87346 2012-05-23 23:39:18 -0700 Web Inspector: introduce console proxy object for HeapSnapshot worker. 2012-05-24 06:10:55 -0700 1 1 1 Unclassified WebKit Web Inspector (Deprecated) 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 loislo loislo alph apavlov bweinstein joepeck keishi loislo pfeldman pmuellr rik timothy yurys oldest_to_newest 632454 0 loislo 2012-05-23 23:39:18 -0700 There is no console object in html5 workers at the moment. This makes me sad when I'm troubleshooting the HeapSnapshot stuff. 632460 1 143745 loislo 2012-05-23 23:47:21 -0700 Created attachment 143745 Patch 632601 2 143745 pfeldman 2012-05-24 04:13:41 -0700 Comment on attachment 143745 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=143745&action=review > Source/WebCore/inspector/front-end/HeapSnapshotProxy.js:67 > + window[message.object][message.method].apply(window[message.object], message.arguments); You should call methods on console only, otherwise, worker can run arbitrary code on the front-end which is effectively the reversed dependency. 632607 3 loislo 2012-05-24 04:26:18 -0700 Committed r118348: <http://trac.webkit.org/changeset/118348> 632703 4 loislo 2012-05-24 06:10:55 -0700 (In reply to comment #2) > (From update of attachment 143745 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=143745&action=review > > > Source/WebCore/inspector/front-end/HeapSnapshotProxy.js:67 > > + window[message.object][message.method].apply(window[message.object], message.arguments); > > You should call methods on console only, otherwise, worker can run arbitrary code on the front-end which is effectively the reversed dependency. comment addressed 143745 2012-05-23 23:47:21 -0700 2012-05-24 04:13:41 -0700 Patch bug-87346-20120524104720.patch text/plain 3562 loislo U3VidmVyc2lvbiBSZXZpc2lvbjogMTE4MzIxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDI5NmViYmQ1YzE5ZDhh NGQ2ODJlNjRlMmQ5ZjBiNzY4ODY0NjQxOC4uZGZmYjE4NDMxYzNjZmM4ZTgzZGY4MzE3ZTkzZWNj OWYwMGNjYjE4OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI0IEBACisyMDEyLTA1LTIzICBJbHlh IFRpa2hvbm92c2t5ICA8bG9pc2xvQGNocm9taXVtLm9yZz4KKworICAgICAgICBXZWIgSW5zcGVj dG9yOiBpbnRyb2R1Y2UgY29uc29sZSBwcm94eSBvYmplY3QgZm9yIEhlYXBTbmFwc2hvdCB3b3Jr ZXIuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04NzM0 NgorCisgICAgICAgIFRoZXJlIGlzIG5vIGNvbnNvbGUgb2JqZWN0IGluIGh0bWw1IHdvcmtlcnMg YXQgdGhlIG1vbWVudC4KKyAgICAgICAgVGhpcyBtYWtlcyBtZSBzYWQgd2hlbiBJJ20gdHJvdWJs ZXNob290aW5nIHRoZSBIZWFwU25hcHNob3Qgc3R1ZmYuCisgICAgICAgIEkgd3JvdGUgYSBzaW1w bGVzdCBwcm94eSBvYmplY3Qgd2hpY2ggc2VuZHMgdGhlIGxvZywgaW5mbyBhbmQgZXJyb3IgbWVz c2FnZXMKKyAgICAgICAgdG8gdGhlIFdlYkluc3BlY3RvciB3aW5kb3cuCisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBpbnNwZWN0b3IvZnJvbnQtZW5k L0hlYXBTbmFwc2hvdFByb3h5LmpzOgorICAgICAgICAoV2ViSW5zcGVjdG9yLkhlYXBTbmFwc2hv dFJlYWxXb3JrZXIucHJvdG90eXBlLl9tZXNzYWdlUmVjZWl2ZWQpOgorICAgICAgICAqIGluc3Bl Y3Rvci9mcm9udC1lbmQvSGVhcFNuYXBzaG90V29ya2VyLmpzOgorICAgICAgICAoV2ViSW5zcGVj dG9yLldvcmtlckNvbnNvbGUpOgorICAgICAgICAoV2ViSW5zcGVjdG9yLldvcmtlckNvbnNvbGUu cHJvdG90eXBlLmxvZyk6CisgICAgICAgIChXZWJJbnNwZWN0b3IuV29ya2VyQ29uc29sZS5wcm90 b3R5cGUuZXJyb3IpOgorICAgICAgICAoV2ViSW5zcGVjdG9yLldvcmtlckNvbnNvbGUucHJvdG90 eXBlLmluZm8pOgorICAgICAgICAoV2ViSW5zcGVjdG9yLldvcmtlckNvbnNvbGUucHJvdG90eXBl Ll9wb3N0TWVzc2FnZSk6CisKIDIwMTItMDUtMjMgIFNoaW55YSBLYXdhbmFrYSAgPHNoaW55YWtA Y2hyb21pdW0ub3JnPgogCiAgICAgICAgIERvY3VtZW50LmVsZW1lbnRGcm9tUG9pbnQgZXhwb3Nl cyBpbm5lciBlbGVtZW50IG9mIFNoYWRvdyBET00uCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9pbnNwZWN0b3IvZnJvbnQtZW5kL0hlYXBTbmFwc2hvdFByb3h5LmpzIGIvU291cmNlL1dlYkNv cmUvaW5zcGVjdG9yL2Zyb250LWVuZC9IZWFwU25hcHNob3RQcm94eS5qcwppbmRleCBhMGFmOGE1 OWJiMDgzY2M0OWIyNWY3ZDNiZmMyYjQ4NzllZTI5ZjhiLi4wNTI2MzlhOWRlOGRjYzQyZmJjYWY4 MWQwYmZkYzhkZTVjMGUyYjkyIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9pbnNwZWN0b3Iv ZnJvbnQtZW5kL0hlYXBTbmFwc2hvdFByb3h5LmpzCisrKyBiL1NvdXJjZS9XZWJDb3JlL2luc3Bl Y3Rvci9mcm9udC1lbmQvSGVhcFNuYXBzaG90UHJveHkuanMKQEAgLTYwLDcgKzYwLDExIEBAIFdl Ykluc3BlY3Rvci5IZWFwU25hcHNob3RSZWFsV29ya2VyID0gZnVuY3Rpb24oKQogV2ViSW5zcGVj dG9yLkhlYXBTbmFwc2hvdFJlYWxXb3JrZXIucHJvdG90eXBlID0gewogICAgIF9tZXNzYWdlUmVj ZWl2ZWQ6IGZ1bmN0aW9uKGV2ZW50KQogICAgIHsKLSAgICAgICAgdGhpcy5kaXNwYXRjaEV2ZW50 VG9MaXN0ZW5lcnMoIm1lc3NhZ2UiLCBldmVudC5kYXRhKTsKKyAgICAgICAgdmFyIG1lc3NhZ2Ug PSBldmVudC5kYXRhOworICAgICAgICBpZiAoImNhbGxJZCIgaW4gbWVzc2FnZSkKKyAgICAgICAg ICAgIHRoaXMuZGlzcGF0Y2hFdmVudFRvTGlzdGVuZXJzKCJtZXNzYWdlIiwgbWVzc2FnZSk7Cisg ICAgICAgIGVsc2UKKyAgICAgICAgICAgIHdpbmRvd1ttZXNzYWdlLm9iamVjdF1bbWVzc2FnZS5t ZXRob2RdLmFwcGx5KHdpbmRvd1ttZXNzYWdlLm9iamVjdF0sIG1lc3NhZ2UuYXJndW1lbnRzKTsK ICAgICB9LAogCiAgICAgcG9zdE1lc3NhZ2U6IGZ1bmN0aW9uKG1lc3NhZ2UpCmRpZmYgLS1naXQg YS9Tb3VyY2UvV2ViQ29yZS9pbnNwZWN0b3IvZnJvbnQtZW5kL0hlYXBTbmFwc2hvdFdvcmtlci5q cyBiL1NvdXJjZS9XZWJDb3JlL2luc3BlY3Rvci9mcm9udC1lbmQvSGVhcFNuYXBzaG90V29ya2Vy LmpzCmluZGV4IGE4MTljMWNjMjQwOGIwNTFhMDI1YTdiZGEzNThkODViYTRhODkxM2QuLmNlNzVl YWIyYzJhMmRlMDc1MDMxYWE2NzFjYTcwNjQ0YzJlNjJkNjEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJDb3JlL2luc3BlY3Rvci9mcm9udC1lbmQvSGVhcFNuYXBzaG90V29ya2VyLmpzCisrKyBiL1Nv dXJjZS9XZWJDb3JlL2luc3BlY3Rvci9mcm9udC1lbmQvSGVhcFNuYXBzaG90V29ya2VyLmpzCkBA IC00MSw1ICs0MSw0MCBAQCBmdW5jdGlvbiBwb3N0TWVzc2FnZVdyYXBwZXIobWVzc2FnZSkKICAg ICBwb3N0TWVzc2FnZShtZXNzYWdlKTsKIH0KIAorLyoqCisgKiBAY29uc3RydWN0b3IKKyAqLwor V2ViSW5zcGVjdG9yLldvcmtlckNvbnNvbGUgPSBmdW5jdGlvbigpCit7Cit9CisKK1dlYkluc3Bl Y3Rvci5Xb3JrZXJDb25zb2xlLnByb3RvdHlwZSA9IHsKKyAgICBsb2c6IGZ1bmN0aW9uKCkKKyAg ICB7CisgICAgICAgIHRoaXMuX3Bvc3RNZXNzYWdlKCJsb2ciLCBBcnJheS5wcm90b3R5cGUuc2xp Y2UuY2FsbChhcmd1bWVudHMpKTsKKyAgICB9LAorCisgICAgZXJyb3I6IGZ1bmN0aW9uKCkKKyAg ICB7CisgICAgICAgIHRoaXMuX3Bvc3RNZXNzYWdlKCJlcnJvciIsIEFycmF5LnByb3RvdHlwZS5z bGljZS5jYWxsKGFyZ3VtZW50cykpOworICAgIH0sCisKKyAgICBpbmZvOiBmdW5jdGlvbigpCisg ICAgeworICAgICAgICB0aGlzLl9wb3N0TWVzc2FnZSgiaW5mbyIsIEFycmF5LnByb3RvdHlwZS5z bGljZS5jYWxsKGFyZ3VtZW50cykpOworICAgIH0sCisKKyAgICBfcG9zdE1lc3NhZ2U6IGZ1bmN0 aW9uKG1ldGhvZCwgYXJncykKKyAgICB7CisgICAgICAgIHZhciByYXdNZXNzYWdlID0geworICAg ICAgICAgICAgb2JqZWN0OiAiY29uc29sZSIsCisgICAgICAgICAgICBtZXRob2Q6IG1ldGhvZCwK KyAgICAgICAgICAgIGFyZ3VtZW50czogYXJncworICAgICAgICB9OworICAgICAgICBwb3N0TWVz c2FnZVdyYXBwZXIocmF3TWVzc2FnZSk7CisgICAgfQorfTsKKwogdmFyIGRpc3BhdGNoZXIgPSBu ZXcgV2ViSW5zcGVjdG9yLkhlYXBTbmFwc2hvdFdvcmtlckRpc3BhdGNoZXIodGhpcywgcG9zdE1l c3NhZ2VXcmFwcGVyKTsKIGFkZEV2ZW50TGlzdGVuZXIoIm1lc3NhZ2UiLCBkaXNwYXRjaGVyLmRp c3BhdGNoTWVzc2FnZS5iaW5kKGRpc3BhdGNoZXIpLCBmYWxzZSk7Citjb25zb2xlID0gbmV3IFdl Ykluc3BlY3Rvci5Xb3JrZXJDb25zb2xlKCk7Cg==