Attachment 256784 Details for Bug 140067 – Patch

[patch] Patch

bug-140067-20150714140759.patch (text/plain), 11.22 KB, created by Michael Catanzaro on 2015-07-14 12:09:06 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Catanzaro

Created: 2015-07-14 12:09:06 PDT

Size: 11.22 KB

patch

obsolete

>Subversion Revision: 186808
>diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
>index ca716be7eb5ad1d2ee2a111e4b19744ff3961ef1..ddabf798768f39772c63446027f15feddbf880d9 100644
>--- a/Source/WebKit2/ChangeLog
>+++ b/Source/WebKit2/ChangeLog
>@@ -1,3 +1,22 @@
>+2015-07-14  Michael Catanzaro  <mcatanzaro@igalia.com>
>+
>+        [Linux] SeccompFilters: whitelist all NPAPI plugin directories
>+        https://bugs.webkit.org/show_bug.cgi?id=140067
>+
>+        Reviewed by Å½an DoberÅ¡ek.
>+
>+        * PlatformEfl.cmake: Build PluginSearchPath.cpp
>+        * PlatformGTK.cmake: Build PluginSearchPath.cpp
>+        * Shared/Plugins/unix/PluginSearchPath.cpp: Added.
>+        (WebKit::pluginsDirectories): Moved from PluginInfoStoreUnix.cpp.
>+        * Shared/Plugins/unix/PluginSearchPath.h: Added.
>+        * Shared/linux/SeccompFilters/SyscallPolicy.cpp:
>+        (WebKit::SyscallPolicy::addDefaultWebProcessPolicy): Add the entire
>+        plugin search path to the whitelist.
>+        * UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp:
>+        (WebKit::PluginInfoStore::pluginsDirectories): Now gets plugins
>+        directories from PluginSearchPath.cpp
>+
> 2015-07-14  Yongjun Zhang  <yongjun_zhang@apple.com>
> 
>         https://bugs.webkit.org/show_bug.cgi?id=146917
>diff --git a/Source/WebKit2/PlatformEfl.cmake b/Source/WebKit2/PlatformEfl.cmake
>index 56813ffa4cc7e0ad73b4f8560befb6442d7816b9..a31d669ebce0b8f8d49d809ff030cb2a4031ca38 100644
>--- a/Source/WebKit2/PlatformEfl.cmake
>+++ b/Source/WebKit2/PlatformEfl.cmake
>@@ -34,6 +34,8 @@ list(APPEND WebKit2_SOURCES
> 
>     Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
> 
>+    Shared/Plugins/unix/PluginSearchPath.cpp
>+
>     Shared/cairo/ShareableBitmapCairo.cpp
> 
>     Shared/efl/NativeContextMenuItemEfl.cpp
>@@ -235,6 +237,7 @@ list(APPEND WebKit2_INCLUDE_DIRECTORIES
>     "${WEBKIT2_DIR}/Shared/CoordinatedGraphics"
>     "${WEBKIT2_DIR}/Shared/Downloads/soup"
>     "${WEBKIT2_DIR}/Shared/Network/CustomProtocols/soup"
>+    "${WEBKIT2_DIR}/Shared/Plugins/unix"
>     "${WEBKIT2_DIR}/Shared/efl"
>     "${WEBKIT2_DIR}/Shared/soup"
>     "${WEBKIT2_DIR}/Shared/unix"
>diff --git a/Source/WebKit2/PlatformGTK.cmake b/Source/WebKit2/PlatformGTK.cmake
>index 461183bfffcd016c977c0c31f7a44838f2f28962..123265f5493cdf025dd555198f89a1e915e5caa4 100644
>--- a/Source/WebKit2/PlatformGTK.cmake
>+++ b/Source/WebKit2/PlatformGTK.cmake
>@@ -55,6 +55,8 @@ list(APPEND WebKit2_SOURCES
> 
>     Shared/Plugins/Netscape/x11/NetscapePluginModuleX11.cpp
> 
>+    Shared/Plugins/unix/PluginSearchPath.cpp
>+
>     Shared/cairo/ShareableBitmapCairo.cpp
> 
>     Shared/gtk/ArgumentCodersGtk.cpp
>@@ -470,6 +472,7 @@ list(APPEND WebKit2_INCLUDE_DIRECTORIES
>     "${WEBKIT2_DIR}/Shared/API/c/gtk"
>     "${WEBKIT2_DIR}/Shared/Network/CustomProtocols/soup"
>     "${WEBKIT2_DIR}/Shared/Downloads/soup"
>+    "${WEBKIT2_DIR}/Shared/Plugins/unix"
>     "${WEBKIT2_DIR}/Shared/gtk"
>     "${WEBKIT2_DIR}/Shared/soup"
>     "${WEBKIT2_DIR}/Shared/unix"
>diff --git a/Source/WebKit2/Shared/Plugins/unix/PluginSearchPath.cpp b/Source/WebKit2/Shared/Plugins/unix/PluginSearchPath.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..2dc9498afb171f624cbdece64d81fcc8cd7f4dac
>--- /dev/null
>+++ b/Source/WebKit2/Shared/Plugins/unix/PluginSearchPath.cpp
>@@ -0,0 +1,76 @@
>+/*
>+ * Copyright (C) 2015 Igalia S.L.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+ * THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "PluginSearchPath.h"
>+
>+#include <WebCore/FileSystem.h>
>+
>+using namespace WebCore;
>+
>+namespace WebKit {
>+
>+Vector<String> pluginsDirectories()
>+{
>+    Vector<String> result;
>+
>+#if ENABLE(NETSCAPE_PLUGIN_API)
>+    result.append(homeDirectoryPath() + "/.mozilla/plugins");
>+    result.append(homeDirectoryPath() + "/.netscape/plugins");
>+    result.append("/usr/lib/browser/plugins");
>+    result.append("/usr/local/lib/mozilla/plugins");
>+    result.append("/usr/lib/firefox/plugins");
>+    result.append("/usr/lib64/browser-plugins");
>+    result.append("/usr/lib/browser-plugins");
>+    result.append("/usr/lib/mozilla/plugins");
>+    result.append("/usr/local/netscape/plugins");
>+    result.append("/opt/mozilla/plugins");
>+    result.append("/opt/mozilla/lib/plugins");
>+    result.append("/opt/netscape/plugins");
>+    result.append("/opt/netscape/communicator/plugins");
>+    result.append("/usr/lib/netscape/plugins");
>+    result.append("/usr/lib/netscape/plugins-libc5");
>+    result.append("/usr/lib/netscape/plugins-libc6");
>+    result.append("/usr/lib64/netscape/plugins");
>+    result.append("/usr/lib64/mozilla/plugins");
>+    result.append("/usr/lib/nsbrowser/plugins");
>+    result.append("/usr/lib64/nsbrowser/plugins");
>+
>+    String mozillaHome(getenv("MOZILLA_HOME"));
>+    if (!mozillaHome.isEmpty())
>+        result.append(mozillaHome + "/plugins");
>+
>+    String mozillaPaths(getenv("MOZ_PLUGIN_PATH"));
>+    if (!mozillaPaths.isEmpty()) {
>+        Vector<String> paths;
>+        mozillaPaths.split(UChar(':'), /* allowEmptyEntries */ false, paths);
>+        result.appendVector(paths);
>+    }
>+#endif
>+
>+    return result;
>+}
>+
>+} // namespace WebKit
>diff --git a/Source/WebKit2/Shared/Plugins/unix/PluginSearchPath.h b/Source/WebKit2/Shared/Plugins/unix/PluginSearchPath.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..25a13ec8e7247913acf3b19dbe463c313167bb72
>--- /dev/null
>+++ b/Source/WebKit2/Shared/Plugins/unix/PluginSearchPath.h
>@@ -0,0 +1,38 @@
>+/*
>+ * Copyright (C) 2015 Igalia S.L.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
>+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
>+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
>+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
>+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
>+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
>+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
>+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
>+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
>+ * THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#ifndef PluginSearchPath_h
>+#define PluginSearchPath_h
>+
>+#include <wtf/Forward.h>
>+#include <wtf/Vector.h>
>+
>+namespace WebKit {
>+
>+Vector<String> pluginsDirectories();
>+
>+} // namespace WebKit
>+
>+#endif // PluginSandboxProfile_h
>diff --git a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp b/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>index 5234455dd16a4865f5196a2d3594e0e5d964449f..1ef946cb5f9175fb3bc8de4bd67346bb4ff203d7 100644
>--- a/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>+++ b/Source/WebKit2/Shared/linux/SeccompFilters/SyscallPolicy.cpp
>@@ -28,6 +28,7 @@
> 
> #if ENABLE(SECCOMP_FILTERS)
> 
>+#include "PluginSearchPath.h"
> #include "WebProcessCreationParameters.h"
> #include <libgen.h>
> #include <string.h>
>@@ -146,6 +147,10 @@ void SyscallPolicy::addDefaultWebProcessPolicy(const WebProcessCreationParameter
>     addDirectoryPermission(ASCIILiteral(DATADIR), Read);
>     addDirectoryPermission(ASCIILiteral(LIBDIR), Read);
> 
>+    // Plugin search path
>+    for (String& path : pluginsDirectories())
>+        addDirectoryPermission(path, Read);
>+
>     // SSL Certificates.
>     addDirectoryPermission(ASCIILiteral("/etc/ssl/certs"), Read);
> 
>diff --git a/Source/WebKit2/UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp b/Source/WebKit2/UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp
>index 3c668719fd3cb57ebae867ebb5ef12da1563b4e4..cfe9bd7b47dd174d2e97977aa8cfdd3aba42280f 100644
>--- a/Source/WebKit2/UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp
>+++ b/Source/WebKit2/UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp
>@@ -32,6 +32,7 @@
> #include "PluginInfoStore.h"
> 
> #include "NetscapePluginModule.h"
>+#include "PluginSearchPath.h"
> #include <WebCore/FileSystem.h>
> 
> #if PLATFORM(GTK)
>@@ -44,41 +45,7 @@ namespace WebKit {
> 
> Vector<String> PluginInfoStore::pluginsDirectories()
> {
>-    Vector<String> result;
>-
>-    result.append(homeDirectoryPath() + "/.mozilla/plugins");
>-    result.append(homeDirectoryPath() + "/.netscape/plugins");
>-    result.append("/usr/lib/browser/plugins");
>-    result.append("/usr/local/lib/mozilla/plugins");
>-    result.append("/usr/lib/firefox/plugins");
>-    result.append("/usr/lib64/browser-plugins");
>-    result.append("/usr/lib/browser-plugins");
>-    result.append("/usr/lib/mozilla/plugins");
>-    result.append("/usr/local/netscape/plugins");
>-    result.append("/opt/mozilla/plugins");
>-    result.append("/opt/mozilla/lib/plugins");
>-    result.append("/opt/netscape/plugins");
>-    result.append("/opt/netscape/communicator/plugins");
>-    result.append("/usr/lib/netscape/plugins");
>-    result.append("/usr/lib/netscape/plugins-libc5");
>-    result.append("/usr/lib/netscape/plugins-libc6");
>-    result.append("/usr/lib64/netscape/plugins");
>-    result.append("/usr/lib64/mozilla/plugins");
>-    result.append("/usr/lib/nsbrowser/plugins");
>-    result.append("/usr/lib64/nsbrowser/plugins");
>-
>-    String mozillaHome(getenv("MOZILLA_HOME"));
>-    if (!mozillaHome.isEmpty())
>-        result.append(mozillaHome + "/plugins");
>-
>-    String mozillaPaths(getenv("MOZ_PLUGIN_PATH"));
>-    if (!mozillaPaths.isEmpty()) {
>-        Vector<String> paths;
>-        mozillaPaths.split(UChar(':'), /* allowEmptyEntries */ false, paths);
>-        result.appendVector(paths);
>-    }
>-
>-    return result;
>+    return WebKit::pluginsDirectories();
> }
> 
> Vector<String> PluginInfoStore::pluginPathsInDirectory(const String& directory)

Actions: View | Formatted Diff | Diff

Attachments on bug 140067: 243954 | 249295 | 256703 | 256784