Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: 8-x-y
Branches Tags
electron
/
patches
/
chromium
/
backport_1073409.patch

backport_1073409.patch 2.6 KB
Permalink History Raw

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Cheng Zhao <[email protected]>
    3. 

  3. Date: Thu, 4 Oct 2018 14:57:02 -0700
    4. 

  4. Subject: fix: use parseHTMLSubset() in chrome://histograms.
    5. 

  5. 

  6. [1073409] [Low] [CVE-2020-6535]: XSS on chrome://histograms/ with a compromised renderer
    7. 

  7. Backport https://chromium.googlesource.com/chromium/src/+/9a31a7ea51e0c7548f4ed77f5007e4a924ef0fbb
    8. 

  8. 

  9. diff --git a/content/browser/resources/histograms/BUILD.gn b/content/browser/resources/histograms/BUILD.gn
    10. 

  10. index 9b67dcd52b2599855eb21b86b29a294094b22003..08c7f14373fa097bf540c60301d3802685affe0e 100644
    11. 

  11. --- a/content/browser/resources/histograms/BUILD.gn
    12. 

  12. +++ b/content/browser/resources/histograms/BUILD.gn
    13. 

  13. @@ -13,6 +13,7 @@ js_type_check("closure_compile") {
    14. 

  14.  js_library("histograms_internals") {
    15. 

  15.    deps = [
    16. 

  16.      "//ui/webui/resources/js:cr",
    17. 

  17. +    "//ui/webui/resources/js:parse_html_subset",
    18. 

  18.      "//ui/webui/resources/js:util",
    19. 

  19.    ]
    20. 

  20.  }
    21. 

  21. diff --git a/content/browser/resources/histograms/histograms_internals.html b/content/browser/resources/histograms/histograms_internals.html
    22. 

  22. index 37e45404843d70bd2621fffc6f5f4e4e69786005..b997e6d2ff88f86c00bf4e4a099cd4999d66c061 100644
    23. 

  23. --- a/content/browser/resources/histograms/histograms_internals.html
    24. 

  24. +++ b/content/browser/resources/histograms/histograms_internals.html
    25. 

  25. @@ -8,6 +8,7 @@
    26. 

  26.    <script src="chrome://resources/js/cr.js"></script>
    27. 

  27.    <script src="chrome://resources/js/promise_resolver.js"></script>
    28. 

  28.    <script src="chrome://resources/js/util.js"></script>
    29. 

  29. +  <script src="chrome://resources/js/parse_html_subset.js"></script>
    30. 

  30.    <script src="histograms_internals.js"></script>
    31. 

  31.    <title>Histograms</title>
    32. 

  32.  </head>
    33. 

  33. diff --git a/content/browser/resources/histograms/histograms_internals.js b/content/browser/resources/histograms/histograms_internals.js
    34. 

  34. index 24c55fb23c9f390a484572fe098e0cdcc79bc4ac..b70641ed43512391e4b75383b68196ba99590638 100644
    35. 

  35. --- a/content/browser/resources/histograms/histograms_internals.js
    36. 

  36. +++ b/content/browser/resources/histograms/histograms_internals.js
    37. 

  37. @@ -24,9 +24,12 @@ function addHistograms(histograms) {
    38. 

  38.      htmlOutput += histogram;
    39. 

  39.    }
    40. 

  40.  
    41. 

  41. -  // NOTE: This is generally unsafe due to XSS attacks. Make sure |htmlOutput|
    42. 

  42. -  // cannot be modified by an external party.
    43. 

  43. -  $('histograms').innerHTML = htmlOutput;
    44. 

  44. +  // The following HTML tags are coming from
    45. 

  45. +  // |HistogramsMessageHandler::HandleRequestHistograms|.
    46. 

  46. +  const sanitizedHTML = parseHtmlSubset(`<span>${htmlOutput}</span>`, [
    47. 

  47. +                          'PRE', 'H4', 'BR', 'HR'
    48. 

  48. +                        ]).firstChild.innerHTML;
    49. 

  49. +  $('histograms').innerHTML = sanitizedHTML;
    50. 

  50.  }
    51. 

  51.  
    52. 

  52.  /**
    53.