51097 2010-12-15 00:09:47 -0800 Primordial privilege escalation from bad this-coercion 2011-07-20 19:18:52 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED DUPLICATE 64250 InRadar P1 Major --- 0 erights webkit-unassigned barraclough erights ggaren jwalden+bwo oliver oldest_to_newest 322527 0 erights 2010-12-15 00:09:47 -0800 To avoid privilege escalation bugs by global object leakage, ES5 repaired Ch15 to coerce the this-bindings of its methods by "ToObject". Thus, primitive values wrap but null and undefined throw an exception instead. For example, 15.4.4.10 Array.prototype.slice step 1 says: 1. Let O be the result of calling ToObject passing the this value as the argument. However, on WebKit nightly (Safari Version 5.0.1 (5533.17.8, r73886)) window[0] = 'a'; window[1] = 'b'; window[2] = 'c'; window.length = 3; [].slice.call(null, 0); // prints a,b,c showing that slice still leaks access to the global object. Even though this is a security bug, I have entered this as a WebKit bug, not a security bug, because no released Safari yet implements ES5, so there is time to fix this before it causes harm. See also https://bugzilla.mozilla.org/show_bug.cgi?id=619283 337723 1 ap 2011-01-20 16:57:41 -0800 <rdar://problem/8895966> 391517 2 90865 erights 2011-04-23 19:06:08 -0700 Created attachment 90865 'valueOf()' in a script tag still does bad this coercion The attachment should alert 'ok' and does so correctly on FF4. On Safari Version 5.0.4 (5533.20.27, r84622) it alerts 'bad value: [object DOMWindow]' instead. Should this case be reported as part of this bug 51097, or should I file a distinct bug? See https://bugzilla.mozilla.org/show_bug.cgi?id=652375 417338 3 erights 2011-06-08 10:40:59 -0700 Should this be merged with https://bugs.webkit.org/show_bug.cgi?id=58338 ? 440191 4 barraclough 2011-07-20 19:18:52 -0700 *** This bug has been marked as a duplicate of bug 64250 *** 90865 2011-04-23 19:06:08 -0700 2011-04-23 19:06:08 -0700 'valueOf()' in a script tag still does bad this coercion implicit-this.html text/html 205 erights PCFkb2N0eXBlIGh0bWw+Cjxib2R5PjxzY3JpcHQ+CiB0cnkgeyAKICAgYWxlcnQoJ2JhZCB2YWx1 ZTogJyArIHZhbHVlT2YoKSk7IAogfSBjYXRjaCAoZXJyKSB7CiAgIGlmIChlcnIgaW5zdGFuY2Vv ZiBUeXBlRXJyb3IpIHsgYWxlcnQoJ29rJyk7IAogICB9IGVsc2UgeyBhbGVydCgnYmFkIHRocm93 OiAnICsgZXJyKTsgfQogfQo8L3NjcmlwdD48L2JvZHk+Cg==