summaryrefslogtreecommitdiffstats
path: root/main/webkit/cve-2010-2646.patch
diff options
context:
space:
mode:
Diffstat (limited to 'main/webkit/cve-2010-2646.patch')
-rw-r--r--main/webkit/cve-2010-2646.patch110
1 files changed, 0 insertions, 110 deletions
diff --git a/main/webkit/cve-2010-2646.patch b/main/webkit/cve-2010-2646.patch
deleted file mode 100644
index 40568164c..000000000
--- a/main/webkit/cve-2010-2646.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-description: fix cve-2010-2646
-author: Michael Gilbert <michael.s.gilbert@gmail.com>
-origin: http://trac.webkit.org/changeset/58873
-Index: webkit-1.2.4/WebCore/storage/StorageEventDispatcher.cpp
-===================================================================
---- webkit-1.2.4.orig/WebCore/storage/StorageEventDispatcher.cpp 2010-09-07 01:13:45.000000000 -0400
-+++ webkit-1.2.4/WebCore/storage/StorageEventDispatcher.cpp 2010-09-07 01:14:42.000000000 -0400
-@@ -54,8 +54,12 @@
- frames.append(frame);
- }
-
-- for (unsigned i = 0; i < frames.size(); ++i)
-- frames[i]->document()->enqueueStorageEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), frames[i]->domWindow()->sessionStorage()));
-+ for (unsigned i = 0; i < frames.size(); ++i) {
-+ ExceptionCode ec = 0;
-+ Storage* storage = frames[i]->domWindow()->sessionStorage(ec);
-+ if (!ec)
-+ frames[i]->document()->enqueueStorageEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->url(), storage));
-+ }
- } else {
- // Send events to every page.
- const HashSet<Page*>& pages = page->group().pages();
-Index: webkit-1.2.4/WebCore/page/DOMWindow.h
-===================================================================
---- webkit-1.2.4.orig/WebCore/page/DOMWindow.h 2010-09-07 01:13:45.000000000 -0400
-+++ webkit-1.2.4/WebCore/page/DOMWindow.h 2010-09-07 01:14:42.000000000 -0400
-@@ -206,7 +206,7 @@
-
- #if ENABLE(DOM_STORAGE)
- // HTML 5 key/value storage
-- Storage* sessionStorage() const;
-+ Storage* sessionStorage(ExceptionCode&) const;
- Storage* localStorage(ExceptionCode&) const;
- #endif
-
-Index: webkit-1.2.4/WebCore/page/DOMWindow.cpp
-===================================================================
---- webkit-1.2.4.orig/WebCore/page/DOMWindow.cpp 2010-09-07 01:13:45.000000000 -0400
-+++ webkit-1.2.4/WebCore/page/DOMWindow.cpp 2010-09-07 01:14:42.000000000 -0400
-@@ -567,7 +567,7 @@
- }
-
- #if ENABLE(DOM_STORAGE)
--Storage* DOMWindow::sessionStorage() const
-+Storage* DOMWindow::sessionStorage(ExceptionCode& ec) const
- {
- if (m_sessionStorage)
- return m_sessionStorage.get();
-@@ -576,6 +576,11 @@
- if (!document)
- return 0;
-
-+ if (!document->securityOrigin()->canAccessLocalStorage()) {
-+ ec = SECURITY_ERR;
-+ return 0;
-+ }
-+
- Page* page = document->page();
- if (!page)
- return 0;
-@@ -593,16 +598,16 @@
- {
- if (m_localStorage)
- return m_localStorage.get();
--
-+
- Document* document = this->document();
- if (!document)
- return 0;
--
-+
- if (!document->securityOrigin()->canAccessLocalStorage()) {
- ec = SECURITY_ERR;
- return 0;
- }
--
-+
- Page* page = document->page();
- if (!page)
- return 0;
-Index: webkit-1.2.4/WebCore/page/SecurityOrigin.h
-===================================================================
---- webkit-1.2.4.orig/WebCore/page/SecurityOrigin.h 2010-09-07 01:13:45.000000000 -0400
-+++ webkit-1.2.4/WebCore/page/SecurityOrigin.h 2010-09-07 01:14:42.000000000 -0400
-@@ -120,6 +120,11 @@
- bool canAccessLocalStorage() const { return !isUnique(); }
- bool canAccessCookies() const { return !isUnique(); }
-
-+ // Technically, we should always allow access to sessionStorage, but we
-+ // currently don't handle creating a sessionStorage area for unique
-+ // origins.
-+ bool canAccessSessionStorage() const { return !isUnique(); }
-+
- bool isSecureTransitionTo(const KURL&) const;
-
- // The local SecurityOrigin is the most privileged SecurityOrigin.
-Index: webkit-1.2.4/WebCore/page/DOMWindow.idl
-===================================================================
---- webkit-1.2.4.orig/WebCore/page/DOMWindow.idl 2010-09-07 01:14:36.000000000 -0400
-+++ webkit-1.2.4/WebCore/page/DOMWindow.idl 2010-09-07 01:14:42.000000000 -0400
-@@ -164,7 +164,8 @@
- raises(DOMException);
- #endif
- #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-- readonly attribute [EnabledAtRuntime] Storage sessionStorage;
-+ readonly attribute [EnabledAtRuntime] Storage sessionStorage
-+ getter raises(DOMException);
- readonly attribute [EnabledAtRuntime] Storage localStorage
- getter raises(DOMException);
- #endif