New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 674203 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug-Security

Blocking:
issue 671102
issue 673170



Sign in to add a comment

Security: Merge general javascript: UXSS fix to beta / stable

Project Member Reported by dcheng@chromium.org, Dec 14 2016

Issue description

Marius landed https://crrev.com/783e19486cab2b7485b4a19c02a2eb0369f3b350, which prevents a whole class of problems from turning into UXSS. We should merge this into beta / stable, as I believe that this actually also blocks several other active UXSS bugs:  671102  and  673170 .

Setting labels based on the already triaged UXSS bugs.
 

Comment 1 by dcheng@chromium.org, Dec 14 2016

Cc: marius.mlynski@gmail.com
+marius.mlynski@gmail.com as the original author of the patch as well

Comment 2 by mmoroz@chromium.org, Dec 15 2016

Cc: mmoroz@chromium.org
Project Member

Comment 3 by sheriffbot@chromium.org, Dec 15 2016

Status: Fixed (was: Started)
Please mark security bugs as fixed as soon as the fix lands, and before requesting merges. This update is based on the merge- labels applied to this issue. Please reopen if this update was incorrect.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 4 by dimu@chromium.org, Dec 15 2016

Labels: -Merge-Request-56 Merge-Approved-56 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M56 (branch: 2924)
Project Member

Comment 5 by sheriffbot@chromium.org, Dec 16 2016

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify

Comment 6 by dcheng@chromium.org, Dec 19 2016

Note: this was merged in https://codereview.chromium.org/2579213002/, but doesn't seem to be getting picked up by bugdroid for some reason.
This is because Bugdroid takes the issue number from the commit description, and it points to the original bug:  https://crbug.com/117226 

Thanks for taking the time to merge, happy to see the mitigation released sooner! If you'd like to merge it to stable, please note that this patch depends on https://crrev.com/8a8505dc2c so that'd need to be uplifted first.
Project Member

Comment 8 by sheriffbot@chromium.org, Dec 19 2016

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 9 by awhalley@google.com, Dec 19 2016

Labels: -Hotlist-Merge-Approved -Merge-Approved-56 merge-merged-2924
Labels: -M-55 M-56 Release-0-M56
Project Member

Comment 11 by sheriffbot@chromium.org, Mar 24 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment