283771 2024-11-27 13:49:51 -0800 [Streams API] Commit pull-into descriptors after filling from queue 2024-12-04 13:50:25 -0800 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 mattias.buelens webkit-unassigned webkit-bug-importer oldest_to_newest 2077933 0 mattias.buelens 2024-11-27 13:49:51 -0800 In GHSA-p5g2-876g-95h9, we discovered that in Chromium, a user could run JavaScript code *synchronously* during `ReadableStreamFulfillReadIntoRequest` by patching `Object.prototype.then`, and use this gadget to break some invariants within `ReadableByteStreamControllerProcessPullIntoDescriptorsUsingQueue`. Fortunately, Safari seems unaffected, see https://github.com/whatwg/streams/security/advisories/GHSA-p5g2-876g-95h9#advisory-comment-109294. The Streams standard has been updated with a proper fix for this case. We now postpone all calls to `ReadableByteStreamControllerCommitPullIntoDescriptor` until *after* all pull-into descriptors have been filled up by `ReadableByteStreamControllerProcessPullIntoDescriptorsUsingQueue`. This way, we won't trigger any patched `then()` method until the stream is in a stable state. * Original report: https://github.com/whatwg/streams/security/advisories/GHSA-p5g2-876g-95h9 * Specification change: https://github.com/whatwg/streams/pull/1326 * WPT tests: https://github.com/web-platform-tests/wpt/pull/48085 2079203 1 webkit-bug-importer 2024-12-04 13:50:25 -0800 <rdar://problem/140936151>