WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
21044
JSEventTarget* classes assume each listener is a JSEventListener
https://bugs.webkit.org/show_bug.cgi?id=21044
Summary
JSEventTarget* classes assume each listener is a JSEventListener
Nikolas Zimmermann
Reported
2008-09-23 16:22:46 PDT
As the summary, says JSEventTargetNode::getListener function blindly casts an EventListener object to a JSEventListener. This will fail if ie. it's actually an ObjCEventListener. The getListener/setListener functions of the JSEventTarget* classes are only used when calling someElement.onclick = '...' or someElement.onclick.handleEvent(..). The official DOM methods are not affected.
Attachments
Add attachment
proposed patch, testcase, etc.
Eric Seidel (no email)
Comment 1
2008-09-23 16:26:56 PDT
This would lead to a crash, so it should be a P1. Any application which registers Obj-C listeners as well as allows pages to run JavaScript would be vulnerable to such a crash.
Mark Rowe (bdash)
Comment 2
2008-09-23 16:32:42 PDT
<
rdar://problem/6241522
>
Deirdre Saoirse Moen
Comment 3
2009-01-11 19:02:56 PST
A test case would be helpful.
Sam Weinig
Comment 4
2009-07-05 15:00:07 PDT
This is no longer a problem. We now check that it is a JSEventListener before use.
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug