RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 07:27:45 +00:00
Code Issues Activity Actions

LibWeb: Fix UAF in CSSStyleSheet

Browse source 
CSSNamespaceRule returns a copy of a DeprecatedString, meaning that the
view returned by the namespace in CSSStyleSheet is into a temporary
string.
This commit is contained in:
Shannon Booth 2023-11-24 19:14:24 +13:00 • committed by Andreas Kling
parent 673329e1bd
commit b7bcdf7c53
2 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Userland/Libraries/LibWeb/CSS/CSSStyleSheet.cpp
View file

@ -146,19 +146,19 @@ void CSSStyleSheet::set_style_sheet_list(Badge<StyleSheetList>, StyleSheetList*
m_style_sheet_list = list; m_style_sheet_list = list;
} }
Optional<StringView> CSSStyleSheet::default_namespace() const Optional<FlyString> CSSStyleSheet::default_namespace() const
{ {
if (m_default_namespace_rule) if (m_default_namespace_rule)
return m_default_namespace_rule->namespace_uri().view(); return MUST(FlyString::from_deprecated_fly_string(m_default_namespace_rule->namespace_uri()));
return {}; return {};
} }
Optional<StringView> CSSStyleSheet::namespace_uri(StringView namespace_prefix) const Optional<FlyString> CSSStyleSheet::namespace_uri(StringView namespace_prefix) const
{ {
return m_namespace_rules.get(namespace_prefix) return m_namespace_rules.get(namespace_prefix)
.map([](JS::GCPtr<CSSNamespaceRule> namespace_) { .map([](JS::GCPtr<CSSNamespaceRule> namespace_) {
return namespace_->namespace_uri().view(); return MUST(FlyString::from_deprecated_fly_string(namespace_->namespace_uri()));
}); });
} }

4
Userland/Libraries/LibWeb/CSS/CSSStyleSheet.h
View file

@ -50,8 +50,8 @@ public:
void set_style_sheet_list(Badge<StyleSheetList>, StyleSheetList*); void set_style_sheet_list(Badge<StyleSheetList>, StyleSheetList*);
Optional<StringView> default_namespace() const; Optional<FlyString> default_namespace() const;
Optional<StringView> namespace_uri(StringView namespace_prefix) const; Optional<FlyString> namespace_uri(StringView namespace_prefix) const;
private: private:
CSSStyleSheet(JS::Realm&, CSSRuleList&, MediaList&, Optional<AK::URL> location); CSSStyleSheet(JS::Realm&, CSSRuleList&, MediaList&, Optional<AK::URL> location);