RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 14:07:46 +00:00
Code Issues Activity Actions

LibWeb: Protect ourselves during ResourceClient iteration

Browse source 
Notifying a Resource's clients may lead to arbitrary JS execution,
so we can't rely on the ResourceClient pointers remaining valid.
Use WeakPtr to avoid this problem.
This commit is contained in:
Andreas Kling 2020-06-01 22:09:38 +02:00
parent e5ddb76a67
commit 9170edf541
2 changed files with 17 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
Libraries/LibWeb/Loader/Resource.h
View file

@ -32,6 +32,8 @@
#include <AK/Noncopyable.h>
#include <AK/RefCounted.h>
#include <AK/URL.h>
#include <AK/WeakPtr.h>
#include <AK/Weakable.h>
#include <LibWeb/Forward.h>
#include <LibWeb/Loader/LoadRequest.h>
@ -60,17 +62,7 @@ public:
void register_client(Badge<ResourceClient>, ResourceClient&);
void unregister_client(Badge<ResourceClient>, ResourceClient&);
template<typename Callback>
void for_each_client(Callback callback)
{
// FIXME: This should use some kind of smart pointer to ResourceClient!
Vector<ResourceClient*, 16> clients_copy;
clients_copy.ensure_capacity(m_clients.size());
for (auto* client : m_clients)
clients_copy.append(client);
for (auto* client : clients_copy)
callback(*client);
}
void for_each_client(Function<void(ResourceClient&)>);
void did_load(Badge<ResourceLoader>, const ByteBuffer& data, const HashMap<String, String, CaseInsensitiveStringTraits>& headers);
void did_fail(Badge<ResourceLoader>, const String& error);
@ -87,7 +79,7 @@ private:
HashTable<ResourceClient*> m_clients;
};
class ResourceClient {
class ResourceClient : public Weakable<ResourceClient> {
public:
virtual ~ResourceClient();