[Webkit-unassigned] [Bug 15811] New: WebKit plug-ins can re-enter WebKit under attach()
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Fri Nov 2 21:14:24 PDT 2007
http://bugs.webkit.org/show_bug.cgi?id=15811
Summary: WebKit plug-ins can re-enter WebKit under attach()
Product: WebKit
Version: 523.x+ (nightly)
Platform: Macintosh
OS/Version: Mac OS X 10.4
Status: NEW
Severity: Normal
Priority: P2
Component: Layout and Rendering
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: mitz at webkit.org
CC: andersca at apple.com
[This is a follow-up to bug 15405 regarding the general case]
HTMLObjectElement::attach() calls RenderPartObject::updateWidget() which lets
WebKit plugins execute arbitrary code, potentially re-entering WebKit.
I think at some point the protection against creating widgets when
updateWidget() is called by attach() applied to WebKit plug-ins, but later it
was restricted to Netscape plug-ins.
--
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
More information about the webkit-unassigned
mailing list