222130 2021-02-18 13:37:58 -0800 hasBrokenEncryptedMediaAPISupportQuirk and needsPreloadAutoQuirk have overly permissive domain allow lists 2022-01-10 15:43:47 -0800 1 1 1 Unclassified WebKit Media WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=190051 https://bugs.webkit.org/show_bug.cgi?id=235015 InRadar P2 Normal --- 1 rich eric.carlson christian.n.klein darin eric.carlson jer.noble webkit-bug-importer oldest_to_newest 1731013 0 rich 2021-02-18 13:37:58 -0800 The hasBrokenEncryptedMediaAPISupportQuirk enables quirks behaviour for several whitelisted domains. The rule to allow subdomains of hulu.com appears to be missing a "." so it would also allow sites like "notreallyhulu.com" as well as genuine subdomains. In other words, the check 'domain.endsWith("hulu.com")' should probably be 'domain.endsWith(".hulu.com")'. This would bring it in line with rules for the other domains. See: https://github.com/WebKit/WebKit/blob/4e8064a058644469e9312abdb736c4164c848e71/Source/WebCore/page/Quirks.cpp#L187 1731014 1 rich 2021-02-18 13:43:27 -0800 needsPreloadAutoQuirk appears to have the same issue with the vimeo.com domain https://github.com/WebKit/WebKit/blob/4e8064a058644469e9312abdb736c4164c848e71/Source/WebCore/page/Quirks.cpp#L767 Credit: - https://news.ycombinator.com/item?id=26166497 - https://twitter.com/mikesherov/status/1208025766832803841 1733484 2 webkit-bug-importer 2021-02-25 13:38:12 -0800 <rdar://problem/74758560> 1829514 3 448763 eric.carlson 2022-01-10 09:58:45 -0800 Created attachment 448763 Patch 1829517 4 eric.carlson 2022-01-10 10:01:34 -0800 *** Bug 235015 has been marked as a duplicate of this bug. *** 1829550 5 448775 eric.carlson 2022-01-10 10:52:46 -0800 Created attachment 448775 Patch 1829627 6 ews-feeder 2022-01-10 13:55:19 -0800 Committed r287855 (245901@main): <https://commits.webkit.org/245901@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 448775. 1829629 7 448775 darin 2022-01-10 14:08:03 -0800 Comment on attachment 448775 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=448775&action=review > Source/WebCore/page/Quirks.cpp:820 > + m_needsPreloadAutoQuirk = domain == "vimeo"_s; This should be "vimeo.com", right? 1829643 8 448775 eric.carlson 2022-01-10 15:03:11 -0800 Comment on attachment 448775 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=448775&action=review >> Source/WebCore/page/Quirks.cpp:820 >> + m_needsPreloadAutoQuirk = domain == "vimeo"_s; > > This should be "vimeo.com", right? It certainly should! 1829649 9 eric.carlson 2022-01-10 15:09:32 -0800 Reopening to attach new patch. 1829650 10 448803 eric.carlson 2022-01-10 15:09:33 -0800 Created attachment 448803 Followup to fix typo 1829657 11 ews-feeder 2022-01-10 15:43:44 -0800 Committed r287862 (245906@main): <https://commits.webkit.org/245906@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 448803. 448763 2022-01-10 09:58:45 -0800 2022-01-10 10:52:45 -0800 Patch bug-222130-20220110095844.patch text/plain 1962 eric.carlson U3VidmVyc2lvbiBSZXZpc2lvbjogMjg3NTgwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNjNjZmQ4MTg0OTEwM2M1 ZTQxMjJjYzg5MzZjNmFlNjhmMzI3MDUxZC4uNjg1ZDkwNTkzZjNhOWZjYWNlOTI0ZjM2NGYwYjE1 ODc5Yjk3ZjlkYiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDIyLTAxLTEwICBFcmlj IENhcmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgorCisgICAgICAgIGhhc0Jyb2tlbkVu Y3J5cHRlZE1lZGlhQVBJU3VwcG9ydFF1aXJrIGFuZCBuZWVkc1ByZWxvYWRBdXRvUXVpcmsgaGF2 ZSBvdmVybHkKKyAgICAgICAgcGVybWlzc2l2ZSBkb21haW4gYWxsb3cgbGlzdHMKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMjEzMAorICAgICAgICA8 cmRhcjovL3Byb2JsZW0vNzQ3NTg1NjA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgRml4IHF1aXJrcyB0ZXN0cyBmb3Igc3ViZG9tYWlucyBvZiB2aW1l byBhbmQgaHVsdSBieSBpbmNsdWRpbmcgdGhlIGxlYWRpbmcgZG90CisgICAgICAgIGluIHRoZSB1 cmwgcGFzc2VkIHRvIGBkb21haW4uZW5kc1dpdGgoLi4uKWAuCisKKyAgICAgICAgKiBwYWdlL1F1 aXJrcy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpRdWlya3M6Omhhc0Jyb2tlbkVuY3J5cHRlZE1l ZGlhQVBJU3VwcG9ydFF1aXJrIGNvbnN0KToKKyAgICAgICAgKFdlYkNvcmU6OlF1aXJrczo6bmVl ZHNQcmVsb2FkQXV0b1F1aXJrIGNvbnN0KToKKwogMjAyMi0wMS0wNCAgSmVyIE5vYmxlICA8amVy Lm5vYmxlQGFwcGxlLmNvbT4KIAogICAgICAgICBbQ29jb2FdIEhhbmcgaW4gQVZUcmFja1ByaXZh dGVBVkZPYmpDSW1wbDo6Yml0cmF0ZSgpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdl L1F1aXJrcy5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL1F1aXJrcy5jcHAKaW5kZXggMzE1NTZl NDZmOTgxYzU1Y2RjNjgxOGJmNWQ4ZjE4ZDE5ZTI4MWYyZi4uOGNjNTk2MjgyZGRhMzBjOWEyNTFh MmMwZWRjZjBkYTlhNjM3NTA1MCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGFnZS9RdWly a3MuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvUXVpcmtzLmNwcApAQCAtMTg2LDcgKzE4 Niw3IEBAIGJvb2wgUXVpcmtzOjpoYXNCcm9rZW5FbmNyeXB0ZWRNZWRpYUFQSVN1cHBvcnRRdWly aygpIGNvbnN0CiAgICAgICAgIHx8IGRvbWFpbiA9PSAieW91dHViZS5jb20iCiAgICAgICAgIHx8 IGRvbWFpbi5lbmRzV2l0aCgiLnlvdXR1YmUuY29tIikKICAgICAgICAgfHwgZG9tYWluID09ICJo dWx1LmNvbSIKLSAgICAgICAgfHwgZG9tYWluLmVuZHNXaXRoKCJodWx1LmNvbSIpOworICAgICAg ICB8fCBkb21haW4uZW5kc1dpdGgoIi5odWx1LmNvbSIpOwogCiAgICAgcmV0dXJuIG1faGFzQnJv a2VuRW5jcnlwdGVkTWVkaWFBUElTdXBwb3J0UXVpcmsudmFsdWUoKTsKIH0KQEAgLTgyNCw3ICs4 MjQsNyBAQCBib29sIFF1aXJrczo6bmVlZHNQcmVsb2FkQXV0b1F1aXJrKCkgY29uc3QKIAogICAg IGF1dG8gZG9tYWluID0gbV9kb2N1bWVudC0+c2VjdXJpdHlPcmlnaW4oKS5kb21haW4oKS5jb252 ZXJ0VG9BU0NJSUxvd2VyY2FzZSgpOwogCi0gICAgbV9uZWVkc1ByZWxvYWRBdXRvUXVpcmsgPSBk b21haW4gPT0gInZpbWVvLmNvbSIgfHwgZG9tYWluLmVuZHNXaXRoKCJ2aW1lby5jb20iKTsKKyAg ICBtX25lZWRzUHJlbG9hZEF1dG9RdWlyayA9IGRvbWFpbiA9PSAidmltZW8uY29tIiB8fCBkb21h aW4uZW5kc1dpdGgoIi52aW1lby5jb20iKTsKIAogICAgIHJldHVybiBtX25lZWRzUHJlbG9hZEF1 dG9RdWlyay52YWx1ZSgpOwogI2Vsc2UK 448775 2022-01-10 10:52:46 -0800 2022-01-10 13:55:21 -0800 Patch bug-222130-20220110105246.patch text/plain 2535 eric.carlson U3VidmVyc2lvbiBSZXZpc2lvbjogMjg3NTgwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNjNjZmQ4MTg0OTEwM2M1 ZTQxMjJjYzg5MzZjNmFlNjhmMzI3MDUxZC4uNzgxMDhmMTg4Zjg2Nzk0NWM0YWI2Y2MxNWNhZDY1 ZmExNjRlMWJjZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDIyLTAxLTEwICBFcmlj IENhcmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgorCisgICAgICAgIGhhc0Jyb2tlbkVu Y3J5cHRlZE1lZGlhQVBJU3VwcG9ydFF1aXJrIGFuZCBuZWVkc1ByZWxvYWRBdXRvUXVpcmsgaGF2 ZSBvdmVybHkKKyAgICAgICAgcGVybWlzc2l2ZSBkb21haW4gYWxsb3cgbGlzdHMKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMjEzMAorICAgICAgICA8 cmRhcjovL3Byb2JsZW0vNzQ3NTg1NjA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgRml4IHF1aXJrIHRlc3RzIGZvciBzdWJkb21haW5zIG9mIHZpbWVv IGFuZCBodWx1IGJ5IHVzaW5nIFJlZ2lzdHJhYmxlRG9tYWluIGluc3RlYWQKKyAgICAgICAgb2Yg dGVzdGluZyB0aGUgdXJsIGRpcmVjdGx5LgorCisgICAgICAgICogcGFnZS9RdWlya3MuY3BwOgor ICAgICAgICAoV2ViQ29yZTo6UXVpcmtzOjpoYXNCcm9rZW5FbmNyeXB0ZWRNZWRpYUFQSVN1cHBv cnRRdWlyayBjb25zdCk6CisgICAgICAgIChXZWJDb3JlOjpRdWlya3M6Om5lZWRzUHJlbG9hZEF1 dG9RdWlyayBjb25zdCk6CisKIDIwMjItMDEtMDQgIEplciBOb2JsZSAgPGplci5ub2JsZUBhcHBs ZS5jb20+CiAKICAgICAgICAgW0NvY29hXSBIYW5nIGluIEFWVHJhY2tQcml2YXRlQVZGT2JqQ0lt cGw6OmJpdHJhdGUoKQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9RdWlya3MuY3Bw IGIvU291cmNlL1dlYkNvcmUvcGFnZS9RdWlya3MuY3BwCmluZGV4IDMxNTU2ZTQ2Zjk4MWM1NWNk YzY4MThiZjVkOGYxOGQxOWUyODFmMmYuLmUxYWU1ZjI3YzRhMmU4ZDdiOGVkODQ1NWE2NDVlN2I5 M2U3ZDEyMWYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvUXVpcmtzLmNwcAorKysg Yi9Tb3VyY2UvV2ViQ29yZS9wYWdlL1F1aXJrcy5jcHAKQEAgLTE3OSwxNCArMTc5LDggQEAgYm9v bCBRdWlya3M6Omhhc0Jyb2tlbkVuY3J5cHRlZE1lZGlhQVBJU3VwcG9ydFF1aXJrKCkgY29uc3QK ICAgICBpZiAobV9oYXNCcm9rZW5FbmNyeXB0ZWRNZWRpYUFQSVN1cHBvcnRRdWlyaykKICAgICAg ICAgcmV0dXJuIG1faGFzQnJva2VuRW5jcnlwdGVkTWVkaWFBUElTdXBwb3J0UXVpcmsudmFsdWUo KTsKIAotICAgIGF1dG8gZG9tYWluID0gbV9kb2N1bWVudC0+c2VjdXJpdHlPcmlnaW4oKS5kb21h aW4oKS5jb252ZXJ0VG9BU0NJSUxvd2VyY2FzZSgpOwotCi0gICAgbV9oYXNCcm9rZW5FbmNyeXB0 ZWRNZWRpYUFQSVN1cHBvcnRRdWlyayA9IGRvbWFpbiA9PSAic3RhcnouY29tIgotICAgICAgICB8 fCBkb21haW4uZW5kc1dpdGgoIi5zdGFyei5jb20iKQotICAgICAgICB8fCBkb21haW4gPT0gInlv dXR1YmUuY29tIgotICAgICAgICB8fCBkb21haW4uZW5kc1dpdGgoIi55b3V0dWJlLmNvbSIpCi0g ICAgICAgIHx8IGRvbWFpbiA9PSAiaHVsdS5jb20iCi0gICAgICAgIHx8IGRvbWFpbi5lbmRzV2l0 aCgiaHVsdS5jb20iKTsKKyAgICBhdXRvIGRvbWFpbiA9IFJlZ2lzdHJhYmxlRG9tYWluKG1fZG9j dW1lbnQtPnVybCgpKS5zdHJpbmcoKTsKKyAgICBtX2hhc0Jyb2tlbkVuY3J5cHRlZE1lZGlhQVBJ U3VwcG9ydFF1aXJrID0gZG9tYWluID09ICJzdGFyei5jb20iX3MgfHwgZG9tYWluID09ICJ5b3V0 dWJlLmNvbSJfcyB8fCBkb21haW4gPT0gImh1bHUuY29tIl9zOwogCiAgICAgcmV0dXJuIG1faGFz QnJva2VuRW5jcnlwdGVkTWVkaWFBUElTdXBwb3J0UXVpcmsudmFsdWUoKTsKIH0KQEAgLTgyMiw5 ICs4MTYsOCBAQCBib29sIFF1aXJrczo6bmVlZHNQcmVsb2FkQXV0b1F1aXJrKCkgY29uc3QKICAg ICBpZiAobV9uZWVkc1ByZWxvYWRBdXRvUXVpcmspCiAgICAgICAgIHJldHVybiBtX25lZWRzUHJl bG9hZEF1dG9RdWlyay52YWx1ZSgpOwogCi0gICAgYXV0byBkb21haW4gPSBtX2RvY3VtZW50LT5z ZWN1cml0eU9yaWdpbigpLmRvbWFpbigpLmNvbnZlcnRUb0FTQ0lJTG93ZXJjYXNlKCk7Ci0KLSAg ICBtX25lZWRzUHJlbG9hZEF1dG9RdWlyayA9IGRvbWFpbiA9PSAidmltZW8uY29tIiB8fCBkb21h aW4uZW5kc1dpdGgoInZpbWVvLmNvbSIpOworICAgIGF1dG8gZG9tYWluID0gUmVnaXN0cmFibGVE b21haW4obV9kb2N1bWVudC0+dXJsKCkpLnN0cmluZygpOworICAgIG1fbmVlZHNQcmVsb2FkQXV0 b1F1aXJrID0gZG9tYWluID09ICJ2aW1lbyJfczsKIAogICAgIHJldHVybiBtX25lZWRzUHJlbG9h ZEF1dG9RdWlyay52YWx1ZSgpOwogI2Vsc2UK 448803 2022-01-10 15:09:33 -0800 2022-01-10 15:43:46 -0800 Followup to fix typo bug-222130-20220110150932.patch text/plain 1446 eric.carlson U3VidmVyc2lvbiBSZXZpc2lvbjogMjg3ODYwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNDRlOWZlODNhYjlhOWM3 MzgyN2ZmZDFmNTI1YjdiNWZjZTNiNzljNS4uMmUwYWUxNTg5YmNhMTA5YjM2OGJhNjVhYTYwMWMz ZDZkZThhNTQ3OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDIyLTAxLTEwICBFcmlj IENhcmxzb24gIDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgorCisgICAgICAgIGhhc0Jyb2tlbkVu Y3J5cHRlZE1lZGlhQVBJU3VwcG9ydFF1aXJrIGFuZCBuZWVkc1ByZWxvYWRBdXRvUXVpcmsgaGF2 ZSBvdmVybHkgcGVybWlzc2l2ZSBkb21haW4gYWxsb3cgbGlzdHMKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMjEzMAorICAgICAgICA8cmRhcjovL3By b2JsZW0vNzQ3NTg1NjA+CisKKyAgICAgICAgVW5yZXZpZXdlZCwgZml4IHR5cG8gaW50cm9kdWNl ZCBpbiByMjg3ODU1LgorCisgICAgICAgICogcGFnZS9RdWlya3MuY3BwOgorICAgICAgICAoV2Vi Q29yZTo6UXVpcmtzOjpuZWVkc1ByZWxvYWRBdXRvUXVpcmsgY29uc3QpOiAidmltZW8iIHNob3Vs ZCBiZSAidmltZW8uY29tIi4KKwogMjAyMi0wMS0xMCAgV2Vuc29uIEhzaWVoICA8d2Vuc29uX2hz aWVoQGFwcGxlLmNvbT4KIAogICAgICAgICBNb2RhbCBjb250YWluZXIgb2JzZXJ2ZXIgc2hvdWxk IGNsYXNzaWZ5IGVsZW1lbnRzIHRoYXQgYXJlIHN0eWxlZCBsaWtlIGNsaWNrYWJsZSBjb250cm9s cwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9RdWlya3MuY3BwIGIvU291cmNlL1dl YkNvcmUvcGFnZS9RdWlya3MuY3BwCmluZGV4IDkzOGMwMmVmYjg4OGFjNTBmY2Y0MDMzOWIyOWZi MTE0MGRlZjNhYmEuLjczOGQ2ZDNiYjU5YWRkZDhlMjk0YTgzZDA3OWQzNTliMWY4NjQ1Y2QgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BhZ2UvUXVpcmtzLmNwcAorKysgYi9Tb3VyY2UvV2Vi Q29yZS9wYWdlL1F1aXJrcy5jcHAKQEAgLTgxNyw3ICs4MTcsNyBAQCBib29sIFF1aXJrczo6bmVl ZHNQcmVsb2FkQXV0b1F1aXJrKCkgY29uc3QKICAgICAgICAgcmV0dXJuIG1fbmVlZHNQcmVsb2Fk QXV0b1F1aXJrLnZhbHVlKCk7CiAKICAgICBhdXRvIGRvbWFpbiA9IFJlZ2lzdHJhYmxlRG9tYWlu KG1fZG9jdW1lbnQtPnVybCgpKS5zdHJpbmcoKTsKLSAgICBtX25lZWRzUHJlbG9hZEF1dG9RdWly ayA9IGRvbWFpbiA9PSAidmltZW8iX3M7CisgICAgbV9uZWVkc1ByZWxvYWRBdXRvUXVpcmsgPSBk b21haW4gPT0gInZpbWVvLmNvbSJfczsKIAogICAgIHJldHVybiBtX25lZWRzUHJlbG9hZEF1dG9R dWlyay52YWx1ZSgpOwogI2Vsc2UK