrIGIvU291cmNlL1dl YktpdC9TaGFyZWQvbWFjL0FyZ3VtZW50Q29kZXJzTWFjLm1tCkBAIC0zNjcsNyArMzY3LDYgQEAg dm9pZCBlbmNvZGUoRW5jb2RlciYgZW5jb2RlciwgTlNEaWN0aW9uYXJ5ICpkaWN0aW9uYXJ5KQog ICAgICAgICBpZCBrZXkgPSBba2V5cyBvYmplY3RBdEluZGV4OmldOwogICAgICAgICBpZCB2YWx1 ZSA9IFt2YWx1ZXMgb2JqZWN0QXRJbmRleDppXTsKICAgICAgICAgQVNTRVJUKGtleSk7Ci0gICAg ICAgIEFTU0VSVChba2V5IGlzS2luZE9mQ2xhc3M6W05TU3RyaW5nIGNsYXNzXV0pOwogICAgICAg ICBBU1NFUlQodmFsdWUpOwogICAgICAgICBBU1NFUlQoaXNTZXJpYWxpemFibGVWYWx1ZSh2YWx1 ZSkpOwogCkBAIC0zNzUsNyArMzc0LDcgQEAgdm9pZCBlbmNvZGUoRW5jb2RlciYgZW5jb2Rlciwg TlNEaWN0aW9uYXJ5ICpkaWN0aW9uYXJ5KQogICAgICAgICBpZiAodHlwZUZyb21PYmplY3QodmFs dWUpID09IE5TVHlwZTo6VW5rbm93bikKICAgICAgICAgICAgIGNvbnRpbnVlOwogCi0gICAgICAg IGVuY29kZShlbmNvZGVyLCAoTlNTdHJpbmcgKilrZXkpOworICAgICAgICBlbmNvZGUoZW5jb2Rl ciwga2V5KTsKICAgICAgICAgZW5jb2RlKGVuY29kZXIsIHZhbHVlKTsKICAgICB9CiB9CkBAIC0z ODksNyArMzg4LDcgQEAgYm9vbCBkZWNvZGUoRGVjb2RlciYgZGVjb2RlciwgUmV0YWluUHRyPE5T RGljdGlvbmFyeT4mIHJlc3VsdCkKICAgICBSZXRhaW5QdHI8TlNNdXRhYmxlRGljdGlvbmFyeT4g ZGljdGlvbmFyeSA9IGFkb3B0TlMoW1tOU011dGFibGVEaWN0aW9uYXJ5IGFsbG9jXSBpbml0V2l0 aENhcGFjaXR5OnNpemVdKTsKICAgICBmb3IgKHVpbnQ2NF90IGkgPSAwOyBpIDwgc2l6ZTsgKytp KSB7CiAgICAgICAgIC8vIFRyeSB0byBkZWNvZGUgdGhlIGtleSBuYW1lLgotICAgICAgICBSZXRh aW5QdHI8TlNTdHJpbmc+IGtleTsKKyAgICAgICAgUmV0YWluUHRyPGlkPiBrZXk7CiAgICAgICAg IGlmICghZGVjb2RlKGRlY29kZXIsIGtleSkpCiAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CiAK ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCA5ZTllNmNhMjg5MDFkYWIyZjRlNTQxODVjOGQzNjBjOTAxZjE3YzE0Li4yZWJhNzNk MGM4ZmFjYjk2N2EwNTAyMWM2NWZlY2IzMTE3ZTc2MmFlIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAK KzIwMTctMTItMTIgIE15bGVzIEMuIE1heGZpZWxkICA8bW1heGZpZWxkQGFwcGxlLmNvbT4KKwor ICAgICAgICBJUEMgY29kZSBkb2Vzbid0IHVuZGVyc3RhbmQgTlNEaWN0aW9uYXJpZXMgd2l0aCBu b24tTlNTdHJpbmcga2V5cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MTgwMzA3CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8zNTgxMjM4Mj4KKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGZhc3QvdGV4dC92 YXJpYXRpb25zL2lwYy1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvdGV4dC92 YXJpYXRpb25zL2lwYy5odG1sOiBBZGRlZC4KKwogMjAxNy0xMi0xMSAgRGF2aWQgUXVlc2FkYSAg PGRhdmlkX3F1ZXNhZGFAYXBwbGUuY29tPgogCiAgICAgICAgIFR1cm4gb24gRU5BQkxFX0FQUExJ Q0FUSU9OX01BTklGRVNUCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L3RleHQvdmFyaWF0 aW9ucy9pcGMtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC90ZXh0L3ZhcmlhdGlvbnMv aXBjLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5jMWI1Y2VmZTJkZDI4NjI3ZmY2YmJiMmY5ODRj OTQ4YmNkM2IyMTM5Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC90ZXh0L3Zh cmlhdGlvbnMvaXBjLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDIgQEAKK1RoaXMgbWFrZXMgc3Vy ZSB0aGF0IHZhcmlhYmxlIGZvbnRzIGNhbiBiZSBzZW50IGFjcm9zcyBJUEMuIFRoZSB0ZXN0IHBh c3NlcyBpZiB0aGVyZSBpcyBubyBjcmFzaC4KK0hlbGxvCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0 cy9mYXN0L3RleHQvdmFyaWF0aW9ucy9pcGMuaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvdGV4dC92 YXJpYXRpb25zL2lwYy5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjBhMjI4NzEzY2RhNzAyYjIzMTBmYzE3YWQw NjkwMjI1ZDdhMDM1ZWEKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L3RleHQv dmFyaWF0aW9ucy9pcGMuaHRtbApAQCAtMCwwICsxLDM2IEBACis8IURPQ1RZUEUgaHRtbD4KKzxo dG1sPgorPGhlYWQ+Cis8c3R5bGU+CitAZm9udC1mYWNlIHsKKyAgICBmb250LWZhbWlseTogIkJv eGlzIjsKKyAgICBzcmM6IHVybCgicmVzb3VyY2VzL0JveGlzLVZGLnR0ZiIpIGZvcm1hdCgidHJ1 ZXR5cGUiKTsKK30KKzwvc3R5bGU+Cis8c2NyaXB0PgorZnVuY3Rpb24gdGVzdCgpIHsKKyAgICBs ZXQgdGFyZ2V0ID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoInRhcmdldCIpOworICAgIGxldCB4 ID0gdGFyZ2V0Lm9mZnNldExlZnQgKyB0YXJnZXQub2Zmc2V0V2lkdGggLyAyOworICAgIGxldCB5 ID0gdGFyZ2V0Lm9mZnNldFRvcCArIHRhcmdldC5vZmZzZXRIZWlnaHQgLyAyOworICAgIGlmICh3 aW5kb3cuZXZlbnRTZW5kZXIpIHsKKyAgICAgICAgZXZlbnRTZW5kZXIubW91c2VNb3ZlVG8oeCwg eSk7CisgICAgICAgIGV2ZW50U2VuZGVyLm1vdXNlRG93bigpOworICAgICAgICBldmVudFNlbmRl ci5tb3VzZVVwKCk7CisgICAgfQorICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgICAg dGVzdFJ1bm5lci5ub3RpZnlEb25lKCk7Cit9Cis8L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5Pgor VGhpcyBtYWtlcyBzdXJlIHRoYXQgdmFyaWFibGUgZm9udHMgY2FuIGJlIHNlbnQgYWNyb3NzIElQ Qy4gVGhlIHRlc3QgcGFzc2VzIGlmIHRoZXJlIGlzIG5vIGNyYXNoLgorPGRpdiBzdHlsZT0iZm9u dDogNDhweCAnQm94aXMnOyBmb250LXZhcmlhdGlvbi1zZXR0aW5nczogJ2hnaHQnIDYwMCwgJ3dk dGgnIDYwMDsiPjxzcGFuIGlkPSJ0YXJnZXQiPkhlbGxvPC9zcGFuPjwvZGl2PgorPHNjcmlwdD4K K2lmICh3aW5kb3cudGVzdFJ1bm5lcikgeworICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOwor ICAgIHRlc3RSdW5uZXIud2FpdFVudGlsRG9uZSgpOworfQord2luZG93LmFkZEV2ZW50TGlzdGVu ZXIoImxvYWQiLCB0ZXN0KTsKKzwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgo=