August 2009 - webkit-dev - lists.webkit.org

Security advice for linux browsers based on WebKit
by Adam Barth 25 Aug '09

25 Aug '09

If you don't use WebKit to build a browser on Linux, you can ignore this message. By default, WebKit allows local HTML files to inject script into any web page. That means that if you open a local HTML file on your machine, it can effective XSS every web site, including the user's bank or webmail provider. To protect against this threat, we have the following setting Settings::setAllowUniversalAccessFromFileURLs which disables this behavior. For legacy reasons, we default this setting to "true," but I'd like to encourage to use the "false" setting by default in your browser, especially if your browser runs on Linux. This issue is particularly important on Linux because many Linux users use a network file system, such as AFS or NFS, which maps the entire world into the local file system. For example, if I made my home directly world-readable, it's quite likely that I would be able to control this URL on your user's machines: file:///afs/cs.stanford.edu/u/abarth If you don't override WebKit's default setting, I might be able to leverage this ability to read your user's email or transact on your user's bank accounts. Of course, even with the "false" setting, I might still be able to read the contents of your user's /etc/passwd file or other sensitive information in your user's file system. Over time, I hope we can further restrict the privileges granted to file URLs. However, removing universal access is a necessary first step. Please let me know if you have any questions. Adam

6 9

Bugzilla Data Loss
by William Siegrist 21 Aug '09

21 Aug '09

Mac OS Forge experienced database corruption during our maintenance reboot this evening and had to roll back to a backup from this morning, August 20 at 2am. Thats about 17 hours of lost data. I cannot begin to explain how deeply sorry I am about this. Obviously, we will be taking corrective actions in the future to prevent this from happening again. I will be relaunching bugzilla shortly after sending this email. You can find some of the lost data captured in the email list archives [1] which may help in recreating bugs or comments. [1] https://lists.webkit.org/pipermail/webkit-unassigned/2009-August/date.html -- William Siegrist Mac OS Forge

6 6

Re: [webkit-dev] [webkit-changes] [47610] trunk/WebCore
by Adam Roben 21 Aug '09

21 Aug '09

On Aug 20, 2009, at 8:07 PM, bweinstein(a)apple.com wrote: > +static inline int adjustedScrollDelta(int beginningDelta) { > + // This implemention matches Firefox's. > + // http://mxr.mozilla.org/firefox/source/toolkit/content/widgets/browser.xml#8… > . > Firefox's implementation is in JavaScript, which means that the numbers are all doubles. Your implementation uses ints. Does the difference matter? -Adam

1 0

Re: [webkit-dev] [webkit-changes] [47592] trunk/JavaScriptCore
by Darin Adler 21 Aug '09

21 Aug '09

On Aug 20, 2009, at 2:04 PM, Yong Li wrote: > If derefIfNotNull() is not inline, it should be static. Otherwise, > you can potentially get a build error like multiple bodies of > "derefIfNotNull<foo>" are found. If this is not a problem to winscw > compiler, ignore this mail. I believe that is true for functions, but not function templates. Have you seen an actual problem? -- Darin

2 1

What should I do？
by Halo Qin 19 Aug '09

19 Aug '09

Hi everyone: I’m an undergraduate student who really wants to be a mobile browser development expert in my future career. Especially, I’m interested in Webkit. But, as wanting to pursue a master degree, I’m confused that what kind of major or field I should apply in graduate school. I want to focus on an academic program that could help me to be a browser developer in my future occupation. Would you give me some advices? Thank you very much :D

2 1

JSC: Array Patch, Seeking Advice
by Brian Barnes 19 Aug '09

19 Aug '09

The last thing I want to do is make you guys job with patches harder, so I thought I'd seek some advice. I created two convenience functions for building arrays with consecutive indexes (i.e., new Array(1,2,3,4,5,6,7,8)). I haven't gone over all the style guidelines yet (but did a quick overview.) I'll do that before I go further, but my question is this: This patch doesn't use anything internal inside JSC itself (it was created outside in my code.) Therefore, it's probably a slow/less efficient path. Is this a bad idea? If so, I'll just scrap the idea before going any further. The functions are: (in JSObjectRef) JSValueRef JSObjectSetArray(JSContextRef ctx,size_t valueCount,const JSValueRef values[],JSValueRef *exception) { JSObjectRef arrayProtoObj; JSStringRef jsStr; JSValueRef arrayVal; // get the array prototype jsStr=JSStringCreateWithUTF8CString("Array"); arrayVal=JSObjectGetProperty(ctx,JSContextGetGlobalObject(ctx),jsStr,exception); JSStringRelease(jsStr); if (arrayVal==NULL) return(NULL); arrayProtoObj=JSValueToObject(ctx,arrayVal,exception); if (arrayProtoObj==NULL) return(NULL); // create the new array object return((JSValueRef)JSObjectCallAsConstructor(ctx,arrayProtoObj,valueCount,values,exception)); } (in JSValueRef) bool JSValueIsArray(JSContextRef ctx,JSValueRef value) { char *ch,str[64]; JSStringRef jsStr; JSObjectRef arrayObj; JSValueRef val; // only check objects if (!JSValueIsObject(ctx,value)) return(FALSE); // get constructor arrayObj=JSValueToObject(ctx,value,NULL); if (arrayObj==NULL) return(FALSE); jsStr=JSStringCreateWithUTF8CString("constructor"); val=JSObjectGetProperty(ctx,arrayObj,jsStr,NULL); JSStringRelease(jsStr); if (val==NULL) return(FALSE); // get constructor as a function jsStr=JSValueToStringCopy(ctx,val,NULL); if (jsStr==NULL) return(FALSE); JSStringGetUTF8CString(jsStr,str,64); str[63]=0x0; JSStringRelease(jsStr); // special check to make sure we don't have Array // anywhere else in a function body or there just // instead a function body ch=strchr(str,'{'); if (ch==NULL) return(FALSE); *ch=0x0; // look for array in string return(strstr(str,"Array")!=NULL); } Thanks for any help ... [>] Brian

2 2

Re: [webkit-dev] [webkit-changes] [47465] trunk/WebKitTools
by Adam Roben 19 Aug '09

19 Aug '09

On Aug 18, 2009, at 8:00 PM, mrowe(a)apple.com wrote: > Bump waitToDumpWatchdogInterval to 15 seconds to match the time-out > used by run-webkit-tests. > Doesn't this create a race condition between the two timers? -Adam

2 2

renaming namespace ARM to ARMRegisters
by Yong Li 19 Aug '09

19 Aug '09

Would anyone please take a look at https://bugs.webkit.org/show_bug.cgi?id=28428 ? It's very simple and clear change: namespace ARM => ARMRegisters. The reason of this change is "ARM" can be used as a macro. -Yong

1 0

About events in WebCore
by Michelangelo De Simone 19 Aug '09

19 Aug '09

Hi, I've been working to add support for the checkValidity() method on (#27452); in order to complete that check I need to understand whether or not a specific event (invalid), previously fired from an element, has been canceled. Now, is there any generic/trivial way to accompish such checks? I don't like the idea to reinvent the wheel if there already is something.:) Thank you. -- Bye, Michelangelo

2 2

Layout Test baselines for Chromium port
by Dimitri Glazkov 19 Aug '09

19 Aug '09

One of the steps in completing the Chromium WebKit port is moving layout test baselines from Chromium repository to svn.webkit.org (https://bugs.webkit.org/show_bug.cgi?id=28397) This is a pretty heavy chunk: over 20K files, weighing about 260MB. In comparison, this is more than the current contents of LayoutTests/platform directory, because we run pixel tests on both Windows and Linux. I am trying to figure out a gentler, kinder way to do this, but as of now don't have anything particularly brilliant. Perhaps the wise webkit-dev has some good thoughts on the subject? :DG<

2 1