summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (10/10)108-basedJack Hsieh2023-05-151-18/+25
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4337726: hid: Handle opaque top level origin in addedEventListener In navigator.hid.addEventListener, throw an exception if the request is coming from a context whose top level frame has an opaque origin. Bug: 1375133 Change-Id: I43d3c59eb4715d5c1b970d6f466a256c580582d6 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4337726 Commit-Queue: Jack Hsieh <chengweih@chromium.org> Reviewed-by: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/main@{#1117306} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476784 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (9/10)Jack Hsieh2023-05-151-13/+18
| | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4313307: serial: Handle opaque top level origin in addedEventListener In navigator.serial.addEventListener, throw an exception if the request is coming from a context whose top level frame has an opaque origin. Bug: 1375133 Change-Id: Ie8ad8333b901f795f55658894551c73f755029c4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4313307 Commit-Queue: Jack Hsieh <chengweih@chromium.org> Reviewed-by: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/main@{#1116683} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476783 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (8/10)Jack Hsieh2023-05-152-2/+19
| | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4237626: usb: Reject using WebUSB API in an opaque origin Rejects renderer's request of using WebUSB API when the top-level document has an opaque origin. Bug: 1375133 Change-Id: I1b449389e55ea8ead412ea9e87fc99971997b491 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4237626 Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org> Commit-Queue: Jack Hsieh <chengweih@chromium.org> Reviewed-by: Alex Moshchuk <alexmos@chromium.org> Reviewed-by: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/main@{#1116595} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476782 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (7/10)Jack Hsieh2023-05-152-34/+80
| | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4248258: Reject Web USB requests with an opaque origin The Web USB API tracks permissions using the origin of the top-level document in the frame tree. If this document has an opaque origin then there is no way to format the origin for display to the user in permission prompts or to write their decision in the preferences file. Access to the Web USB API from such contexts should therefore be blocked. Bug: 1375133 Change-Id: I47952bb230b3fdf0bfbc76f46d1ef91c19fc7ea1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4248258 Reviewed-by: Reilly Grant <reillyg@chromium.org> Commit-Queue: Jack Hsieh <chengweih@chromium.org> Cr-Commit-Position: refs/heads/main@{#1116559} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476761 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (7/10)Jack Hsieh2023-05-151-0/+8
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4237816: serial: Reject using Serial API in an opaque origin Rejects renderer's request of using Serial API when the top-level document has an opaque origin. Bug: 1375133 Change-Id: I14488099dda296b0fcf62f25ffef3e6e76e566ae Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4237816 Reviewed-by: Reilly Grant <reillyg@chromium.org> Reviewed-by: Alex Moshchuk <alexmos@chromium.org> Commit-Queue: Jack Hsieh <chengweih@chromium.org> Cr-Commit-Position: refs/heads/main@{#1114388} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476760 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (6/10)Sina Firoozabadi2023-05-152-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4114125: Drop Web Bluetooth mojoms from a renderer process of an opaque origin The Web Bluetooth API tracks permissions using the origin of the top-level document in the frame tree. If a document has an opaque origin then the requests to access Web Bluetooth get rejected on renderer side. To add a second layer of security in case of the renderer process being compromised, responding to the Web Bluetooth mojoms from such renderer process should be avoided. Disable-Rts: True Bug: 1375133 Change-Id: Icbc6da4127e9c10f659d43e64cd5d7d1e207d02f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4114125 Reviewed-by: Reilly Grant <reillyg@chromium.org> Commit-Queue: Sina Firoozabadi <sinafirooz@chromium.org> Cr-Commit-Position: refs/heads/main@{#1114352} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476759 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (5/10)Sina Firoozabadi2023-05-151-0/+14
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4112672: Reject HidService interface requests from opaque origins The Web HID API tracks permissions using the origin of the top-level document in the frame tree. If a document has an opaque origin then the requests to access Web HID get rejected on renderer side. To add a second layer of security in case of the renderer process being compromised, responding to the Web HID mojoms from such renderer process should be avoided. Bug: 1375133 Change-Id: I76dcccae558ef583787d646746671086d8199940 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4112672 Commit-Queue: Sina Firoozabadi <sinafirooz@chromium.org> Reviewed-by: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/main@{#1114294} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476758 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (4/10)Jack Hsieh2023-05-157-11/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4307819: Reland "Add top level frame security origin in GlobalWorkerScope" This reverts commit a1497e151b9c0fa094a48a6cb97c235abd41c8df. Reason for revert: Fixed the failure of https://ci.chromium.org/ui/p/chromium/builders/ci/linux-ubsan-vptr/21391/overview. Original change's description: > Revert "Add top level frame security origin in GlobalWorkerScope" > > Revert submission 4112689 > > Reason for revert: suspect for introducing test failures for > DedicatedWorkerTest.TopLevelFrameSecurityOrigin, for example > https://ci.chromium.org/ui/p/chromium/builders/ci/linux-ubsan-vptr/21391/overview > > Reverted changes: /q/submissionid:4112689 > > Change-Id: I5d9f05f031f312c4e37d908e5d112f5289ba30bc > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4307115 > Commit-Queue: Mikel Astiz <mastiz@chromium.org> > Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> > Owners-Override: Mikel Astiz <mastiz@google.com> > Cr-Commit-Position: refs/heads/main@{#1112817} Change-Id: I759b90d7b56ab28a43a550bdd940e6765da09c23 Bug: 1375133 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4307819 Reviewed-by: Hiroki Nakagawa <nhiroki@chromium.org> Commit-Queue: Jack Hsieh <chengweih@chromium.org> Cr-Commit-Position: refs/heads/main@{#1113254} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476757 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (3/10)Jack Hsieh2023-05-151-21/+47
| | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4112689: Reject Web Serial requests with an opaque origin The Web Serial API tracks permissions using the origin of the top-level document in the frame tree. If this document has an opaque origin then there is no way to format the origin for display to the user in permission prompts or to write their decision in the preferences file. Access to the Web Serial API from such contexts should therefore be blocked. Bug: 1375133 Change-Id: I4552ae74d480aa8df9ff93527fc85618bc03b947 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4112689 Reviewed-by: Reilly Grant <reillyg@chromium.org> Cr-Commit-Position: refs/heads/main@{#1112561} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476756 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (2/10)Sina Firoozabadi2023-05-151-4/+23
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4133535: Reject Web HID requests with an opaque origin The Web HID API tracks permissions using the origin of the top-level document in the frame tree. If this document has an opaque origin then there is no way to format the origin for display to the user in permission prompts or to write their decision in the preferences file. Access to the Web HID API from such contexts should therefore be blocked. Bug: 1375133 Change-Id: I7992b2886e882bbbb097b0460114f0a02a02e34f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4133535 Reviewed-by: Reilly Grant <reillyg@chromium.org> Commit-Queue: Sina Firoozabadi <sinafirooz@chromium.org> Cr-Commit-Position: refs/heads/main@{#1097051} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476755 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2462: Inappropriate implementation in Prompts (1/10)gsinafirooz2023-05-151-0/+12
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originaly reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4113162: Reject Web Bluetooth requests with an opaque origin The Web Bluetooth API tracks permissions using the origin of the top-level document in the frame tree. If this document has an opaque origin then there is no way to format the origin for display to the user in permission prompts or to write their decision in the preferences file. Access to the Web Bluetooth API from such contexts should therefore be blocked. Bug: 1375133 Change-Id: Idf737c1806eac4342e0fe716e2561e51aa127f53 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4113162 Reviewed-by: Reilly Grant <reillyg@chromium.org> Commit-Queue: Sina Firoozabadi <sinafirooz@chromium.org> Cr-Commit-Position: refs/heads/main@{#1089042} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476754 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2459: Inappropriate implementation in PromptsThomas Nguyen2023-05-154-23/+131
| | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4365724: Use weak pointer to store duplicate requests Bug: 1423304 Change-Id: I7ab170f085c3d05c582f7065b88c1ad2510cc633 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4365724 Commit-Queue: Thomas Nguyen <tungnh@chromium.org> Reviewed-by: Andy Paicu <andypaicu@chromium.org> Cr-Commit-Position: refs/heads/main@{#1124133} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476753 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-29469 / Security bug 1433328Michael Brüning2023-05-15128-7195/+6570
| | | | | | | | | | Manual roll of libxml to include cherry-picked security fix. Originally reviewed on: https://chromium-review.googlesource.com/c/chromium/src/+/4457227 Change-Id: I5dd9fbd29aaea404609b8a6b533fa79ae8d0f127 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476752 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1423360Keren Zhu2023-05-151-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4466648: Fix ScopedObservation UaF in BubbleDialogDelegate::AnchorWidgetObserver A ScopedObservation can outlive the aura::Window it observes, leading to a use-after-free error in ~ScopedObservation(). The problem occurs in BubbleDialogDelegate::AnchorWidgetObserver. This fix listens for OnWindowDestroying() and resets the observation to prevent the UaF. (cherry picked from commit 72bd6a1018548ee63a2ec06d6c7714d3a8cdf8a8) Bug: 1423360 Change-Id: I742b4624b2664dea3fd97db7b399fcd15e45c8fe Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4455016 Code-Coverage: Findit <findit-for-me@appspot.gserviceaccount.com> Reviewed-by: Elly Fong-Jones <ellyjones@chromium.org> Commit-Queue: Keren Zhu <kerenzhu@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1133511} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4466648 Reviewed-by: Allen Bauer <kylixrd@chromium.org> Cr-Commit-Position: refs/branch-heads/5672@{#868} Cr-Branched-From: 5f2a72468eda1eb945b3b5a2298b5d1cd678521e-refs/heads/main@{#1121455} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476751 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* FIXUP: Add pdfium_use_system_libtiff build optionMichal Klocek2023-05-152-0/+3
| | | | | | | | | | | | Add missing extern "C" to msvc linkage. Add public header to source set. This commit amends 95e07600c1df512543c82e6e6070e6c1447df91e Task-number: QTBUG-111626 Change-Id: I8b5c05f753d20a9b1643691551eeeb7a87e2544f Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/477700 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* [Backport] Fix SharedImageFactory log messagePeter Varga2023-05-122-5/+21
| | | | | | | | | | | | | | | | | SharedImageFactory::GetFactoryByUsage() logs an error message if it failed to find a backing factory. SharedImageFactory was changed to try GetFactoryByUsage() more than once with different parameters now. Change the error message to only be logged when there is actually a failure to find a suitable factory. Low-Coverage-Reason: No tests for error logs. Bug: 1293509 Change-Id: Ic8390a8f3ee2729c4a2e33f5921ba635049e2d7c Review-URL: https://chromium-review.googlesource.com/c/chromium/src/+/3978950 Cr-Commit-Position: refs/heads/main@{#1063786} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/477466 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix v8 context snapshot generator jumbo build compilation issueAnu Aliyas2023-05-111-0/+3
| | | | | | | | - Added missing override ResourceBundle::GetNativeImageNamed(int) Change-Id: I5eef0ed6cea07e39bb2d1c70772f5aa196f9a9ef Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/477170 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Add pdfium_use_system_libtiff build optionMichal Klocek2023-05-054-54/+76
| | | | | | | | | | | | | | | | | | | This change is based on: https://pdfium-review.googlesource.com/c/pdfium/+/105650 Compared to original change it is however fixed to really use system headers and not just compile against embedded tiff library headers and link to system libtiff. Note that pdfium/thirdparty/tiffiop.h is a private header which is not going to be present as system include, therefore fix implementation to use public header instead tiffio.h Task-number: QTBUG-111626 Change-Id: I21ac717361c7fc43c1ab2b5158d758b766026c64 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475877 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fixup for '[Backport] CVE-2023-1818: Use after free in Vulkan. (2/2)'Michael Brüning2023-05-051-3/+4
| | | | | | | | Missing a closing bracket in Windows specific code. Change-Id: Ie776ad68356b92f0a2483b3b269cceea757ec093 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/476097 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Bump V8_PATCH_LEVELMichael Brüning2023-05-041-1/+1
| | | | | | | Change-Id: I968ee29429d6cfd3969a3eccc9517bd0b0ccb7ec Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475998 Reviewed-by: Michal Klocek <michal.klocek@qt.io> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1815: Use after free in Networking APIsYoichi Osato2023-05-022-136/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4280021: Call each NetworkStateObserver separately. NetworkStateNotifier used to have NetworkStateObserver list as HashMap<SingleThreadTaskRunner*, Vector<NetworkStateObserver*>> and call each observer on a taskrunner sequentially. That caused race condition and use-after-free: what if an observer calls wait and other observer removes all? We also should not guarantee the order of registering observers is kept as notification order: each observer should not depend on others. To fix that, this patch reconstructs the structure to HashMap<NetworkStateObserver*, SingleThreadTaskRunner*> and call each observer on each taskrunner separately. This implementation follows base/observer_list_threadsafe.h except the taskrunner is given by the caller. Fixed: 1278708 Change-Id: Iff5d0008d5b0d98caa5931e2806db3ffc52be6fa Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4280021 Reviewed-by: Kent Tamura <tkent@chromium.org> Commit-Queue: Yoichi Osato <yoichio@chromium.org> Cr-Commit-Position: refs/heads/main@{#1111448} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/475426 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1428820 (3/3)Kenichi Ishibashi2023-05-021-3/+4
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4437791: Check callback availability in SpdyProxyClientSocket::RunWriteCallback OnClose() could consume `write_callback_` so it may not be available when RunWriteCallback() is invoked. Bug: 1428820 Change-Id: I9a5ade62d67f5bf15e12d0915d1ad6098657ffd4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4437791 Code-Coverage: Findit <findit-for-me@appspot.gserviceaccount.com> Reviewed-by: Adam Rice <ricea@chromium.org> Commit-Queue: Kenichi Ishibashi <bashi@chromium.org> Cr-Commit-Position: refs/heads/main@{#1131689} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474647 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1428820 (2/3)Kenichi Ishibashi2023-05-021-0/+7
| | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4394863: Check SpdyProxyClientSocket is alive after write callback To ensure that we don't use any member field. Bug: 1428820 Change-Id: Icf6677c652a47dc2fd2d01675e94cda031a015f2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4394863 Commit-Queue: Kenichi Ishibashi <bashi@chromium.org> Cr-Commit-Position: refs/heads/main@{#1125634} (cherry picked from commit b71541b22ca19d5c3a7c01fedffe521b26577b72) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474646 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1428820 (1/3)Kenichi Ishibashi2023-05-022-14/+6
| | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4393905: Remove the second WeakPtrFactory from SpdyProxyClientSocket It was introduced [1] to work around an old issue that wouldn't happen any more since we store a write callback in the class. Instead of having the second WeakPtrFactory and moving the callback, we can just keep it until RunWriteCallback() is called. This is a speculative fix for the linked bug. [1] https://codereview.chromium.org/338583003/ Bug: 1428820 Change-Id: I0b5af2675b68188e208c2ecd42293251b2722b28 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4393905 Commit-Queue: Kenichi Ishibashi <bashi@chromium.org> Cr-Commit-Position: refs/heads/main@{#1125216} (cherry picked from commit 01b25615896b911e21103dd381fafc1f85886d91) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474645 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1404790Geoff Lang2023-05-025-5/+22
| | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/4428752: M112: Mark RGBX and BGRX formats as having 8 unused bits. This makes sure that pixelBytes ends up being 4 and fixes potential buffer size validation. Fix EGL configs using pixelBytes to compute EGL_BUFFER_SIZE which is not supposed to include unused bits. This is covered by dEQP-EGL.functional.query_config.constraints.color_buffer_size Bug: chromium:1404790 Change-Id: Ie0480cbdc6229c4bb3a6c6242337eaed5a3ae3b7 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4428752 Reviewed-by: Amirali Abdolrashidi <abdolrashidi@google.com> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474644 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] Security bug 1360571Florian Leimgruber2023-05-022-11/+12
| | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4352658: Add lock to AlternativeStateNameMap. To prevent the class from accessing its localized_state_names_map_ and localized_state_names_reverse_lookup_map_ members, a lock is added. It locks all reads/write from the aforementioned members. Bug: 1360571, 1414241, 1425951 Change-Id: Ic01b0cba3878748617863274deb04ec9e13645d4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4352658 Reviewed-by: Christoph Schwering <schwering@google.com> Commit-Queue: Florian Leimgruber <fleimgruber@google.com> Cr-Commit-Position: refs/heads/main@{#1119411} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474643 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2137: Heap buffer overflow in sqliteMichael Brüning2023-05-02279-14286/+75705
| | | | | | | | | | | Manual update of sqlite to version 3.41.2 to get to the same version as reviewed in https://chromium-review.googlesource.com/c/chromium/src/+/4404861. This includes the fix for Chromium bug 1430644 / CVE-2023-2137. Change-Id: I79130f25c34e23ed91c9945bc69737a654b41049 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474642 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-2134: Out of bounds memory access in Service Worker APIYoshisato Yanagisawa2023-05-021-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4406580: Stop supporting { handleEvent }. M108 merge issues: content_unittests_bundle_data.filelist: Not present in 108, skipped; Only used in iOS tests on main Make the code aligned with the following specification update: https://github.com/w3c/ServiceWorker/pull/1676 With the previous specification and code, event listener vector can be modified during the GetEffectiveFunction execution, which may bring unexpected vector state. (cherry picked from commit 5105ce37a6853d52ec97894bf6969b3c29a23afd) Change-Id: I732c4c9ab2caebc49a7f4ef52640df7b8476d838 Bug: 1429201 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4394402 Commit-Queue: Yoshisato Yanagisawa <yyanagisawa@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1126483} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4406580 Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Reviewed-by: Yoshisato Yanagisawa <yyanagisawa@chromium.org> Cr-Commit-Position: refs/branch-heads/5359@{#1449} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474621 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-2133: Out of bounds memory access in Service Worker API.Yoshisato Yanagisawa2023-05-021-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4405896: Use ScriptState::Scope instead of setting HandleScope. M108 merge issues: third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc: Conflicting declarations for isolate content_unittests_bundle_data.filelist: Not present in 108, skipped; Only used in iOS tests on main Since `GetEffectiveFunction` may call `Get` if the given v8 listener is an object, we need to prepare `v8::Context::Scope` before calling it. Blink already have a helper class to prepare the environment for the script execution, which has already been used used in other ServiceWorkerGlobalScope member functions. It is `ScriptState::Scope` This CL also use it instead. (cherry picked from commit 299385e09d41d5ce3abd434879b5f9b0a8880cd7) Bug: 1429197 Change-Id: Idbcfdfa9c06160a18b57155a9540f72eed4ec0b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4387655 Commit-Queue: Yoshisato Yanagisawa <yyanagisawa@chromium.org> Commit-Queue: Kouhei Ueno <kouhei@chromium.org> Auto-Submit: Yoshisato Yanagisawa <yyanagisawa@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1125148} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4405896 Reviewed-by: Yoshisato Yanagisawa <yyanagisawa@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/5359@{#1448} Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474620 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-2136: Integer overflow in Skia (2/2)John Stiles2023-05-022-5/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://skia-review.googlesource.com/c/skia/+/673577: Enforce size limits on struct and array declarations. M108 merge issues: resources/sksl/BUILD.bazel: File doesn't exist in M108, tests are added manually to gn/sksl_tests.gni. gn/sksl_tests.gni: Conflicting rts entries tests/sksl/shared/Ossfuzz37900.* Not present in 108, skipped. src/sksl/ir/SkSLType.cpp: - Conflicting includes - MakeStructType(): - Conflicting function signature - context isn't a parameter, used ThreadContext::Context() directly. This improves error reporting by more clearly attaching the error message to the oversized type. Bug: chromium:1432603 Change-Id: I26511f08aff22072cf4913abf7be2c49940a732c Reviewed-on: https://skia-review.googlesource.com/c/skia/+/671377 Commit-Queue: John Stiles <johnstiles@google.com> (cherry picked from commit 1cbd33ecd73523f8d4bf88e9c5576303b39e5556) Reviewed-on: https://skia-review.googlesource.com/c/skia/+/673577 Reviewed-by: John Stiles <johnstiles@google.com> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474619 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-2136: Integer overflow in Skia (1/2)John Stiles2023-05-021-17/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://skia-review.googlesource.com/c/skia/+/673576: Enforce program stack limits on function parameters. M108 merge issues: resources/sksl/BUILD.bazel: File doesn't exist in M108, tests are added manually to gn/sksl_tests.gni. gn/sksl_tests.gni: Conflicting rts entries src/sksl/ir/SkSLFunctionDefinition.cpp: - Conflicting includes - visitStatement(): Conflicting declarations of const Variable* var (const Variable& var on 108) Previously, a function's parameter list did not count against its stack size limit. Bug: chromium:1432603 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: If49dce98f3155f3144a766c26b5a3a39401ce1b2 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/670236 Auto-Submit: John Stiles <johnstiles@google.com> Commit-Queue: John Stiles <johnstiles@google.com> (cherry picked from commit 4dc748f14c6650cb45c7086a39af1760bfda41d2) Reviewed-on: https://skia-review.googlesource.com/c/skia/+/673576 Reviewed-by: John Stiles <johnstiles@google.com> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474618 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] Security bug 1427388Darius M2023-05-021-1/+2
| | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4370790: Prevent constant folding of TypeGuard TypeGuard are used to prevent operations from floating before a preceding check, and thus shouldn't be constant-folded. Fixed: chromium:1427388 Change-Id: Ia42d22ce45005d28c3831a16df23f806c3d68522 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4370790 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Auto-Submit: Darius Mercadier <dmercadier@chromium.org> Reviewed-by: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/main@{#86733} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474617 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-2033: Type Confusion in V8Igor Sheludko2023-05-021-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/4422621: Reland "[M108-LTS][runtime] Make Error.captureStackTrace() a no-op for global object" This is a reland of commit 12be50e5ccf198c6353bc82fe0d17e614bfb7431 Original change's description: > [M108-LTS][runtime] Make Error.captureStackTrace() a no-op for global object > > (cherry picked from commit fa81078cca6964def7a3833704e0dba7b05065d8) > > Bug: chromium:1432210 > Change-Id: I8aa4c3f1d9ecbfffce503085c2879416ff916c69 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4417690 > Commit-Queue: Igor Sheludko <ishell@chromium.org> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org> > Auto-Submit: Igor Sheludko <ishell@chromium.org> > Cr-Original-Commit-Position: refs/heads/main@{#87045} > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4422621 > Reviewed-by: Igor Sheludko <ishell@chromium.org> > Cr-Commit-Position: refs/branch-heads/10.8@{#52} > Cr-Branched-From: f1bc03fd6b4c201abd9f0fd9d51fb989150f97b9-refs/heads/10.8.168@{#1} > Cr-Branched-From: 237de893e1c0a0628a57d0f5797483d3add7f005-refs/heads/main@{#83672} Bug: chromium:1432210 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I4c06a76db005a61b2259b836c1f06c78eb004e16 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4459252 Reviewed-by: Igor Sheludko <ishell@chromium.org> Commit-Queue: Roger Felipe Zanoni da Silva <rzanoni@google.com> Cr-Commit-Position: refs/branch-heads/10.8@{#56} Cr-Branched-From: f1bc03fd6b4c201abd9f0fd9d51fb989150f97b9-refs/heads/10.8.168@{#1} Cr-Branched-From: 237de893e1c0a0628a57d0f5797483d3add7f005-refs/heads/main@{#83672} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474370 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1818: Use after free in Vulkan. (2/2)Zhenyao Mo2023-05-026-47/+93
| | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4242104: Enable GPU watchdog for SwiftShader. At a longer timeout. R=magchen@chromium.org,geofflang@chromium.org TEST=bots Bug: 1223346 Change-Id: Ic8b7f5e77eae5257711d9c210c4ede1816b834be Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4242104 Commit-Queue: Zhenyao Mo <zmo@chromium.org> Reviewed-by: Maggie Chen <magchen@chromium.org> Reviewed-by: Kyle Charbonneau <kylechar@chromium.org> Cr-Commit-Position: refs/heads/main@{#1113632} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474369 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1818: Use after free in Vulkan. (1/2)Geoff Lang2023-05-021-1/+1
| | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/angle/angle/+/3430243: Vulkan: Wait forever when waiting on fences If a timeout occurs while waiting for the VK queue to be idle during context destruction, there is no way to safely delete the resources without potentially crashing as the driver is still reading them. Instead, wait forever and let Chrome's watchdog tear the process down. Bug: chromium:1223346 Change-Id: Ifa91465270f54b62a5ead88e8f26b3315072c380 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3430243 Reviewed-by: Zhenyao Mo <zmo@chromium.org> Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org> Commit-Queue: Geoff Lang <geofflang@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474368 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1819: Out of bounds read in AccessibilityValerie Young2023-05-021-6/+2
| | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4201191: Remove use of g_utf8_substring Bug: 1406588 Change-Id: Iae03fce3d8332fdc5144b9b80a9ba146bf359693 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4201191 Reviewed-by: David Tseng <dtseng@chromium.org> Commit-Queue: Valerie Young <spectranaut@igalia.com> Cr-Commit-Position: refs/heads/main@{#1098756} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474367 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1813: Inappropriate implementation in ExtensionsDanil Somsikov2023-05-021-1/+5
| | | | | | | | | | | | | | Manual cherry-pick of patch originally reviewed on Use built-in URL class instead of string comparison in file URL check. Bug: 1423258 Change-Id: Ie6ea865fbe363c138b372d45d98daf1db6434671 Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/4370246 Commit-Queue: Alex Gough <ajgo@chromium.org> Reviewed-by: Alex Gough <ajgo@chromium.org> Auto-Submit: Danil Somsikov <dsv@chromium.org> Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474366 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1812: Out of bounds memory access in DOM BindingsBenoit Lize2023-05-022-5/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4357658: Take encoding into account for ParkableString hashing Hashing is used for string deduplication, must take encoding into account. See linked bug for details. (cherry picked from commit ab66c0409aece5bd57511792a3867920f31c589b) Bug: 1418224 Change-Id: I63c024d0a97e44b1f3323cd1ca4d9e953c2beed1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4328136 Commit-Queue: Benoit Lize <lizeb@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1117528} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4357658 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Benoit Lize <lizeb@chromium.org> Auto-Submit: Benoit Lize <lizeb@chromium.org> Cr-Commit-Position: refs/branch-heads/5615@{#696} Cr-Branched-From: 9c6408ef696e83a9936b82bbead3d41c93c82ee4-refs/heads/main@{#1109224} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474365 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1811: Use after free in FramesDave Tapuska2023-05-021-2/+9
| | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4372837: Move the edit commands to an on stack variable DevTools uses nested event loops and the usage of the class member can be problematic for iteration because the nested loop can change the variable's storage causing a UAF. Bug: 1420510 Change-Id: Ie08a71b60401fa4322cca0cc31062ba64672126a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4355811 Commit-Queue: Dave Tapuska <dtapuska@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/main@{#1120123} (cherry picked from commit d9b34f0f3a2d0dd73648eca3ef940fb66806227b) Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474364 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* [Backport] CVE-2023-1810: Heap buffer overflow in Visualskylechar2023-05-022-9/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | Cherry-pick of patch originallt reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4298330: Add CHECKs in HostFrameSinkManager It looks like it's possible for a compromised renderer to get multiple things to register the same FrameSinkId with HostFrameSinkManager. This violates assumptions around ownership so turn DCHECKs here into CHECKs. Also convert DCHECKs into CHECKs for registering/unregistering frame sink hierarchy just in case. (cherry picked from commit a707ac2d95e4726f4cf0267c9b0c038926c2a691) Bug: 1414018 Change-Id: If948e758a8484024666f4066360620bc3a9cb493 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4283141 Reviewed-by: Martin Kreichgauer <martinkr@google.com> Reviewed-by: Jonathan Ross <jonross@chromium.org> Commit-Queue: Kyle Charbonneau <kylechar@chromium.org> Cr-Original-Commit-Position: refs/heads/main@{#1109533} Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4298330 Cr-Commit-Position: refs/branch-heads/5615@{#69} Cr-Branched-From: 9c6408ef696e83a9936b82bbead3d41c93c82ee4-refs/heads/main@{#1109224} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474363 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix v8 context snapshot generator compilationMichal Klocek2023-04-283-2/+152
| | | | | | | | Add missing overrides. Change-Id: I5d5a8b6522eca9bb7511a6533abb4cdedcf1fd33 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/470769 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Fix build with ICU 70Allan Sandfeld Jensen2023-04-273-1/+10
| | | | | | | Change-Id: Ic32597652ad0cce85328911e95fc88bd383fe4e9 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474025 Reviewed-by: Szabolcs David <davidsz@inf.u-szeged.hu> Reviewed-by: Martin Negyokru <negyokru@inf.u-szeged.hu>
* Fixup 'Fixes for jumbo build'Michael Brüning2023-04-261-2/+2
| | | | | | | | | | | | | | The fix for jumbo builds renamed the function ProvideInputCallback to ProvideInputCallback2, but did not update the call site. This was probably hidden in jumbo builds as there is another function with the same signature in the decoder counterpart, but might have lead to some undefined / unwanted behaviour. Change-Id: I29129e5323bc3271016b7373cd49dc995749c7c9 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/474116 Reviewed-by: Anu Aliyas <anu.aliyas@qt.io> Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Avoid exporting API from static ANGLE buildsAllan Sandfeld Jensen2023-04-266-11/+16
| | | | | | Change-Id: I28a2920b80d8c8b68a7419b7a8df2f13a1aa9291 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/470612 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* Collect extra gpu info on in-process-gpu tooAllan Sandfeld Jensen2023-04-201-0/+6
| | | | | | | | This gives us ANGLE feature data in chrome://gpu Change-Id: If4b1eae4697a297ae86f8d85059f531fe1924c8b Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/473467 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* Revert "[Backport] CVE-2023-0704: Insufficient policy enforcement in DevTools"Michael Brüning2023-04-184-37/+0
| | | | | | | | | | This reverts commit 0717211ca9d7ee2dcc17a7964170d633aafcfb98. Reason for revert: It is causing trouble with the inspector and it is low impact and should not matter for production use cases. Change-Id: If85063ed8cfa8b8cf754d4c958da6e540d87e44a Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/472951 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* Do not stop navigation during saving the page if not necessarySzabolcs David2023-04-051-1/+2
| | | | | | | | | | Calling Stop() interrupts printing, even if there is no page load in progress. Task-number: QTBUG-108154 Change-Id: Ibb8e898c3c7e7ea1933c88aa32d8f96604a6527a Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/470895 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
* Pass through non-keymutex share handlesAllan Sandfeld Jensen2023-04-043-2/+10
| | | | | | | | | For some reason I can't get the keymutex share handles to work, but we can work with non-keyed shared handles. Change-Id: I3e7f387570775a6cd23e17582e6ce36a79c5f111 Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/467974 Reviewed-by: Peter Varga <pvarga@inf.u-szeged.hu>
* [Backport] CVE-2023-1236: Inappropriate implementation in Internalsahmedmoussa2023-04-047-7/+32
| | | | | | | | | | | | | | | | | | | | | Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4014983: Fix PresentationRequest Origin not shown issue when Opaque The origin info from the PresentationRequest is not shown when the origin is opaque. This CL fixes that issue. Bug: 1374518 Change-Id: Iec1902f4918ae92315051abfb97d8fecfcbc7e11 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4014983 Reviewed-by: Takumi Fujimoto <takumif@chromium.org> Reviewed-by: Mark Foltz <mfoltz@chromium.org> Commit-Queue: Ahmed Moussa <ahmedmoussa@google.com> Reviewed-by: Tommy Steimel <steimel@chromium.org> Reviewed-by: Chris Thompson <cthomp@chromium.org> Cr-Commit-Position: refs/heads/main@{#1096324} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468199 Reviewed-by: Michal Klocek <michal.klocek@qt.io>
* [Backport] CVE-2023-0704: Insufficient policy enforcement in DevToolsAlex Rudenko2023-04-044-0/+37
| | | | | | | | | | | | | | | | | | | | | | | Manual cherry-pick of patch originaly reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4106102: DevTools: reject debugging web socket connections with a defined Origin header Unless the browser is started with a new flag `--remote-allow-origins=<origin>[,<origin>, ...]`. The star origin `*` allows all origins. This CL should not affect non-browser clients such as Puppeteer and WebDriver. It affects DevTools e2e tests in the hosted mode which is fixed in [1]. It should not affect features like remote debugging that don't use web sockets. [1]: https://crrev.com/c/4112007 Bug: chromium:1385982 Change-Id: I721f7db3167ebab63416c8a1f48281735f063e48 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4106102 Reviewed-by: Dmitry Gozman <dgozman@chromium.org> Commit-Queue: Alex Rudenko <alexrudenko@chromium.org> Reviewed-by: Andrey Kosyakov <caseq@chromium.org> Reviewed-by: Danil Somsikov <dsv@chromium.org> Cr-Commit-Position: refs/heads/main@{#1085812} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/461071 Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
View Lorry Controller Status