Bug 222130 – hasBrokenEncryptedMediaAPISupportQuirk and needsPreloadAutoQuirk have overly permissive domain allow lists

• Status: RESOLVED
• Resolution: FIXED
• Component: Media

[Rich Dougherty]

The hasBrokenEncryptedMediaAPISupportQuirk enables quirks behaviour for several whitelisted domains. The rule to allow subdomains of hulu.com appears to be missing a "." so it would also allow sites like "notreallyhulu.com" as well as genuine subdomains.

In other words, the check 'domain.endsWith("hulu.com")' should probably be 'domain.endsWith(".hulu.com")'. This would bring it in line with rules for the other domains.

See: https://github.com/WebKit/WebKit/blob/4e8064a058644469e9312abdb736c4164c848e71/Source/WebCore/page/Quirks.cpp#L187

[Rich Dougherty]

needsPreloadAutoQuirk appears to have the same issue with the vimeo.com domain

https://github.com/WebKit/WebKit/blob/4e8064a058644469e9312abdb736c4164c848e71/Source/WebCore/page/Quirks.cpp#L767

Credit:
- https://news.ycombinator.com/item?id=26166497
- https://twitter.com/mikesherov/status/1208025766832803841

[Radar WebKit Bug Importer]

<rdar://problem/74758560>

[Eric Carlson]

Created attachment 448763 [details]
Patch

[Eric Carlson]

*** Bug 235015 has been marked as a duplicate of this bug. ***

[Eric Carlson]

Created attachment 448775 [details]
Patch

[EWS]

Committed r287855 (245901@main): <https://commits.webkit.org/245901@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 448775 [details].

[Darin Adler]

Comment on attachment 448775 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=448775&action=review

> Source/WebCore/page/Quirks.cpp:820
> +    m_needsPreloadAutoQuirk = domain == "vimeo"_s;

This should be "vimeo.com", right?

[Eric Carlson]

Comment on attachment 448775 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=448775&action=review

>> Source/WebCore/page/Quirks.cpp:820
>> +    m_needsPreloadAutoQuirk = domain == "vimeo"_s;
> 
> This should be "vimeo.com", right?

It certainly should!

[Eric Carlson]

Reopening to attach new patch.

[Eric Carlson]

Created attachment 448803 [details]
Followup to fix typo

[EWS]

Committed r287862 (245906@main): <https://commits.webkit.org/245906@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 448803 [details].