Bug 58610 – CSP should block string arguments to setTimeout and setInterval unless options eval-script

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Adam Barth]

CSP should block string arguments to setTimeout and setInterval unless options eval-script

[Adam Barth]

Created attachment 89697 [details]
Patch

[Eric Seidel (no email)]

Comment on attachment 89697 [details]
Patch

OK.

[Adam Barth]

Comment on attachment 89697 [details]
Patch

Clearing flags on attachment: 89697

Committed r83954: <http://trac.webkit.org/changeset/83954>

[Adam Barth]

All reviewed patches have been landed.  Closing bug.

[Philippe Normand]

I think this patch broke fast/dom/Window/timer-null-script-execution-context.html		
 on GTK:

http://webkit-bots.igalia.com/amd64/svn_83958.core-when_1302857706-_-who_DumpRenderTree-_-why_11.trace.html

Thread 1 (Thread 5107):
#0  0x00002b40f4742876 in WTF::RefPtr<WebCore::ContentSecurityPolicy>::get (this=0x13d8) at ../../Source/JavaScriptCore/wtf/RefPtr.h:60
#1  0x00002b40f4742146 in WebCore::Document::contentSecurityPolicy (this=0x0) at ../../Source/WebCore/dom/Document.h:1106
#2  0x00002b40f4741479 in WebCore::JSDOMWindow::setTimeout (this=0x2b41488259d0, exec=0x2b4148012130) at ../../Source/WebCore/bindings/js/JSDOMWindowCustom.cpp:735
#3  0x00002b40f5224e70 in WebCore::jsDOMWindowPrototypeFunctionSetTimeout (exec=0x2b4148012130) at DerivedSources/WebCore/JSDOMWindow.cpp:9692
#4  0x00002b40f54f2975 in JSC::Interpreter::executeCall (this=0x15a0db0, callFrame=0x2b41480120b0, function=0x2b414bd3b210, callType=JSC::CallTypeHost, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:872
#5  0x00002b40f557f77c in JSC::call (exec=0x2b41480120b0, functionObject=..., callType=JSC::CallTypeHost, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/runtime/CallData.cpp:38
#6  0x00002b40f55908b5 in JSC::functionProtoFuncCall (exec=0x2b41480120b0) at ../../Source/JavaScriptCore/runtime/FunctionPrototype.cpp:146
#7  0x00002b41080001e8 in ?? ()
#8  0x00007ffff87ea2b0 in ?? ()
#9  0x00002b410805b52e in ?? ()
#10 0x00007ffff87ea240 in ?? ()
#11 0x00002b414bd3b210 in ?? ()
#12 0x0000000004167800 in ?? ()
#13 0x00002b4100000001 in ?? ()
#14 0x00002b414882f3a0 in ?? ()
#15 0x00007ffff87ea260 in ?? ()
#16 0x00007ffff87ea270 in ?? ()
#17 0x00002b40f45fa03d in JSC::JSValue::decode (ptr=0x2b40f94f4170) at ../../Source/JavaScriptCore/runtime/JSValueInlineMethods.h:369
#18 0x00002b40f54f5779 in JSC::JITCode::execute (this=0x2b414bcdcb68, registerFile=0x15a0dc8, callFrame=0x2b4148012038, globalData=0xfc6050) at ../../Source/JavaScriptCore/jit/JITCode.h:77
#19 0x00002b40f54f2723 in JSC::Interpreter::executeCall (this=0x15a0db0, callFrame=0x2b4148826bd8, function=0x2b414bcfb710, callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:844
#20 0x00002b40f557f77c in JSC::call (exec=0x2b4148826bd8, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/runtime/CallData.cpp:38
#21 0x00002b40f471fc6b in WebCore::JSMainThreadExecState::call (exec=0x2b4148826bd8, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:48
#22 0x00002b40f4784b46 in WebCore::ScheduledAction::executeFunctionInContext (this=0x43c7f90, globalObject=0x2b4148826b50, thisValue=..., context=0x4130500) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:109
#23 0x00002b40f4784d3b in WebCore::ScheduledAction::execute (this=0x43c7f90, document=0x4130320) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:131
#24 0x00002b40f4784902 in WebCore::ScheduledAction::execute (this=0x43c7f90, context=0x4130500) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:79
#25 0x00002b40f4cd62fd in WebCore::DOMTimer::fired (this=0x43c7fd0) at ../../Source/WebCore/page/DOMTimer.cpp:148
#26 0x00002b40f4e06160 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0xfcdbb0) at ../../Source/WebCore/platform/ThreadTimers.cpp:112
#27 0x00002b40f4e06097 in WebCore::ThreadTimers::sharedTimerFired () at ../../Source/WebCore/platform/ThreadTimers.cpp:90
#28 0x00002b40f45b485a in WebCore::timeout_cb () at ../../Source/WebCore/platform/gtk/SharedTimerGtk.cpp:49
#29 0x00002b40f9253dbb in g_timeout_dispatch (source=0x41d8650, callback=0x2b4148012130, user_data=0x2b4148012130) at /tmp/buildd/glib2.0-2.27.91/./glib/gmain.c:3877
#30 0x00002b40f9253362 in g_main_dispatch (context=0xffff000000000002) at /tmp/buildd/glib2.0-2.27.91/./glib/gmain.c:2440
#31 g_main_context_dispatch (context=0xffff000000000002) at /tmp/buildd/glib2.0-2.27.91/./glib/gmain.c:3013
#32 0x00002b40f9257a28 in g_main_context_iterate (context=0xf27a30, block=<value optimized out>, dispatch=<value optimized out>, self=<value optimized out>) at /tmp/buildd/glib2.0-2.27.91/./glib/gmain.c:3091
#33 0x00002b40f9257f35 in g_main_loop_run (loop=0x4121c90) at /tmp/buildd/glib2.0-2.27.91/./glib/gmain.c:3299
#34 0x00002b40f71c6657 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#35 0x0000000000421360 in runTest (testPathOrURL=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:702
#36 0x00000000004209fd in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:494
#37 0x0000000000422cbf in main (argc=2, argv=0x7ffff87eb438) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1179

[Philippe Normand]

Forgot a bit:

Program terminated with signal 11, Segmentation fault.
#0  0x00002b40f4742876 in WTF::RefPtr<WebCore::ContentSecurityPolicy>::get (this=0x13d8) at ../../Source/JavaScriptCore/wtf/RefPtr.h:60
60	        T* get() const { return m_ptr; }

[Adam Roben (:aroben)]

Windows, too: http://build.webkit.org/results/Windows%20XP%20Debug%20%28Tests%29/r83954%20(27657)/fast/dom/Window/timer-null-script-execution-context-crash-log.txt

[Adam Roben (:aroben)]

I rolled this out in r83963 to stop the crashing on the bots.

[Adam Barth]

(In reply to comment #8)
> I rolled this out in r83963 to stop the crashing on the bots.

Thanks!  Sorry I went to sleep.  :(

[Adam Barth]

Created attachment 89847 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 89847 [details]
Patch for landing

Clearing flags on attachment: 89847

Committed r84073: <http://trac.webkit.org/changeset/84073>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.