Cross-origin Shared Worker
Reported by
s.h.h.n....@gmail.com,
Nov 20 2017
|
|||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36 Steps to reproduce the problem: 1. Go to https://test.shhnjk.com/2.html 2. Open another tab and go to https://vuln.shhnjk.com/2.html 3. Click on stop button on one tab What is the expected behavior? other tab keeps counting and does not stop (SharedWorker won't be established between cross-origin) What went wrong? In https://html.spec.whatwg.org/multipage/workers.html#sharedworker, step 11.2's note of "When the SharedWorker(scriptURL, options) constructor is invoked:" says data: URLs create a worker with an opaque origin. Both the constructor origin and constructor url are compared so the same data: URL can be used within an origin to get to the same SharedWorkerGlobalScope object, but cannot be used to bypass the same origin restriction. This is not the case in Chrome and cross-origin site can create SharedWorker using data URL SharedWorker script. Did this work before? N/A Chrome version: 62.0.3202.94 Channel: stable OS Version: 10.0 Flash Version:
,
Nov 20 2017
,
Nov 21 2017
Thank you for reporting this. Looks like URL matching logic (SharedWorkerInstance::Matches()) is not correct for Data URL. Data URL has an empty origin and can pass the logic. Probably we should compare "constructor origin" set to "outside settings's origin"[1] instead of a given URL's origin. [1] https://html.spec.whatwg.org/multipage/workers.html#run-a-worker
,
Nov 21 2017
Bumping up the priority because this is a security issue to bypass the same origin policy...
,
Nov 21 2017
Related to issue 270979 and https://www.chromestatus.com/feature/5633342665916416? Seems like https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/6otx9aZlwEo/ddfnO5gTCAAJ had a lot of discussion about the security model.
,
Nov 21 2017
falken@: Thank you for sharing information! WIP CL (I'll add tests): https://chromium-review.googlesource.com/c/chromium/src/+/781539
,
Nov 21 2017
,
Nov 28 2017
nhiroki: Friendly ping. :)
,
Nov 28 2017
I'm still working on the CL to fix this in M64: https://chromium-review.googlesource.com/c/chromium/src/+/781539
,
Nov 30 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/018bb6d300c11acb953d51ef3cbec4cdcaf4a652 commit 018bb6d300c11acb953d51ef3cbec4cdcaf4a652 Author: Hiroki Nakagawa <nhiroki@chromium.org> Date: Thu Nov 30 03:31:37 2017 SharedWorker: Introduce "constructor origin" concept defined in the spec This CL introduces the "constructor origin" concept defined in the HTML spec: https://html.spec.whatwg.org/multipage/workers.html#concept-sharedworkerglobalscope-constructor-origin Bug: 787103 Change-Id: I273629760bb34e0c24f1c4d023e66e146a476407 Reviewed-on: https://chromium-review.googlesource.com/781539 Reviewed-by: Raymes Khoury <raymes@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Matt Falkenhagen <falken@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Reviewed-by: Kinuko Yasuda <kinuko@chromium.org> Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org> Cr-Commit-Position: refs/heads/master@{#520417} [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/browsing_data/browsing_data_shared_worker_helper.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/browsing_data/browsing_data_shared_worker_helper.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/browsing_data/browsing_data_shared_worker_helper_unittest.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/browsing_data/cookies_tree_model.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/browsing_data/mock_browsing_data_shared_worker_helper.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/browsing_data/mock_browsing_data_shared_worker_helper.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/chrome_content_browser_client.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/chrome_content_browser_client.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/content_settings/tab_specific_content_settings.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/chrome/browser/content_settings/tab_specific_content_settings.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/devtools/shared_worker_devtools_manager_unittest.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/shared_worker/shared_worker_instance.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/shared_worker/shared_worker_instance.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/shared_worker/shared_worker_instance_unittest.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/shared_worker/shared_worker_service_impl.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/shared_worker/shared_worker_service_impl.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/browser/shared_worker/shared_worker_service_impl_unittest.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/public/browser/content_browser_client.cc [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/public/browser/content_browser_client.h [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/content/public/browser/shared_worker_service.h [add] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/third_party/WebKit/LayoutTests/external/wpt/workers/data-url-shared-window.html [modify] https://crrev.com/018bb6d300c11acb953d51ef3cbec4cdcaf4a652/third_party/WebKit/LayoutTests/external/wpt/workers/data-url-shared.html
,
Nov 30 2017
,
Nov 30 2017
Android doesn't support SharedWorker.
,
Nov 30 2017
,
Dec 4 2017
,
Dec 8 2017
*** Boilerplate reminders! *** Please do NOT publicly disclose details until a fix has been released to all our users. Early public disclosure may cancel the provisional reward. Also, please be considerate about disclosure when the bug affects a core library that may be used by other products. Please do NOT share this information with third parties who are not directly involved in fixing the bug. Doing so may cancel the provisional reward. Please be honest if you have already disclosed anything publicly or to third parties. Lastly, we understand that some of you are not interested in money. We offer the option to donate your reward to an eligible charity. If you prefer this option, let us know and we will also match your donation - subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing. *********************************
,
Dec 8 2017
Nice on s.h.h.n.j.k@! The VRP panel decided to award $2,000 for this report. Cheers!
,
Dec 8 2017
,
Dec 15 2017
,
Dec 15 2017
This bug requires manual review: M64 has already been promoted to the beta branch, so this requires manual review Please contact the milestone owner if you have questions. Owners: cmasso@(Android), cmasso@(iOS), kbleicher@(ChromeOS), abdulsyed@(Desktop) For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Dec 18 2017
abdulsyed@ - good for M64
,
Dec 18 2017
nhiroki@ - this seems like a very large change overall and is touching some key directories. Can you please comment on whether this is absolutely needed for M64 vs waiting until M65? How well tested is this? Are we confident it won't break anything?
,
Dec 18 2017
On a second look, seems like this is already in M64 and made it before branch. Removing Merge-Request label. https://chromium.googlesource.com/chromium/src.git/+/018bb6d300c11acb953d51ef3cbec4cdcaf4a652
,
Dec 18 2017
Sorry for the late comment. I didn't notice the automatic merge request. Yes, this should already be in M64. $ git find-releases 018bb6d300c11acb953d51ef3cbec4cdcaf4a652 commit 018bb6d300c11acb953d51ef3cbec4cdcaf4a652 was: initially in 64.0.3282.0
,
Jan 22 2018
,
Jan 24 2018
,
Mar 2 2018
,
Mar 8 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Mar 27 2018
,
Apr 25 2018
,
Oct 5
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by mmoroz@chromium.org
, Nov 20 2017Labels: Security_Impact-Stable OS-Linux
Owner: nhiroki@chromium.org
Status: Assigned (was: Unconfirmed)