37392 2010-04-10 15:22:54 -0700 Run the SVG <img> rendering context in a unique origin as a defense in depth measure 2010-04-10 23:57:33 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 1 scarybeasts webkit-unassigned abarth commit-queue darin oldest_to_newest 211199 0 scarybeasts 2010-04-10 15:22:54 -0700 Patch forthcoming. 211211 1 53058 scarybeasts 2010-04-10 16:22:16 -0700 Created attachment 53058 Simple defense-in-depth patch. 211212 2 scarybeasts 2010-04-10 16:22:48 -0700 I've not found a concrete problem due to this, but the area makes me nervous enough to have created this patch. 211226 3 53058 abarth 2010-04-10 16:51:57 -0700 Comment on attachment 53058 Simple defense-in-depth patch. That method on FrameLoader is very sketchy. Can't we operate on the SecurityOrigin directly? That won't be overridden in any funny ways. 211234 4 scarybeasts 2010-04-10 17:25:20 -0700 The only way I can see for the sandbox flags on the FrameLoader to get overridden is if a parent HTMLFrameElement changes state. This will never happen to our temporary SVG loader, which has an SVG document at the root :) I like doing this on the FrameLoader because any other origins created from it will also inherit the same sandboxing state. For example, an SVG could contain an html:iframe element[*]. If we do a one-off patch up on the SecurityOrigin, I worry that a complicated & clever SVG could bypass it. [*] - this is pretty ugly in the <img> context. I may be changing things here, but for now we should assume these uglies exist. 211238 5 abarth 2010-04-10 17:27:23 -0700 Ah good, point. I'm worried that other consumers of this API will get confused. Can we make this a new bit field that always gets applied to the "natural" sandbox policy? That way it could survive updates. 211257 6 53065 scarybeasts 2010-04-10 18:40:16 -0700 Created attachment 53065 Add new bitmap to make forced flags more sturdy :) 211266 7 53065 abarth 2010-04-10 20:38:27 -0700 Comment on attachment 53065 Add new bitmap to make forced flags more sturdy :) Very nice. 211275 8 scarybeasts 2010-04-10 20:59:52 -0700 Can you cq+ it? I don't think my WebKit committer paperwork was processed yet ;-) 211288 9 53065 commit-queue 2010-04-10 22:17:10 -0700 Comment on attachment 53065 Add new bitmap to make forced flags more sturdy :) Clearing flags on attachment: 53065 Committed r57438: <http://trac.webkit.org/changeset/57438> 211289 10 commit-queue 2010-04-10 22:17:15 -0700 All reviewed patches have been landed. Closing bug. 211311 11 darin 2010-04-10 23:13:52 -0700 I suggest calling these "forced sandbox flags" in the code, not "force sandbox flags". Maybe the names you ended up using in the patch were a typo? 211323 12 abarth 2010-04-10 23:57:33 -0700 Fixed in http://trac.webkit.org/changeset/57445 53058 2010-04-10 16:22:16 -0700 2010-04-10 18:40:16 -0700 Simple defense-in-depth patch. svgorigin.diff text/plain 2104 scarybeasts SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1NzI4NikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTkgQEAKKzIwMTAtMDQtMTAgIENocmlzIEV2YW5zICA8Y2V2YW5zQGNocm9taXVt Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBE ZWZlbnNlIGluIGRlcHRoOiBtYWtlIHN1cmUgYW4gU1ZHIGRvY3VtZW50IGluIHRoZSA8aW1nPiBj b250ZXh0IGhhcworICAgICAgICBhIHVuaXF1ZSBvcmlnaW4uCisKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM3MzkyCisKKyAgICAgICAgKiBzdmcvZ3Jh cGhpY3MvU1ZHSW1hZ2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6U1ZHSW1hZ2U6OmRhdGFDaGFu Z2VkKToKKyAgICAgICAgICBGb3JjZSB0aGUgdGVtcG9yYXJ5IHJlbmRlcmluZyBjb250ZXh0IGlu dG8gYSB1bmlxdWUgb3JpZ2luLgorICAgICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5oOgorICAg ICAgICAoV2ViQ29yZTo6RnJhbWVMb2FkZXI6OnNldFNhbmRib3hGbGFncyk6CisgICAgICAgICAg U3VwcG9ydCBmb3Igc2V0dGluZyBzYW5kYm94IGZsYWdzLgorCiAyMDEwLTAzLTMwICBEdW1pdHJ1 IERhbmlsaXVjICA8ZHVtaUBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGlt aXRyaSBHbGF6a292LgpJbmRleDogV2ViQ29yZS9zdmcvZ3JhcGhpY3MvU1ZHSW1hZ2UuY3BwCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFdlYkNvcmUvc3ZnL2dyYXBoaWNzL1NWR0ltYWdlLmNwcAkocmV2aXNpb24g NTcyODYpCisrKyBXZWJDb3JlL3N2Zy9ncmFwaGljcy9TVkdJbWFnZS5jcHAJKHdvcmtpbmcgY29w eSkKQEAgLTI1NSw2ICsyNTUsNyBAQAogICAgICAgICBmcmFtZS0+aW5pdCgpOwogICAgICAgICBS ZXNvdXJjZVJlcXVlc3QgZmFrZVJlcXVlc3QoS1VSTChQYXJzZWRVUkxTdHJpbmcsICIiKSk7CiAg ICAgICAgIEZyYW1lTG9hZGVyKiBsb2FkZXIgPSBmcmFtZS0+bG9hZGVyKCk7CisgICAgICAgIGxv YWRlci0+c2V0U2FuZGJveEZsYWdzKFNhbmRib3hBbGwpOwogICAgICAgICBsb2FkZXItPmxvYWQo ZmFrZVJlcXVlc3QsIGZhbHNlKTsgLy8gTWFrZSBzdXJlIHRoZSBEb2N1bWVudExvYWRlciBpcyBj cmVhdGVkCiAgICAgICAgIGxvYWRlci0+cG9saWN5Q2hlY2tlcigpLT5jYW5jZWxDaGVjaygpOyAv LyBjYW5jZWwgYW55IHBvbGljeSBjaGVja3MKICAgICAgICAgbG9hZGVyLT5jb21taXRQcm92aXNp b25hbExvYWQoMCk7CkluZGV4OiBXZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5oCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFdlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmgJKHJldmlzaW9uIDU3Mjg2KQorKysg V2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuaAkod29ya2luZyBjb3B5KQpAQCAtMjU5LDYgKzI1 OSw5IEBACiAKICAgICBib29sIGlzU2FuZGJveGVkKFNhbmRib3hGbGFncyBtYXNrKSBjb25zdCB7 IHJldHVybiBtX3NhbmRib3hGbGFncyAmIG1hc2s7IH0KICAgICBTYW5kYm94RmxhZ3Mgc2FuZGJv eEZsYWdzKCkgY29uc3QgeyByZXR1cm4gbV9zYW5kYm94RmxhZ3M7IH0KKyAgICAvLyBXYXJuaW5n IC0gd2lsbCBiZSBvdmVycmlkZGVuIGJ5IGluaXQoKSwgb3IgYSBjaGFuZ2Ugb2YgYW55IHBhcmVu dAorICAgIC8vIGZyYW1lIHNhbmRib3ggYXR0cmlidXRlLgorICAgIHZvaWQgc2V0U2FuZGJveEZs YWdzKFNhbmRib3hGbGFncyBmbGFncykgeyBtX3NhbmRib3hGbGFncyA9IGZsYWdzOyB9CiAKICAg ICAvLyBNaXhlZCBjb250ZW50IHJlbGF0ZWQgZnVuY3Rpb25zLgogICAgIHN0YXRpYyBib29sIGlz TWl4ZWRDb250ZW50KFNlY3VyaXR5T3JpZ2luKiBjb250ZXh0LCBjb25zdCBLVVJMJik7Cg== 53065 2010-04-10 18:40:16 -0700 2010-04-10 22:17:10 -0700 Add new bitmap to make forced flags more sturdy :) svgorigin2.diff text/plain 3307 scarybeasts SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1NzI4NikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjIgQEAKKzIwMTAtMDQtMTAgIENocmlzIEV2YW5zICA8Y2V2YW5zQGNocm9taXVt Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBE ZWZlbnNlIGluIGRlcHRoOiBtYWtlIHN1cmUgYW4gU1ZHIGRvY3VtZW50IGluIHRoZSA8aW1nPiBj b250ZXh0IGhhcworICAgICAgICBhIHVuaXF1ZSBvcmlnaW4uCisKKyAgICAgICAgaHR0cHM6Ly9i dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM3MzkyCisKKyAgICAgICAgKiBzdmcvZ3Jh cGhpY3MvU1ZHSW1hZ2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6U1ZHSW1hZ2U6OmRhdGFDaGFu Z2VkKToKKyAgICAgICAgICBGb3JjZSB0aGUgdGVtcG9yYXJ5IHJlbmRlcmluZyBjb250ZXh0IGlu dG8gYSB1bmlxdWUgb3JpZ2luLgorICAgICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5oOgorICAg ICAgICAoV2ViQ29yZTo6RnJhbWVMb2FkZXI6OnNldEZvcmNlU2FuZGJveEZsYWdzKToKKyAgICAg ICAgICBTdXBwb3J0IGZvciBzZXR0aW5nIHNhbmRib3ggZmxhZ3MgdGhhdCB3aWxsIGFsd2F5cyBi ZSBhcHBsaWVkLgorICAgICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5jcHA6CisgICAgICAgIChX ZWJDb3JlOjpGcmFtZUxvYWRlcjo6dXBkYXRlU2FuZGJveEZsYWdzKToKKyAgICAgICAgICBBbHdh eXMgYXBwbHkgYW55IGZvcmNlZCBmbGFncy4KKwogMjAxMC0wMy0zMCAgRHVtaXRydSBEYW5pbGl1 YyAgPGR1bWlAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERpbWl0cmkgR2xh emtvdi4KSW5kZXg6IFdlYkNvcmUvc3ZnL2dyYXBoaWNzL1NWR0ltYWdlLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBXZWJDb3JlL3N2Zy9ncmFwaGljcy9TVkdJbWFnZS5jcHAJKHJldmlzaW9uIDU3Mjg2KQor KysgV2ViQ29yZS9zdmcvZ3JhcGhpY3MvU1ZHSW1hZ2UuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0y NTUsNiArMjU1LDcgQEAKICAgICAgICAgZnJhbWUtPmluaXQoKTsKICAgICAgICAgUmVzb3VyY2VS ZXF1ZXN0IGZha2VSZXF1ZXN0KEtVUkwoUGFyc2VkVVJMU3RyaW5nLCAiIikpOwogICAgICAgICBG cmFtZUxvYWRlciogbG9hZGVyID0gZnJhbWUtPmxvYWRlcigpOworICAgICAgICBsb2FkZXItPnNl dEZvcmNlU2FuZGJveEZsYWdzKFNhbmRib3hBbGwpOwogICAgICAgICBsb2FkZXItPmxvYWQoZmFr ZVJlcXVlc3QsIGZhbHNlKTsgLy8gTWFrZSBzdXJlIHRoZSBEb2N1bWVudExvYWRlciBpcyBjcmVh dGVkCiAgICAgICAgIGxvYWRlci0+cG9saWN5Q2hlY2tlcigpLT5jYW5jZWxDaGVjaygpOyAvLyBj YW5jZWwgYW55IHBvbGljeSBjaGVja3MKICAgICAgICAgbG9hZGVyLT5jb21taXRQcm92aXNpb25h bExvYWQoMCk7CkluZGV4OiBXZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3BwCShyZXZpc2lvbiA1NzI4NikKKysr IFdlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjAzLDYg KzIwMyw3IEBACiAgICAgLCBtX2xvYWRpbmdGcm9tQ2FjaGVkUGFnZShmYWxzZSkKICAgICAsIG1f c3VwcHJlc3NPcGVuZXJJbk5ld0ZyYW1lKGZhbHNlKQogICAgICwgbV9zYW5kYm94RmxhZ3MoU2Fu ZGJveEFsbCkKKyAgICAsIG1fZm9yY2VTYW5kYm94RmxhZ3MoU2FuZGJveE5vbmUpCiAjaWZuZGVm IE5ERUJVRwogICAgICwgbV9kaWREaXNwYXRjaERpZENvbW1pdExvYWQoZmFsc2UpCiAjZW5kaWYK QEAgLTQwMDcsNyArNDAwOCw3IEBACiAKIHZvaWQgRnJhbWVMb2FkZXI6OnVwZGF0ZVNhbmRib3hG bGFncygpCiB7Ci0gICAgU2FuZGJveEZsYWdzIGZsYWdzID0gU2FuZGJveE5vbmU7CisgICAgU2Fu ZGJveEZsYWdzIGZsYWdzID0gbV9mb3JjZVNhbmRib3hGbGFnczsKICAgICBpZiAoRnJhbWUqIHBh cmVudEZyYW1lID0gbV9mcmFtZS0+dHJlZSgpLT5wYXJlbnQoKSkKICAgICAgICAgZmxhZ3MgfD0g cGFyZW50RnJhbWUtPmxvYWRlcigpLT5zYW5kYm94RmxhZ3MoKTsKICAgICBpZiAoSFRNTEZyYW1l T3duZXJFbGVtZW50KiBvd25lckVsZW1lbnQgPSBtX2ZyYW1lLT5vd25lckVsZW1lbnQoKSkKSW5k ZXg6IFdlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmgKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9s b2FkZXIvRnJhbWVMb2FkZXIuaAkocmV2aXNpb24gNTcyODYpCisrKyBXZWJDb3JlL2xvYWRlci9G cmFtZUxvYWRlci5oCSh3b3JraW5nIGNvcHkpCkBAIC0yNTksNiArMjU5LDkgQEAKIAogICAgIGJv b2wgaXNTYW5kYm94ZWQoU2FuZGJveEZsYWdzIG1hc2spIGNvbnN0IHsgcmV0dXJuIG1fc2FuZGJv eEZsYWdzICYgbWFzazsgfQogICAgIFNhbmRib3hGbGFncyBzYW5kYm94RmxhZ3MoKSBjb25zdCB7 IHJldHVybiBtX3NhbmRib3hGbGFnczsgfQorICAgIC8vIFRoZSBmb2xsb3dpbmcgc2FuZGJveCBm bGFncyB3aWxsIGJlIGZvcmNlZCwgcmVnYXJkbGVzcyBvZiBjaGFuZ2VzIHRvCisgICAgLy8gdGhl IHNhbmRib3ggYXR0cmlidXRlIG9mIGFueSBwYXJlbnQgZnJhbWVzLgorICAgIHZvaWQgc2V0Rm9y Y2VTYW5kYm94RmxhZ3MoU2FuZGJveEZsYWdzIGZsYWdzKSB7IG1fZm9yY2VTYW5kYm94RmxhZ3Mg PSBmbGFnczsgbV9zYW5kYm94RmxhZ3MgfD0gZmxhZ3M7IH0KIAogICAgIC8vIE1peGVkIGNvbnRl bnQgcmVsYXRlZCBmdW5jdGlvbnMuCiAgICAgc3RhdGljIGJvb2wgaXNNaXhlZENvbnRlbnQoU2Vj dXJpdHlPcmlnaW4qIGNvbnRleHQsIGNvbnN0IEtVUkwmKTsKQEAgLTUzMCw2ICs1MzMsNyBAQAog ICAgIGJvb2wgbV9zdXBwcmVzc09wZW5lckluTmV3RnJhbWU7CiAgICAgCiAgICAgU2FuZGJveEZs YWdzIG1fc2FuZGJveEZsYWdzOworICAgIFNhbmRib3hGbGFncyBtX2ZvcmNlU2FuZGJveEZsYWdz OwogCiAjaWZuZGVmIE5ERUJVRwogICAgIGJvb2wgbV9kaWREaXNwYXRjaERpZENvbW1pdExvYWQ7 Cg==