From 2e05260455cfe47b9bbab5ecf869def3f5eff63c Mon Sep 17 00:00:00 2001 From: darin Date: Sat, 19 Mar 2005 19:34:56 +0000 Subject: [PATCH] Reviewed by Maciej (a while back). - fixed local-file security check is allowing plug-in streams, but must not * Plugins.subproj/WebNetscapePluginStream.m: (-[WebNetscapePluginStream initWithRequest:pluginPointer:notifyData:sendNotification:]): Roll out change I made on 3-13. That change is needed for subresource, but not for plug-in streams. For plug-in streams it's too risky, and leaves a serious security hole open. git-svn-id: https://svn.webkit.org/repository/webkit/trunk@8934 268f45cc-cd09-0410-ab3c-d52691b4dbfc --- WebKit/ChangeLog | 11 +++++++++++ WebKit/Plugins.subproj/WebNetscapePluginStream.m | 6 ++---- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog index 06095b093f59..476e96ae1491 100644 --- a/WebKit/ChangeLog +++ b/WebKit/ChangeLog @@ -1,3 +1,14 @@ +2005-03-19 Darin Adler + + Reviewed by Maciej (a while back). + + - fixed local-file security check is allowing plug-in streams, but must not + + * Plugins.subproj/WebNetscapePluginStream.m: + (-[WebNetscapePluginStream initWithRequest:pluginPointer:notifyData:sendNotification:]): + Roll out change I made on 3-13. That change is needed for subresource, but not for plug-in streams. + For plug-in streams it's too risky, and leaves a serious security hole open. + 2005-03-19 Darin Adler Reviewed by Ken and John. diff --git a/WebKit/Plugins.subproj/WebNetscapePluginStream.m b/WebKit/Plugins.subproj/WebNetscapePluginStream.m index 90123f068233..3072c6d1f645 100644 --- a/WebKit/Plugins.subproj/WebNetscapePluginStream.m +++ b/WebKit/Plugins.subproj/WebNetscapePluginStream.m @@ -38,11 +38,9 @@ WebBaseNetscapePluginView *view = (WebBaseNetscapePluginView *)thePluginPointer->ndata; WebBridge *bridge = [[view webFrame] _bridge]; - - // Since this is a subresource, we can load any URL (we ignore the return value). - // But we still want to know whether we should hide the referrer or not, so we call the canLoadURL method. BOOL hideReferrer; - [bridge canLoadURL:[theRequest URL] fromReferrer:[bridge referrer] hideReferrer:&hideReferrer]; + if (![bridge canLoadURL:[theRequest URL] fromReferrer:[bridge referrer] hideReferrer:&hideReferrer]) + return nil; if ([self initWithRequestURL:[theRequest URL] pluginPointer:thePluginPointer -- 2.36.0