[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.1-2-29-g5dbcb1c
Michael Gilbert
michael.s.gilbert at gmail.com
Tue Jun 29 04:11:27 UTC 2010
The following commit has been merged in the debian/unstable branch:
commit 725dfa03752647edaca1c3969f098a9d62010aa4
Author: Michael Gilbert <michael.s.gilbert at gmail.com>
Date: Mon Jun 28 21:31:35 2010 -0400
fix cve-2010-1422
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 681172d..025666a 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -2151,7 +2151,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
node->dispatchEvent(keydown, ec);
- return keydown->defaultHandled() || keydown->defaultPrevented();
+ // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
+ bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
+ return keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
}
// Run input method in advance of DOM event handling. This may result in the IM
@@ -2171,7 +2173,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
}
node->dispatchEvent(keydown, ec);
- bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented();
+ // If frame changed as a result of keydown dispatch, then return early to avoid sending a subsequent keypress message to the new frame.
+ bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
+ bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
if (handledByInputMethod || (keydownResult && !backwardCompatibilityMode))
return keydownResult;
diff --git a/debian/changelog b/debian/changelog
index f665caf..e2c33c8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,7 @@ webkit (1.2.1-3) UNRELEASED; urgency=low
* Fix cve-2010-1417: possible code execution in the css implementation (this
currently duplicated as cve-2010-1665 in the cve tracker).
* Fix cve-2010-1418: remote web script and/or html injection.
+ * Fix cve-2010-1422: keyboard focus hijack.
-- Michael Gilbert <michael.s.gilbert at gmail.com> Thu, 27 May 2010 20:36:41 -0400
diff --git a/debian/patches/cve-2010-1422.patch b/debian/patches/cve-2010-1422.patch
new file mode 100644
index 0000000..b8c9faf
--- /dev/null
+++ b/debian/patches/cve-2010-1422.patch
@@ -0,0 +1,29 @@
+description: fix cve-2010-1422
+author: Michael Gilbert <michael.s.gilbert at gmail.com>
+origin: http://trac.webkit.org/changeset/58829
+Index: webkit-1.2.1/WebCore/page/EventHandler.cpp
+===================================================================
+--- webkit-1.2.1.orig/WebCore/page/EventHandler.cpp 2010-05-13 16:31:30.000000000 -0400
++++ webkit-1.2.1/WebCore/page/EventHandler.cpp 2010-06-28 21:29:21.000000000 -0400
+@@ -2151,7 +2151,9 @@
+
+ if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
+ node->dispatchEvent(keydown, ec);
+- return keydown->defaultHandled() || keydown->defaultPrevented();
++ // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
++ bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
++ return keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
+ }
+
+ // Run input method in advance of DOM event handling. This may result in the IM
+@@ -2171,7 +2173,9 @@
+ }
+
+ node->dispatchEvent(keydown, ec);
+- bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented();
++ // If frame changed as a result of keydown dispatch, then return early to avoid sending a subsequent keypress message to the new frame.
++ bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
++ bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
+ if (handledByInputMethod || (keydownResult && !backwardCompatibilityMode))
+ return keydownResult;
+
diff --git a/debian/patches/series b/debian/patches/series
index d156010..4bf25a5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@ cve-2010-1417+1665.patch
cve-2010-1418-part1.patch
cve-2010-1418-part2.patch
cve-2010-1418-part3.patch
+cve-2010-1422.patch
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list