From 39ed1862f1a4d09daf4bc9a35c553b5c6612d20f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Z=C3=BCnd?= Date: Wed, 11 Jan 2023 05:55:14 +0000 Subject: [Backport] CVE-2023-1235: Type Confusion in DevTools MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cherry-pick of commit originally reviewed on https://chromium-review.googlesource.com/c/chromium/src/+/4150308: Ensure that invoked method is an actual v8::Function CallMethodOnFrame invokes a function part of an object which in turn is installed on globalThis. E.g. globalThis['foo'].bar(); CallMethodOnFrame already bails out if 'foo' or 'bar' can't be found, but we should also bail out if 'bar' is not an actual function. Fixed: 1404704 Change-Id: I67c0883a53b358176898bd04fad3c45cf98721ed Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4150308 Reviewed-by: David Bokan Commit-Queue: Simon Zünd Cr-Commit-Position: refs/heads/main@{#1091189} Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/468226 Reviewed-by: Michal Klocek --- .../third_party/blink/renderer/core/frame/local_frame_mojo_handler.cc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/chromium/third_party/blink/renderer/core/frame/local_frame_mojo_handler.cc b/chromium/third_party/blink/renderer/core/frame/local_frame_mojo_handler.cc index 47b86ec9111..b40e145b028 100644 --- a/chromium/third_party/blink/renderer/core/frame/local_frame_mojo_handler.cc +++ b/chromium/third_party/blink/renderer/core/frame/local_frame_mojo_handler.cc @@ -206,9 +206,11 @@ v8::MaybeLocal CallMethodOnFrame(LocalFrame* local_frame, v8::Local object; v8::Local method; if (!GetProperty(context, context->Global(), object_name).ToLocal(&object) || - !GetProperty(context, object, method_name).ToLocal(&method)) { + !GetProperty(context, object, method_name).ToLocal(&method) || + !method->IsFunction()) { return v8::MaybeLocal(); } + CHECK(method->IsFunction()); return local_frame->DomWindow() ->GetScriptController() -- cgit v1.2.1