60791 2011-05-13 13:03:12 -0700 Use AVAssetReferenceRestrictions to prevent cross site media references 2011-06-03 14:04:57 -0700 1 1 1 Unclassified WebKit Media 528+ (Nightly build) Mac Unspecified RESOLVED FIXED InRadar, PlatformOnly P2 Normal --- 1 eric.carlson eric.carlson ademar simon.fraser oldest_to_newest 403773 0 eric.carlson 2011-05-13 13:03:12 -0700 The AVFoundation media engine should be configured to disallow cross site media references. <rdar://problem/9374202> 403797 1 93499 eric.carlson 2011-05-13 13:28:50 -0700 Created attachment 93499 Proposed patch. 404181 2 93499 eric.carlson 2011-05-15 09:19:32 -0700 Comment on attachment 93499 Proposed patch. This was reviewed by Maciej. 404182 3 eric.carlson 2011-05-15 09:19:50 -0700 http://trac.webkit.org/changeset/86506 404192 4 simon.fraser 2011-05-15 10:30:40 -0700 The new test is failing on Leopard and SnowLeopard. 404193 5 eric.carlson 2011-05-15 10:37:23 -0700 (In reply to comment #4) > The new test is failing on Leopard and SnowLeopard. Looks OK on Leopard so far. Added to SL skipped list in http://trac.webkit.org/changeset/86508. 415174 6 ademar 2011-06-03 14:04:57 -0700 Revision r86506 cherry-picked into qtwebkit-2.2 with commit a4f1520 <http://gitorious.org/webkit/qtwebkit/commit/a4f1520> 93499 2011-05-13 13:28:50 -0700 2011-05-15 09:19:32 -0700 Proposed patch. patch_4.txt text/plain 7490 eric.carlson SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDg2NDU2KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDUtMTMgIEVyaWMgQ2Fy bHNvbiAgPGVyaWMuY2FybHNvbkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgVXNlIG5ldyBBVkFzc2V0UmVmZXJlbmNlUmVzdHJpY3Rp b25zIHRvIHByZXZlbnQgY3Jvc3Mgc2l0ZSBtZWRpYSByZWZlcmVuY2VzCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02MDc5MQorCisgICAgICAgIFRlc3Q6 IGh0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jvc3Mtc2l0ZS5odG1sCisKKyAgICAgICAgKiBwbGF0 Zm9ybS9ncmFwaGljcy9hdmZvdW5kYXRpb24vTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0aW9u T2JqQy5tbToKKyAgICAgICAgKFdlYkNvcmU6Ok1lZGlhUGxheWVyUHJpdmF0ZUFWRm91bmRhdGlv bk9iakM6OmNyZWF0ZUFWQXNzZXRGb3JVUkwpOiBTZXQgbmV3IHJlc3RyaWN0aW9uCisgICAgICAg ICAgICB0byBwcmV2ZW50IGNyb3NzLWRvbWFpbiByZWZlcmVuY2VzIGZyb20gYmVpbmcgZm9sbG93 ZWQuCisKIDIwMTEtMDUtMTMgIEFkYW0gUm9iZW4gIDxhcm9iZW5AYXBwbGUuY29tPgogCiAgICAg ICAgIEZpeCBtYW51YWwgdGVzdHMgdGhhdCBnb3QgYnJva2VuIGJ5IHRoZSBtb3ZlIG9mIFdlYkNv cmUgaW50byBTb3VyY2UKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2F2 Zm91bmRhdGlvbi9NZWRpYVBsYXllclByaXZhdGVBVkZvdW5kYXRpb25PYmpDLm1tCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2F2Zm91bmRhdGlvbi9NZWRp YVBsYXllclByaXZhdGVBVkZvdW5kYXRpb25PYmpDLm1tCShyZXZpc2lvbiA4NjM1NCkKKysrIFNv dXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2F2Zm91bmRhdGlvbi9NZWRpYVBsYXllclBy aXZhdGVBVkZvdW5kYXRpb25PYmpDLm1tCSh3b3JraW5nIGNvcHkpCkBAIC02Nyw2ICs2Nyw3IEBA IFNPRlRfTElOS19QT0lOVEVSKEFWRm91bmRhdGlvbiwgQVZNZWRpYVQKIFNPRlRfTElOS19QT0lO VEVSKEFWRm91bmRhdGlvbiwgQVZNZWRpYVR5cGVBdWRpbywgTlNTdHJpbmcgKikKIFNPRlRfTElO S19QT0lOVEVSKEFWRm91bmRhdGlvbiwgQVZQbGF5ZXJJdGVtRGlkUGxheVRvRW5kVGltZU5vdGlm aWNhdGlvbiwgTlNTdHJpbmcgKikKIFNPRlRfTElOS19QT0lOVEVSKEFWRm91bmRhdGlvbiwgQVZB c3NldEltYWdlR2VuZXJhdG9yQXBlcnR1cmVNb2RlQ2xlYW5BcGVydHVyZSwgTlNTdHJpbmcgKikK K1NPRlRfTElOS19QT0lOVEVSKEFWRm91bmRhdGlvbiwgQVZVUkxBc3NldFJlZmVyZW5jZVJlc3Ry aWN0aW9uc0tleSwgTlNTdHJpbmcgKikKIAogU09GVF9MSU5LX0NPTlNUQU5UKENvcmVNZWRpYSwg a0NNVGltZVplcm8sIENNVGltZSkKIApAQCAtODMsNiArODQsNyBAQCBTT0ZUX0xJTktfQ09OU1RB TlQoQ29yZU1lZGlhLCBrQ01UaW1lWmVyCiAjZGVmaW5lIEFWTWVkaWFUeXBlQXVkaW8gZ2V0QVZN ZWRpYVR5cGVBdWRpbygpCiAjZGVmaW5lIEFWUGxheWVySXRlbURpZFBsYXlUb0VuZFRpbWVOb3Rp ZmljYXRpb24gZ2V0QVZQbGF5ZXJJdGVtRGlkUGxheVRvRW5kVGltZU5vdGlmaWNhdGlvbigpCiAj ZGVmaW5lIEFWQXNzZXRJbWFnZUdlbmVyYXRvckFwZXJ0dXJlTW9kZUNsZWFuQXBlcnR1cmUgZ2V0 QVZBc3NldEltYWdlR2VuZXJhdG9yQXBlcnR1cmVNb2RlQ2xlYW5BcGVydHVyZSgpCisjZGVmaW5l IEFWVVJMQXNzZXRSZWZlcmVuY2VSZXN0cmljdGlvbnNLZXkgZ2V0QVZVUkxBc3NldFJlZmVyZW5j ZVJlc3RyaWN0aW9uc0tleSgpCiAKICNkZWZpbmUga0NNVGltZVplcm8gZ2V0a0NNVGltZVplcm8o KQogCkBAIC0yNTMsOCArMjU1LDEyIEBAIHZvaWQgTWVkaWFQbGF5ZXJQcml2YXRlQVZGb3VuZGF0 aW9uT2JqQzoKIAogICAgIHNldERlbGF5Q2FsbGJhY2tzKHRydWUpOwogCisgICAgTlNEaWN0aW9u YXJ5ICpvcHRpb25zID0gW05TRGljdGlvbmFyeSBkaWN0aW9uYXJ5V2l0aE9iamVjdHNBbmRLZXlz OgorICAgICAgICAgICAgICAgICAgICAgICAgW05TTnVtYmVyIG51bWJlcldpdGhJbnQ6QVZBc3Nl dFJlZmVyZW5jZVJlc3RyaWN0aW9uRm9yYmlkQ3Jvc3NTaXRlUmVmZXJlbmNlXSwgQVZVUkxBc3Nl dFJlZmVyZW5jZVJlc3RyaWN0aW9uc0tleSwgCisgICAgICAgICAgICAgICAgICAgICAgICBuaWxd OwogICAgIE5TVVJMICpjb2NvYVVSTCA9IEtVUkwoUGFyc2VkVVJMU3RyaW5nLCB1cmwpOwotICAg IG1fYXZBc3NldC5hZG9wdE5TKFtbQVZVUkxBc3NldCBhbGxvY10gaW5pdFdpdGhVUkw6Y29jb2FV Ukwgb3B0aW9uczpuaWxdKTsKKyAgICBtX2F2QXNzZXQuYWRvcHROUyhbW0FWVVJMQXNzZXQgYWxs b2NdIGluaXRXaXRoVVJMOmNvY29hVVJMIG9wdGlvbnM6b3B0aW9uc10pOworCiAgICAgbV9oYXZl Q2hlY2tlZFBsYXlhYmlsaXR5ID0gZmFsc2U7CiAKICAgICBzZXREZWxheUNhbGxiYWNrcyhmYWxz ZSk7CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCShyZXZpc2lvbiA4NjQ1NikKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwko d29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDExLTA1LTEzICBFcmljIENhcmxzb24g IDxlcmljLmNhcmxzb25AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIFVzZSBuZXcgQVZBc3NldFJlZmVyZW5jZVJlc3RyaWN0aW9ucyB0 byBwcmV2ZW50IGNyb3NzIHNpdGUgbWVkaWEgcmVmZXJlbmNlcworICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NjA3OTEKKworICAgICAgICBBZGQgdGVzdCBm b3IgY3Jvc3MtZG9tYWluIFF1aWNrVGltZSByZWZlcmVuY2UgbW92aWUgYW5kIHRlc3QuCisKKyAg ICAgICAgKiBodHRwL3Rlc3RzL21lZGlhL3Jlc291cmNlcy9jcm9zcy1zaXRlLXJlZmVyZW5jZS5t b3Y6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jvc3Mtc2l0ZS1l eHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jv c3Mtc2l0ZS5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBwbGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4 cGVjdGF0aW9ucy50eHQ6IFNraXBwZWQsIFF1aWNrVGltZSByZWZlcmVuY2UgbW92aWVzIG5vdCBz dXBwb3J0ZWQuCisgICAgICAgICogcGxhdGZvcm0vZ3RrL1NraXBwZWQ6IERpdHRvLgorCiAyMDEx LTA1LTEzICBOYXQgRHVjYSAgPG5kdWNhQGNocm9taXVtLm9yZz4KIAogICAgICAgICBSZXZpZXdl ZCBieSBKYW1lcyBSb2JpbnNvbi4KSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvbWVkaWEv dmlkZW8tY3Jvc3Mtc2l0ZS1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv aHR0cC90ZXN0cy9tZWRpYS92aWRlby1jcm9zcy1zaXRlLWV4cGVjdGVkLnR4dAkocmV2aXNpb24g MCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jvc3Mtc2l0ZS1leHBl Y3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsOSBAQAorVmlkZW8gd2l0aCBjcm9zcy1z aXRlIHJlZmVyZW5jZSBzaG91bGQgbm90IGxvYWQuCisKK0VYUEVDVEVEICh2aWRlby5lcnJvciA9 PSAnbnVsbCcpIE9LCitFVkVOVChsb2Fkc3RhcnQpCitFVkVOVChlcnJvcikKK1NVQ0NFU1M6IGRl bmllZCBjcm9zcy1zaXRlIHZpZGVvIGxvYWQuIE9LCisKK0VORCBPRiBURVNUCisKSW5kZXg6IExh eW91dFRlc3RzL2h0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jvc3Mtc2l0ZS5odG1sCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jvc3Mtc2l0ZS5odG1s CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9tZWRpYS92aWRlby1jcm9z cy1zaXRlLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNDAgQEAKKzwhRE9DVFlQRSBodG1s PgorPGh0bWw+CisgICAgPGhlYWQ+CisgICAgICAgIDx0aXRsZT5tZWRpYSBmaWxlIHJlZGlyZWN0 cyB0byBhbm90aGVyIHNpdGU8L3RpdGxlPgorICAgICAgICA8c2NyaXB0IHNyYz0uLi8uLi9tZWRp YS1yZXNvdXJjZXMvdmlkZW8tdGVzdC5qcz48L3NjcmlwdD4KKyAgICAgICAgPHNjcmlwdD4KKyAg ICAgICAgICAgIGZ1bmN0aW9uIGxvYWRlZG1ldGFkYXRhKGV2dCkgCisgICAgICAgICAgICB7Cisg ICAgICAgICAgICAgICAgZmFpbFRlc3QoIkVSUk9SOiBhbGxvd2VkIGNyb3NzLXNpdGUgdmlkZW8g bG9hZCEiKTsKKyAgICAgICAgICAgICAgICBjb25zb2xlV3JpdGUoIiIpOworICAgICAgICAgICAg ICAgIGVuZFRlc3QoKTsKKyAgICAgICAgICAgIH0KKworICAgICAgICAgICAgZnVuY3Rpb24gZXJy b3IoZXZ0KQorICAgICAgICAgICAgeworICAgICAgICAgICAgICAgIGxvZ1Jlc3VsdCh0cnVlLCAi U1VDQ0VTUzogZGVuaWVkIGNyb3NzLXNpdGUgdmlkZW8gbG9hZC4iKTsKKyAgICAgICAgICAgICAg ICBjb25zb2xlV3JpdGUoIiIpOworICAgICAgICAgICAgICAgIGVuZFRlc3QoKTsKKyAgICAgICAg ICAgIH0KKworICAgICAgICAgICAgZnVuY3Rpb24gc3RhcnQoKSAKKyAgICAgICAgICAgIHsKKyAg ICAgICAgICAgICAgICBmaW5kTWVkaWFFbGVtZW50KCk7CisKKyAgICAgICAgICAgICAgICB3YWl0 Rm9yRXZlbnQoJ2xvYWRlZG1ldGFkYXRhJywgbG9hZGVkbWV0YWRhdGEpOworICAgICAgICAgICAg ICAgIHdhaXRGb3JFdmVudCgiZXJyb3IiLCBlcnJvcik7CisgICAgICAgICAgICAgICAgd2FpdEZv ckV2ZW50KCJsb2Fkc3RhcnQiKTsKKyAgICAgICAgICAgICAgICB0ZXN0RXhwZWN0ZWQoInZpZGVv LmVycm9yIiwgbnVsbCk7CisKKyAgICAgICAgICAgICAgICB2aWRlby5zcmMgPSAiaHR0cDovLzEy Ny4wLjAuMTo4MDAwL21lZGlhL3Jlc291cmNlcy9jcm9zcy1zaXRlLXJlZmVyZW5jZS5tb3YiOwor ICAgICAgICAgICAgfQorICAgICAgICA8L3NjcmlwdD4KKyAgICA8L2hlYWQ+CisgICAgPGJvZHk+ CisgICAgICAgIDx2aWRlbyBjb250cm9scz48L3ZpZGVvPgorICAgICAgICA8cD5WaWRlbyB3aXRo IGNyb3NzLXNpdGUgcmVmZXJlbmNlIHNob3VsZCBub3QgbG9hZC48L3A+CisgICAgICAgIDxzY3Jp cHQ+c3RhcnQoKTwvc2NyaXB0PgorICAgIDwvYm9keT4KKzwvaHRtbD4KKwpJbmRleDogTGF5b3V0 VGVzdHMvcGxhdGZvcm0vY2hyb21pdW0vdGVzdF9leHBlY3RhdGlvbnMudHh0Cj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIExheW91dFRlc3RzL3BsYXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRpb25zLnR4dAko cmV2aXNpb24gODYxNTApCisrKyBMYXlvdXRUZXN0cy9wbGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4 cGVjdGF0aW9ucy50eHQJKHdvcmtpbmcgY29weSkKQEAgLTQwMzYsMyArNDAzNiw2IEBAIEJVR1dL NTQxODEgOiBmYXN0L2V2ZW50cy9wYWdlLXZpc2liaWxpdHkKIAogLy8gVG8gYmUgcmUtZW5hYmxl ZCBhZnRlciBsYW5kaW5nIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02 MDE3Ny4KIEJVR1dLNjAzODcgOiBmYXN0L2RvbS9NZWRpYVN0cmVhbS9hcmd1bWVudC10eXBlcy5o dG1sID0gRkFJTAorCisvLyBRdWlja1RpbWUgcmVmZXJlbmNlIG1vdmllcyBub3Qgc3VwcG9ydGVk LgorV09OVEZJWCBTS0lQIDogaHR0cC90ZXN0cy9tZWRpYS92aWRlby1jcm9zcy1zaXRlLmh0bWwg PSBQQVNTIEZBSUwgVElNRU9VVApJbmRleDogTGF5b3V0VGVzdHMvcGxhdGZvcm0vZ3RrL1NraXBw ZWQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvcGxhdGZvcm0vZ3RrL1NraXBwZWQJKHJldmlz aW9uIDg2MTUwKQorKysgTGF5b3V0VGVzdHMvcGxhdGZvcm0vZ3RrL1NraXBwZWQJKHdvcmtpbmcg Y29weSkKQEAgLTUyMiw2ICs1MjIsMTAgQEAgaHR0cC90ZXN0cy9sb2FkaW5nL3RleHQtY29udGVu dC10eXBlLXdpdAogaHR0cC90ZXN0cy9tZWRpYS92aWRlby1wbGF5LXN0YWxsLXNlZWsuaHRtbAog aHR0cC90ZXN0cy9tZWRpYS92aWRlby1wbGF5LXN0YWxsLmh0bWwKIGh0dHAvdGVzdHMvbWVkaWEv dmlkZW8tc2Vla2FibGUtc3RhbGwuaHRtbAorCisjIFF1aWNrVGltZSByZWZlcmVuY2UgbW92aWUg bm90IHN1cHBvcnRlZC4KK2h0dHAvdGVzdHMvbWVkaWEvdmlkZW8tY3Jvc3Mtc2l0ZS5odG1sCisK IGh0dHAvdGVzdHMvbWlzYy9hY2lkMy5odG1sCiBodHRwL3Rlc3RzL21pc2MvbGluay1yZWwtcHJl ZmV0Y2gtYW5kLXN1YnJlc291cmNlLmh0bWwKIGh0dHAvdGVzdHMvbWlzYy9wb2xpY3ktZGVsZWdh dGUtY2FsbGVkLXR3aWNlLmh0bWwKSW5kZXg6IExheW91dFRlc3RzL2h0dHAvdGVzdHMvbWVkaWEv cmVzb3VyY2VzL2Nyb3NzLXNpdGUtcmVmZXJlbmNlLm1vdgo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09CkNhbm5vdCBkaXNw bGF5OiBmaWxlIG1hcmtlZCBhcyBhIGJpbmFyeSB0eXBlLgpzdm46bWltZS10eXBlID0gYXBwbGlj YXRpb24vb2N0ZXQtc3RyZWFtCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9odHRw L3Rlc3RzL21lZGlhL3Jlc291cmNlcy9jcm9zcy1zaXRlLXJlZmVyZW5jZS5tb3YKX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpBZGRlZDogc3ZuOm1pbWUtdHlwZQogICArIGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQoKCkFB QUFqMjF2YjNZQUFBQ0hjbTF5WVFBQUFIOXliV1JoQUFBQVEzSmtjbVlBQUFBQWRYSnNJQUFBQUM5 b2RIUndPaTh2Ykc5allXeG8KYjNOME9qZ3dNREF2YldWa2FXRXZjbVZ6YjNWeVkyVnpMM1JsYzNR dWJYQTBBQUFBQUJCeWJXUnlBQUFBQUFBQUZlQUFBQUFrY20xagpaQUFBQUFCelpHVmpiWEEwWVFB QUFBQUFBQUFBQUFBQUFBQUFBQUU9Cgo=