| Summary: | Move functions from Frame to Editor as planned | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Darin Adler <darin> | ||||||
| Component: | WebCore Misc. | Assignee: | Darin Adler <darin> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | dglazkov, gustavo, webkit-ews, webkit.review.bot, xan.lopez, zecke | ||||||
| Priority: | P2 | ||||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
|
Description
Darin Adler
2010-09-03 17:56:19 PDT
Created attachment 66972 [details]
Patch
Attachment 66972 [details] did not build on qt: Build output: http://queues.webkit.org/results/3949295 Attachment 66972 [details] did not build on gtk: Build output: http://queues.webkit.org/results/3979090 Attachment 66972 [details] did not build on chromium: Build output: http://queues.webkit.org/results/3919332 Attachment 66972 [details] did not build on win: Build output: http://queues.webkit.org/results/3985048 Created attachment 67059 [details]
Patch
Comment on attachment 67059 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=67059&action=prettypatch > WebCore/editing/Editor.cpp:3366 > + styleElement->appendChild(m_frame->document()->createEditingTextNode(""), ec); > + ASSERT(!ec); This is a security vulnerability. appendChild fires DOM mutation events, which run JavaScript, which can make |node| point off into unallocated memory. Please RefPtr node. > WebCore/editing/Editor.cpp:3394 > + Node* shadowTreeRoot = selection.shadowTreeRootNode(); I bet this needs to be RefPtr for the same reason. (In reply to comment #7) > (From update of attachment 67059 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=67059&action=prettypatch > > > WebCore/editing/Editor.cpp:3366 > > + styleElement->appendChild(m_frame->document()->createEditingTextNode(""), ec); > > + ASSERT(!ec); > This is a security vulnerability. appendChild fires DOM mutation events, which run JavaScript, which can make |node| point off into unallocated memory. Please RefPtr node. Glad you spotted it. But the node here came from position.node(); Position already holds the node in a RefPtr. I’ll change the code to use position.node() and eliminate the local variable for clarity on this point. > > WebCore/editing/Editor.cpp:3394 > > + Node* shadowTreeRoot = selection.shadowTreeRootNode(); > I bet this needs to be RefPtr for the same reason. I put this in a RefPtr. Committed r67122: <http://trac.webkit.org/changeset/67122> *** Bug 23430 has been marked as a duplicate of this bug. *** |