237100 2022-02-23 11:53:53 -0800 Restrict supported image decoding types when in CaptivePortal mode 2022-02-23 16:22:18 -0800 1 1 1 Unclassified WebKit WebKit Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED INVALID https://bugs.webkit.org/show_bug.cgi?id=237120 InRadar P2 Normal --- 1 bfulgham bfulgham bfulgham cdumez darin sabouhallawa webkit-bug-importer oldest_to_newest 1845248 0 bfulgham 2022-02-23 11:53:53 -0800 Adopt the CGImageSourceSetAllowableTypes SPI to prevent CoreGraphics from running image decoders for riskier image types. 1845249 1 webkit-bug-importer 2022-02-23 11:54:15 -0800 <rdar://problem/89369518> 1845254 2 453010 bfulgham 2022-02-23 12:02:30 -0800 Created attachment 453010 Patch 1845298 3 453023 bfulgham 2022-02-23 13:39:22 -0800 Created attachment 453023 Patch 1845337 4 453023 darin 2022-02-23 15:01:29 -0800 Comment on attachment 453023 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=453023&action=review > Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:248 > +#if HAVE(CGIMAGESOURCE_WITH_SET_ALLOWABLE_TYPES) > +static NSArray *UTITypes() > +{ > + return @[@"public.jpeg", > + @"public.png", > + @"org.webmproject.webp", > + @"com.compuserve.gif", > + ]; > +} > +#endif Does not seem like we need a separate function for this. NSArray *types = @[ @"public.jpeg", @"public.png", @"org.webmproject.webp", @"com.compuserve.gif", ]; auto status = CGImageSourceSetAllowableTypes(bridge_cast(types)); Could even use auto or constexpr. > Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm:255 > +#if HAVE(CGIMAGESOURCE_WITH_SET_ALLOWABLE_TYPES) I think we should format the #if differently. Strange to just check the boolean and then do nothing, so maybe we can put more of the function inside the #if, or put the #if at the call site too. 1845390 6 bfulgham 2022-02-23 15:58:13 -0800 See Bug 237120 for the actual issue. 1845410 7 bfulgham 2022-02-23 16:22:18 -0800 After reviewing this with the CoreGraphics/ImageIO team, we don't need to do this, as we have already adopted the necessary entitlements to limit decoders in Captive Portal mode. The cause of PDF images still appearing is a separate issue, which requires a different fix (see Bug 237120). 453010 2022-02-23 12:02:30 -0800 2022-02-23 13:39:19 -0800 Patch bug-237100-20220223120229.patch text/plain 2963 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjkwMzM4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGIxOWMwYTFiYTk5MWEyZTcz MWVkZjg5ZDZiNjNmNTg5NjQyYTk3YzAuLjUwN2IyYjRjZmRhMjIwYjU2NDdlNjczNDFlMzNhMGEy YTgwZTFmYWMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMjItMDItMjMgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgUmVzdHJpY3Qgc3VwcG9ydGVk IGltYWdlIGRlY29kaW5nIHR5cGVzIHdoZW4gaW4gQ2FwdGl2ZVBvcnRhbCBtb2RlCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzcxMDAKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzg5MzY5NTE4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEFkb3B0IHRoZSBDR0ltYWdlU291cmNlU2V0QWxsb3dhYmxlVHlw ZXMgU1BJIHdoZW4gbGF1bmNoaW5nIGluIGxvY2tkb3duIG1vZGUuCisKKyAgICAgICAgKiBXZWJQ cm9jZXNzL2NvY29hL1dlYlByb2Nlc3NDb2NvYS5tbToKKyAgICAgICAgKFdlYktpdDo6VVRJVHlw ZXMpOiBBZGRlZC4KKyAgICAgICAgKFdlYktpdDo6cmVzdHJpY3RJbWFnZVR5cGVzSWZOZWNlc3Nh cnkpOiBBZGRlZC4KKyAgICAgICAgKFdlYktpdDo6V2ViUHJvY2Vzczo6cGxhdGZvcm1Jbml0aWFs aXplV2ViUHJvY2Vzcyk6IENhbGwgbmV3IG1ldGhvZC4KKwogMjAyMi0wMi0yMiAgQnJlbnQgRnVs Z2hhbSAgPGJmdWxnaGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBQaW5nTG9hZGVyIGlzIGZhaWxp bmcgdG8gY2FsbCBjb21wbGV0aW9uIGhhbmRsZXIgaW4gZXJyb3IgY2FzZQpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvY29hL1dlYlByb2Nlc3NDb2NvYS5tbSBiL1NvdXJj ZS9XZWJLaXQvV2ViUHJvY2Vzcy9jb2NvYS9XZWJQcm9jZXNzQ29jb2EubW0KaW5kZXggYWFhZTk5 NGYzMjlhZjFjNzM0NTc4ZGU4NjllMzllZDgwNjUxMTJiMi4uY2YwNmVmMGZiMjJlNThkMGY5NjY3 MjQyN2ZlOThiNWI5NmFkZjVhZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9XZWJQcm9jZXNz L2NvY29hL1dlYlByb2Nlc3NDb2NvYS5tbQorKysgYi9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3Mv Y29jb2EvV2ViUHJvY2Vzc0NvY29hLm1tCkBAIC0xMTQsNiArMTE0LDEwIEBACiAjaW1wb3J0IDxK YXZhU2NyaXB0Q29yZS9SZW1vdGVJbnNwZWN0b3IuaD4KICNlbmRpZgogCisjaWYgSEFWRShDR0lN QUdFU09VUkNFX1dJVEhfU0VUX0FMTE9XQUJMRV9UWVBFUykKKyNpbXBvcnQgPHBhbC9zcGkvY2cv SW1hZ2VJT1NQSS5oPgorI2VuZGlmCisKICNpZiBQTEFURk9STShJT1NfRkFNSUxZKQogI2ltcG9y dCAiVUlLaXRTUEkuaCIKICNpbXBvcnQgPGJtYWxsb2MvTWVtb3J5U3RhdHVzU1BJLmg+CkBAIC0y MzIsMTIgKzIzNiwzOSBAQCBzdGF0aWMgQm9vbGVhbiBpc0FYQXV0aGVudGljYXRlZENhbGxiYWNr KGF1ZGl0X3Rva2VuX3QgYXVkaXRUb2tlbikKIH0KICNlbmRpZgogCisjaWYgSEFWRShDR0lNQUdF U09VUkNFX1dJVEhfU0VUX0FMTE9XQUJMRV9UWVBFUykKK3N0YXRpYyBOU0FycmF5ICpVVElUeXBl cygpCit7CisgICAgcmV0dXJuIEBbQCJwdWJsaWMuanBlZyIsCisgICAgICAgIEAicHVibGljLnBu ZyIsCisgICAgICAgIEAib3JnLndlYm1wcm9qZWN0LndlYnAiLAorICAgICAgICBAImNvbS5jb21w dXNlcnZlLmdpZiIsCisgICAgXTsKK30KKyNlbmRpZgorCitzdGF0aWMgdm9pZCByZXN0cmljdElt YWdlVHlwZXNJZk5lY2Vzc2FyeShjb25zdCBXZWJQcm9jZXNzQ3JlYXRpb25QYXJhbWV0ZXJzJiBw YXJhbWV0ZXJzKQoreworICAgIGlmICghcGFyYW1ldGVycy5pc0NhcHRpdmVQb3J0YWxNb2RlRW5h YmxlZCkKKyAgICAgICAgcmV0dXJuOworCisjaWYgSEFWRShDR0lNQUdFU09VUkNFX1dJVEhfU0VU X0FMTE9XQUJMRV9UWVBFUykKKyAgICBPU1N0YXR1cyBzdGF0dXMgPSBDR0ltYWdlU291cmNlU2V0 QWxsb3dhYmxlVHlwZXMoKF9fYnJpZGdlIENGQXJyYXlSZWYpVVRJVHlwZXMoKSk7CisgICAgaWYg KHN0YXR1cyAhPSBub0VycikKKyAgICAgICAgUkVMRUFTRV9MT0dfRVJST1IoUHJvY2VzcywgIlVu YWJsZSB0byBsaW1pdCBhbGxvd2FibGUgaW1hZ2UgdHlwZXMuIEVycm9yOiAlaSIsIHN0YXR1cyk7 CisgICAgUkVMRUFTRV9BU1NFUlQoc3RhdHVzID09IG5vRXJyKTsKKyAgICBSRUxFQVNFX0xPRyhQ cm9jZXNzLCAiUnVubmluZyB3aXRoIHJlc3RyaWN0ZWQgc2V0IG9mIHN1cHBvcnRlZCBpbWFnZSB0 eXBlcy4iKTsKKyNlbmRpZgorfQorCiB2b2lkIFdlYlByb2Nlc3M6OnBsYXRmb3JtSW5pdGlhbGl6 ZVdlYlByb2Nlc3MoV2ViUHJvY2Vzc0NyZWF0aW9uUGFyYW1ldGVycyYgcGFyYW1ldGVycykKIHsK ICAgICBhcHBseVByb2Nlc3NDcmVhdGlvblBhcmFtZXRlcnMocGFyYW1ldGVycy5hdXhpbGlhcnlQ cm9jZXNzUGFyYW1ldGVycyk7CiAKICAgICBzZXRRT1MocGFyYW1ldGVycy5sYXRlbmN5UU9TLCBw YXJhbWV0ZXJzLnRocm91Z2hwdXRRT1MpOwogICAgIAorICAgIHJlc3RyaWN0SW1hZ2VUeXBlc0lm TmVjZXNzYXJ5KHBhcmFtZXRlcnMpOworCiAjaWYgSEFWRShDQVRBTFlTVF9VU0VSX0lOVEVSRkFD RV9JRElPTV9BTkRfU0NBTEVfRkFDVE9SKQogICAgIGlmIChjYW5Mb2FkX1VJS2l0X19VSUFwcGxp Y2F0aW9uQ2F0YWx5c3RSZXF1ZXN0Vmlld1NlcnZpY2VJZGlvbUFuZFNjYWxlRmFjdG9yKCkpIHsK ICAgICAgICAgYXV0byBbb3ZlcnJpZGVVc2VySW50ZXJmYWNlSWRpb20sIG92ZXJyaWRlU2NhbGVG YWN0b3JdID0gcGFyYW1ldGVycy5vdmVycmlkZVVzZXJJbnRlcmZhY2VJZGlvbUFuZFNjYWxlOwo= 453023 2022-02-23 13:39:22 -0800 2022-02-23 15:01:29 -0800 Patch bug-237100-20220223133921.patch text/plain 2953 bfulgham U3VidmVyc2lvbiBSZXZpc2lvbjogMjkwMzg2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDU5ZDgxOWVmNDRjNjYzYTM5 ZjljZDMxOTcyMDk4ZTBlN2Q0MTNjMjMuLmUzZDg2MGFmYmQ1YWM5NmYwMjY4NTAwYjI0MDg1MDA2 OTliYjA0ZjIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMjItMDItMjMgIEJyZW50IEZ1 bGdoYW0gIDxiZnVsZ2hhbUBhcHBsZS5jb20+CisKKyAgICAgICAgUmVzdHJpY3Qgc3VwcG9ydGVk IGltYWdlIGRlY29kaW5nIHR5cGVzIHdoZW4gaW4gQ2FwdGl2ZVBvcnRhbCBtb2RlCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzcxMDAKKyAgICAgICAg PHJkYXI6Ly9wcm9ibGVtLzg5MzY5NTE4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIEFkb3B0IHRoZSBDR0ltYWdlU291cmNlU2V0QWxsb3dhYmxlVHlw ZXMgU1BJIHdoZW4gbGF1bmNoaW5nIGluIGxvY2tkb3duIG1vZGUuCisKKyAgICAgICAgKiBXZWJQ cm9jZXNzL2NvY29hL1dlYlByb2Nlc3NDb2NvYS5tbToKKyAgICAgICAgKFdlYktpdDo6VVRJVHlw ZXMpOiBBZGRlZC4KKyAgICAgICAgKFdlYktpdDo6cmVzdHJpY3RJbWFnZVR5cGVzSWZOZWNlc3Nh cnkpOiBBZGRlZC4KKyAgICAgICAgKFdlYktpdDo6V2ViUHJvY2Vzczo6cGxhdGZvcm1Jbml0aWFs aXplV2ViUHJvY2Vzcyk6IENhbGwgbmV3IG1ldGhvZC4KKwogMjAyMi0wMi0yMyAgSiBQYXNjb2Ug IDxqX3Bhc2NvZUBhcHBsZS5jb20+CiAKICAgICAgICAgUHJldmVudCB1c2Ugb2YgUERGS2l0IHdo ZW4gdXNpbmcgUERGLmpzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvY29j b2EvV2ViUHJvY2Vzc0NvY29hLm1tIGIvU291cmNlL1dlYktpdC9XZWJQcm9jZXNzL2NvY29hL1dl YlByb2Nlc3NDb2NvYS5tbQppbmRleCBhYWFlOTk0ZjMyOWFmMWM3MzQ1NzhkZTg2OWUzOWVkODA2 NTExMmIyLi4yNTdjZjUyOTkyYmIyNDY4YjU1NTc0MGU1YTFkMDQ3YzFlZDA0YjRlIDEwMDY0NAot LS0gYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvY29jb2EvV2ViUHJvY2Vzc0NvY29hLm1tCisr KyBiL1NvdXJjZS9XZWJLaXQvV2ViUHJvY2Vzcy9jb2NvYS9XZWJQcm9jZXNzQ29jb2EubW0KQEAg LTExNCw2ICsxMTQsMTAgQEAKICNpbXBvcnQgPEphdmFTY3JpcHRDb3JlL1JlbW90ZUluc3BlY3Rv ci5oPgogI2VuZGlmCiAKKyNpZiBIQVZFKENHSU1BR0VTT1VSQ0VfV0lUSF9TRVRfQUxMT1dBQkxF X1RZUEVTKQorI2ltcG9ydCA8cGFsL3NwaS9jZy9JbWFnZUlPU1BJLmg+CisjZW5kaWYKKwogI2lm IFBMQVRGT1JNKElPU19GQU1JTFkpCiAjaW1wb3J0ICJVSUtpdFNQSS5oIgogI2ltcG9ydCA8Ym1h bGxvYy9NZW1vcnlTdGF0dXNTUEkuaD4KQEAgLTIzMiwxMiArMjM2LDM5IEBAIHN0YXRpYyBCb29s ZWFuIGlzQVhBdXRoZW50aWNhdGVkQ2FsbGJhY2soYXVkaXRfdG9rZW5fdCBhdWRpdFRva2VuKQog fQogI2VuZGlmCiAKKyNpZiBIQVZFKENHSU1BR0VTT1VSQ0VfV0lUSF9TRVRfQUxMT1dBQkxFX1RZ UEVTKQorc3RhdGljIE5TQXJyYXkgKlVUSVR5cGVzKCkKK3sKKyAgICByZXR1cm4gQFtAInB1Ymxp Yy5qcGVnIiwKKyAgICAgICAgQCJwdWJsaWMucG5nIiwKKyAgICAgICAgQCJvcmcud2VibXByb2pl Y3Qud2VicCIsCisgICAgICAgIEAiY29tLmNvbXB1c2VydmUuZ2lmIiwKKyAgICBdOworfQorI2Vu ZGlmCisKK3N0YXRpYyB2b2lkIHJlc3RyaWN0SW1hZ2VUeXBlc0lmTmVjZXNzYXJ5KGNvbnN0IFdl YlByb2Nlc3NDcmVhdGlvblBhcmFtZXRlcnMmIHBhcmFtZXRlcnMpCit7CisgICAgaWYgKCFwYXJh bWV0ZXJzLmlzQ2FwdGl2ZVBvcnRhbE1vZGVFbmFibGVkKQorICAgICAgICByZXR1cm47CisKKyNp ZiBIQVZFKENHSU1BR0VTT1VSQ0VfV0lUSF9TRVRfQUxMT1dBQkxFX1RZUEVTKQorICAgIE9TU3Rh dHVzIHN0YXR1cyA9IENHSW1hZ2VTb3VyY2VTZXRBbGxvd2FibGVUeXBlcygoX19icmlkZ2UgQ0ZB cnJheVJlZilVVElUeXBlcygpKTsKKyAgICBpZiAoc3RhdHVzICE9IG5vRXJyKQorICAgICAgICBS RUxFQVNFX0xPR19FUlJPUihQcm9jZXNzLCAiVW5hYmxlIHRvIGxpbWl0IGFsbG93YWJsZSBpbWFn ZSB0eXBlcy4gRXJyb3I6ICVpIiwgc3RhdGljX2Nhc3Q8aW50PihzdGF0dXMpKTsKKyAgICBSRUxF QVNFX0FTU0VSVChzdGF0dXMgPT0gbm9FcnIpOworICAgIFJFTEVBU0VfTE9HKFByb2Nlc3MsICJS dW5uaW5nIHdpdGggcmVzdHJpY3RlZCBzZXQgb2Ygc3VwcG9ydGVkIGltYWdlIHR5cGVzLiIpOwor I2VuZGlmCit9CisKIHZvaWQgV2ViUHJvY2Vzczo6cGxhdGZvcm1Jbml0aWFsaXplV2ViUHJvY2Vz cyhXZWJQcm9jZXNzQ3JlYXRpb25QYXJhbWV0ZXJzJiBwYXJhbWV0ZXJzKQogewogICAgIGFwcGx5 UHJvY2Vzc0NyZWF0aW9uUGFyYW1ldGVycyhwYXJhbWV0ZXJzLmF1eGlsaWFyeVByb2Nlc3NQYXJh bWV0ZXJzKTsKIAogICAgIHNldFFPUyhwYXJhbWV0ZXJzLmxhdGVuY3lRT1MsIHBhcmFtZXRlcnMu dGhyb3VnaHB1dFFPUyk7CiAgICAgCisgICAgcmVzdHJpY3RJbWFnZVR5cGVzSWZOZWNlc3Nhcnko cGFyYW1ldGVycyk7CisKICNpZiBIQVZFKENBVEFMWVNUX1VTRVJfSU5URVJGQUNFX0lESU9NX0FO RF9TQ0FMRV9GQUNUT1IpCiAgICAgaWYgKGNhbkxvYWRfVUlLaXRfX1VJQXBwbGljYXRpb25DYXRh bHlzdFJlcXVlc3RWaWV3U2VydmljZUlkaW9tQW5kU2NhbGVGYWN0b3IoKSkgewogICAgICAgICBh dXRvIFtvdmVycmlkZVVzZXJJbnRlcmZhY2VJZGlvbSwgb3ZlcnJpZGVTY2FsZUZhY3Rvcl0gPSBw YXJhbWV0ZXJzLm92ZXJyaWRlVXNlckludGVyZmFjZUlkaW9tQW5kU2NhbGU7Cg==