185500 2018-05-09 17:09:46 -0700 Drop-down Control borders missing 2019-01-02 11:07:47 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 193079 1 pvollan pvollan ap bfulgham bshafiei commit-queue dbates jmarcell webkit-bug-importer oldest_to_newest 1422571 0 pvollan 2018-05-09 17:09:46 -0700 This can be seen when filing a bug on bugs.webkit.org. 1422573 1 pvollan 2018-05-09 17:10:13 -0700 <rdar://problem/40093461> 1422596 2 340058 pvollan 2018-05-09 18:39:14 -0700 Created attachment 340058 Patch 1422615 3 340058 ap 2018-05-09 19:39:43 -0700 Comment on attachment 340058 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=340058&action=review > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:643 > +(allow file-read-data (path-regex #"^/private/tmp/cv")) This looks super suspicious. Any process on the system can modify WebKit behavior by writing to this location? That can’t be right, and I don’t think that it’s ok to allow. 1422625 4 pvollan 2018-05-09 21:09:36 -0700 (In reply to Alexey Proskuryakov from comment #3) > Comment on attachment 340058 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=340058&action=review > > > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:643 > > +(allow file-read-data (path-regex #"^/private/tmp/cv")) > > This looks super suspicious. Any process on the system can modify WebKit > behavior by writing to this location? That can’t be right, and I don’t think > that it’s ok to allow. This is intended as a temporary workaround until the underlying issue is fixed, but I do see your concern. Thanks for reviewing! 1422626 5 bfulgham 2018-05-09 21:11:52 -0700 (In reply to Per Arne Vollan from comment #4) > (In reply to Alexey Proskuryakov from comment #3) > > Comment on attachment 340058 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=340058&action=review > > > > > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:643 > > > +(allow file-read-data (path-regex #"^/private/tmp/cv")) > > > > This looks super suspicious. Any process on the system can modify WebKit > > behavior by writing to this location? That can’t be right, and I don’t think > > that it’s ok to allow. > > This is intended as a temporary workaround until the underlying issue is > fixed, but I do see your concern. > > Thanks for reviewing! Yes, I agree with Alexey. I thought this sounded fine as a quick fix to allow someone to have proper function in a local build, but I don't think it's appropriate to land for general use. We need to help find and fix the underlying regression that is causing this widget drawing weirdness. 1422627 6 pvollan 2018-05-09 21:23:37 -0700 (In reply to Brent Fulgham from comment #5) > (In reply to Per Arne Vollan from comment #4) > > (In reply to Alexey Proskuryakov from comment #3) > > > Comment on attachment 340058 [details] > > > Patch > > > > > > View in context: > > > https://bugs.webkit.org/attachment.cgi?id=340058&action=review > > > > > > > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:643 > > > > +(allow file-read-data (path-regex #"^/private/tmp/cv")) > > > > > > This looks super suspicious. Any process on the system can modify WebKit > > > behavior by writing to this location? That can’t be right, and I don’t think > > > that it’s ok to allow. > > > > This is intended as a temporary workaround until the underlying issue is > > fixed, but I do see your concern. > > > > Thanks for reviewing! > > Yes, I agree with Alexey. I thought this sounded fine as a quick fix to > allow someone to have proper function in a local build, but I don't think > it's appropriate to land for general use. > > We need to help find and fix the underlying regression that is causing this > widget drawing weirdness. Sounds good, thanks for reviewing! 1422663 7 340058 dbates 2018-05-10 00:07:48 -0700 Comment on attachment 340058 Patch r-‘ing per comment 3 and comment 5 and to get this patch out of the review and cq queues. 1422747 8 340097 pvollan 2018-05-10 10:02:01 -0700 Created attachment 340097 Patch 1422750 9 340097 ap 2018-05-10 10:04:56 -0700 Comment on attachment 340097 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=340097&action=review > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:112 > + (allow file-read* file-write-unlink > + (extension "com.apple.cvms.kernel")) This seems to mean that a process with com.apple.cvms.kernel extension can read any files, and delete any files. > Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:114 > + (allow file-read* file-write-unlink > + (prefix "/private/tmp/cvmsCodeSignObj")) Doesn't this have the same problem as the original patch? 1422762 10 340097 bfulgham 2018-05-10 10:43:25 -0700 Comment on attachment 340097 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=340097&action=review >> Source/WebKit/WebProcess/com.apple.WebProcess.sb.in:114 >> + (prefix "/private/tmp/cvmsCodeSignObj")) > > Doesn't this have the same problem as the original patch? Per Arne: Can you try this instead: (with-filter (extension "com.apple.cvms.kernel") (allow file-read* file-write-unlink (prefix "/private/tmp/cvmsCodeSignObj”))) 1422787 11 340111 pvollan 2018-05-10 11:23:44 -0700 Created attachment 340111 Patch 1422817 12 340111 bfulgham 2018-05-10 12:12:49 -0700 Comment on attachment 340111 Patch This version looks good, based on what we discussed with the sandboxing team. r=me 1422818 13 340111 pvollan 2018-05-10 12:15:20 -0700 Comment on attachment 340111 Patch Thanks for reviewing, all! 1422822 14 340111 commit-queue 2018-05-10 12:38:10 -0700 Comment on attachment 340111 Patch Clearing flags on attachment: 340111 Committed r231653: <https://trac.webkit.org/changeset/231653> 1422823 15 commit-queue 2018-05-10 12:38:11 -0700 All reviewed patches have been landed. Closing bug. 340058 2018-05-09 18:39:14 -0700 2018-05-10 10:02:00 -0700 Patch bug-185500-20180509183912.patch text/plain 1302 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyMzE2MjEpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE4LTA1LTA5ICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBEcm9wLWRvd24gQ29udHJvbCBi b3JkZXJzIG1pc3NpbmcuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xODU1MDAKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzQwMDkzNDYxPgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE9wZW4gc2FuZGJveCBm b3IgcmVhZGluZyBvZiBzb21lIGZpbGVzIGluIHRlbXAgZm9sZGVyLgorCisgICAgICAgICogV2Vi UHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbjoKKwogMjAxOC0wNS0wOSAgV2Vuc29u IEhzaWVoICA8d2Vuc29uX2hzaWVoQGFwcGxlLmNvbT4KIAogICAgICAgICBbRXh0cmEgem9vbSBt b2RlXSBmYXN0L3ZpZXdwb3J0L2V4dHJhem9vbS92aWV3cG9ydC1jaGFuZ2UtbWluLWRldmljZS13 aWR0aC5odG1sIHNvbWV0aW1lcyBmYWlscwpJbmRleDogU291cmNlL1dlYktpdC9XZWJQcm9jZXNz L2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJLaXQv V2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbgkocmV2aXNpb24gMjMxNTg3KQor KysgU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCSh3 b3JraW5nIGNvcHkpCkBAIC02MzksNiArNjM5LDEwIEBACiAoYWxsb3cgZmlsZS1yZWFkLWRhdGEg KHBhdGggIi9wcml2YXRlL3Zhci9kYi9uc3VybHN0b3JhZ2VkL2RhZnNhRGF0YS5iaW4iKSkKICNl bmRpZgogCisjaWYgX19NQUNfT1NfWF9WRVJTSU9OX01JTl9SRVFVSVJFRCA+PSAxMDE0MDAKKyhh bGxvdyBmaWxlLXJlYWQtZGF0YSAocGF0aC1yZWdleCAjIl4vcHJpdmF0ZS90bXAvY3YiKSkKKyNl bmRpZgorCiA7OyBOZXR3b3JrIEV4dGVuc2lvbnMgLyBWUE4gaGVscGVyLgogKGFsbG93IG1hY2gt bG9va3VwCiAgICAgKGdsb2JhbC1uYW1lICJjb20uYXBwbGUubmVoZWxwZXIiKSkK 340097 2018-05-10 10:02:01 -0700 2018-05-10 11:23:42 -0700 Patch bug-185500-20180510100200.patch text/plain 1398 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyMzE2NDIpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE4LTA1LTEwICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBEcm9wLWRvd24gQ29udHJvbCBi b3JkZXJzIG1pc3NpbmcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTE4NTUwMAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNDAwOTM0NjE+CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRqdXN0IHNhbmRib3gg dG8gYWxsb3cgcmVhZGluZyBzb21lIGZpbGVzIGluIHRlbXAgZm9sZGVyLgorCisgICAgICAgICog V2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbjoKKwogMjAxOC0wNS0wOSAgQ2Fy bG9zIEdhcmNpYSBDYW1wb3MgIDxjZ2FyY2lhQGlnYWxpYS5jb20+CiAKICAgICAgICAgV2ViRHJp dmVyOiBpbXBsZW1lbnQgYWR2YW5jZSB1c2VyIGludGVyYWN0aW9ucwpJbmRleDogU291cmNlL1dl YktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbgkocmV2 aXNpb24gMjMxNjQxKQorKysgU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQ cm9jZXNzLnNiLmluCSh3b3JraW5nIGNvcHkpCkBAIC0xMDcsNiArMTA3LDEyIEBACiAgICAgOzsg Q1ZNUwogICAgIChhbGxvdyBtYWNoLWxvb2t1cAogICAgICAgICAoZ2xvYmFsLW5hbWUgImNvbS5h cHBsZS5jdm1zU2VydiIpKQorICAgIDs7IE5lZWRlZCBieSA8cmRhcjovL3Byb2JsZW0vNDAwOTM0 NjE+LCByZW1vdmUgd2hlbiA8cmRhcjovL3Byb2JsZW0vMzk0MDI1NTU+IGlzIGZpeGVkLgorICAg IChhbGxvdyBmaWxlLXJlYWQqIGZpbGUtd3JpdGUtdW5saW5rCisgICAgICAgIChleHRlbnNpb24g ImNvbS5hcHBsZS5jdm1zLmtlcm5lbCIpKQorICAgIChhbGxvdyBmaWxlLXJlYWQqIGZpbGUtd3Jp dGUtdW5saW5rCisgICAgICAgIChwcmVmaXggIi9wcml2YXRlL3RtcC9jdm1zQ29kZVNpZ25PYmoi KSkKKwogICAgIDs7IE9wZW5DTAogICAgIChhbGxvdyBpb2tpdC1vcGVuCiAgICAgICAgIChpb2tp dC1jb25uZWN0aW9uICJJT0FjY2VsZXJhdG9yIikK 340111 2018-05-10 11:23:44 -0700 2018-05-10 12:38:10 -0700 Patch bug-185500-20180510112343.patch text/plain 1406 pvollan SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyMzE2MjEpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDE4LTA1LTA5ICBQZXIgQXJuZSBW b2xsYW4gIDxwdm9sbGFuQGFwcGxlLmNvbT4KKworICAgICAgICBEcm9wLWRvd24gQ29udHJvbCBi b3JkZXJzIG1pc3NpbmcuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xODU1MDAKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzQwMDkzNDYxPgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE9wZW4gc2FuZGJveCBm b3IgcmVhZGluZyBvZiBzb21lIGZpbGVzIGluIHRlbXAgZm9sZGVyLgorCisgICAgICAgICogV2Vi UHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbjoKKwogMjAxOC0wNS0wOSAgV2Vuc29u IEhzaWVoICA8d2Vuc29uX2hzaWVoQGFwcGxlLmNvbT4KIAogICAgICAgICBbRXh0cmEgem9vbSBt b2RlXSBmYXN0L3ZpZXdwb3J0L2V4dHJhem9vbS92aWV3cG9ydC1jaGFuZ2UtbWluLWRldmljZS13 aWR0aC5odG1sIHNvbWV0aW1lcyBmYWlscwpJbmRleDogU291cmNlL1dlYktpdC9XZWJQcm9jZXNz L2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJLaXQv V2ViUHJvY2Vzcy9jb20uYXBwbGUuV2ViUHJvY2Vzcy5zYi5pbgkocmV2aXNpb24gMjMxNTg3KQor KysgU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvbS5hcHBsZS5XZWJQcm9jZXNzLnNiLmluCSh3 b3JraW5nIGNvcHkpCkBAIC0xMDcsNiArMTA3LDExIEBACiAgICAgOzsgQ1ZNUwogICAgIChhbGxv dyBtYWNoLWxvb2t1cAogICAgICAgICAoZ2xvYmFsLW5hbWUgImNvbS5hcHBsZS5jdm1zU2VydiIp KQorI2lmIF9fTUFDX09TX1hfVkVSU0lPTl9NSU5fUkVRVUlSRUQgPj0gMTAxNDAwCisgICAgOzsg TmVlZGVkIGJ5IDxyZGFyOi8vcHJvYmxlbS80MDA5MzQ2MT4sIHJlbW92ZSB3aGVuIDxyZGFyOi8v cHJvYmxlbS8zOTQwMjU1NT4gaXMgZml4ZWQuCisgICAgKGFsbG93IGZpbGUtcmVhZCogZmlsZS13 cml0ZS11bmxpbmsKKyAgICAgICAgKHByZWZpeCAiL3ByaXZhdGUvdG1wL2N2bXNDb2RlU2lnbk9i aiIpKQorI2VuZGlmCiAgICAgOzsgT3BlbkNMCiAgICAgKGFsbG93IGlva2l0LW9wZW4KICAgICAg ICAgKGlva2l0LWNvbm5lY3Rpb24gIklPQWNjZWxlcmF0b3IiKQo=