Bug 26868 - EventConstructor is being shared between documents
Summary: EventConstructor is being shared between documents
Status: RESOLVED FIXED
Alias: None
Product: Security
Classification: Unclassified
Component: Security (show other bugs)
Version: 525.x (Nightly build)
Hardware: Mac OS X 10.5
: P2 Major
Assignee: WebKit Security Group
URL: http://gf3.ca/safari_scope/
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2009-06-30 15:28 PDT by Gianni Chiappetta
Modified: 2012-05-10 08:15 PDT (History)
7 users (show)

See Also:


Attachments
Test case - Outer document (37 bytes, text/plain)
2009-09-08 16:08 PDT, Gianni Chiappetta
no flags Details
Test case - Inner document (37 bytes, text/plain)
2009-09-08 16:09 PDT, Gianni Chiappetta
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Gianni Chiappetta 2009-06-30 15:28:53 PDT
It seems as if the EventConstructor object is being shared between document scopes, which leads to conflicts when dealing with cross-frame events.


Reproduce
---------
Compare the Event object between parent and child documents.

I've created a test case in the URL attached. There are three assert statements, the assert on the Event object fails in Safari 4.

Weirdly enough, if you retrieve the objects via eval on each of the contexts, they return the expected results (thanks to tfluehr for noticing that one).


Actual Results
-----------
Both references are, in fact, the same object.


Expected Results
-------------
Each reference should refer to a different object relating to the scope of the document.
Comment 1 Adam Barth 2009-06-30 15:54:48 PDT
This sounds like it might be exploitable.  We need a better testing plan for finding these kinds of bugs.
Comment 2 David Kilzer (:ddkilzer) 2009-08-26 13:02:50 PDT
<rdar://problem/7172579>
Comment 3 Adam Barth 2009-08-26 20:40:40 PDT
I bet Eric fixed this as part of his grand cleanup of wrapper constructors.
Comment 4 Sam Weinig 2009-09-08 11:09:10 PDT
The test case is no longer reachable.  Can you upload one to the bug if this still manifests?
Comment 5 Gianni Chiappetta 2009-09-08 15:58:59 PDT
Sorry about that, moved it to a new server. Updated URL.
Comment 6 Gianni Chiappetta 2009-09-08 16:08:24 PDT
Created attachment 39224 [details]
Test case - Outer document
Comment 7 Gianni Chiappetta 2009-09-08 16:09:20 PDT
Created attachment 39225 [details]
Test case - Inner document
Comment 8 Sam Weinig 2009-09-08 18:58:28 PDT
This seems to be fixed in the latest nightlies.
Comment 9 David Kilzer (:ddkilzer) 2009-09-09 08:50:21 PDT
(In reply to comment #8)
> This seems to be fixed in the latest nightlies.

This was fixed by r46068:  <http://trac.webkit.org/changeset/46068>

That means this bug is a duplicate of Bug 27276, but I'm hesitant to dupe it since this would provide some potentially unwanted information disclosure.