Luke Wilde
7e701f6256
LibWeb: Keep unhandledrejection event promises alive when task is queued
...
This is fixed by making the "about to be notified rejected promises
list" use JS::Handle instead of JS::NonnullGCPtr. This UAF happens
because notify_about_rejected_promises makes a local copy of this list,
empties the member variable list and then moves the local copy into a
JS::SafeFunction lambda. JS::SafeFunction can only see GC pointers that
are in its storage, not external storage.
Example exploit (requires fixed microtask timing by removing the dummy
execution context):
```html
<script>
Promise.reject(new Error);
// Exit the script block, causing a microtask checkpoint and thus
// queuing of a task to fire the unhandled rejection event for the
// above promise.
// During the time after being queued but before being ran, these
// promises are not kept alive. This is because JS::SafeFunction cannot
// see into a Vector, meaning it can't visit the stored NonnullGCPtrs.
</script>
<script defer>
// Cause a garbage collection, destroying the above promise.
const b = [];
for (var i = 0; i < 200000; i++)
b.push({});
// Some time after this script block, the queued unhandled rejection
// event task will fire, with the event object containing the dead
// promise.
window.onunhandledrejection = (event) => {
let value = event.promise;
console.log(value);
}
</script>
```
2022-12-25 15:32:51 +01:00
..
2022-12-06 08:54:33 +01:00
2022-12-07 16:43:06 +00:00
2022-12-15 06:56:37 -05:00
2022-12-15 06:56:37 -05:00
2022-12-25 15:32:51 +01:00
2022-12-06 08:54:33 +01:00
2022-11-10 17:02:11 +00:00
2022-11-13 16:37:09 -07:00
2022-12-10 12:03:19 +00:00
2022-12-10 12:03:19 +00:00
2022-11-07 14:10:41 +01:00
2022-11-04 10:38:00 +01:00
2022-10-20 15:16:23 +02:00
2022-10-20 15:16:23 +02:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-10-01 21:05:32 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-10-01 21:05:32 +01:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-09-20 10:32:13 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-11-19 14:37:31 +00:00
2022-09-24 19:31:39 +01:00
2022-09-24 19:31:39 +01:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-10-14 16:01:35 +02:00
2022-09-20 10:32:12 +02:00
2022-12-06 08:54:33 +01:00
2022-12-19 07:57:44 -05:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-19 07:57:44 -05:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-09-21 21:12:24 +01:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-20 15:16:23 +02:00
2022-10-20 15:16:23 +02:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-20 10:34:19 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-14 16:47:57 +00:00
2022-12-06 08:54:33 +01:00
2022-11-13 16:37:09 -07:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-11-25 22:49:59 +01:00
2022-11-07 14:10:41 +01:00
2022-11-07 14:10:41 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-19 07:57:44 -05:00
2022-12-19 07:57:44 -05:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-11-04 10:38:00 +01:00
2022-12-14 16:47:57 +00:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-20 15:16:23 +02:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-10 00:21:10 +00:00
2022-12-10 00:21:10 +00:00
2022-12-10 00:21:10 +00:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-09-25 19:13:31 +01:00
2022-10-01 21:05:32 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-10-20 15:16:23 +02:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-11-07 14:10:41 +01:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-12-17 18:35:32 +01:00
2022-11-25 22:49:59 +01:00
2022-11-25 22:49:59 +01:00
2022-11-25 22:49:59 +01:00
2022-11-25 22:49:59 +01:00
2022-11-07 14:10:41 +01:00
2022-11-25 22:49:59 +01:00
2022-11-25 22:49:59 +01:00
2022-10-09 10:14:57 +02:00
2022-10-31 14:12:44 +00:00
2022-10-29 15:16:57 +02:00
2022-10-09 10:14:57 +02:00
2022-11-07 14:10:41 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-09-21 21:12:24 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-10-01 21:05:32 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-10-01 21:05:32 +01:00
2022-10-09 10:14:57 +02:00
2022-10-01 21:05:32 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-10-01 21:05:32 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-15 06:56:37 -05:00
2022-10-13 11:14:45 +02:00
2022-10-13 11:14:45 +02:00
2022-10-09 10:14:57 +02:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-10-13 14:42:14 +02:00
2022-10-09 10:14:57 +02:00
2022-10-09 10:14:57 +02:00
2022-12-06 08:54:33 +01:00
2022-10-01 21:05:32 +01:00
2022-10-01 21:05:32 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-10-24 22:58:37 +01:00
2022-10-01 21:05:32 +01:00
2022-10-01 21:05:32 +01:00
2022-09-18 13:27:24 -04:00
2022-12-06 08:54:33 +01:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-11-26 00:47:23 +01:00
2022-11-26 00:47:23 +01:00
2022-10-01 21:05:32 +01:00
2022-10-01 21:05:32 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-10-01 21:05:32 +01:00
2022-10-09 10:14:57 +02:00
2022-12-15 06:56:37 -05:00
2022-09-20 10:32:14 +02:00
2022-12-20 10:34:19 +01:00
2022-12-06 08:54:33 +01:00
2022-09-24 19:31:39 +01:00
2022-09-24 19:31:39 +01:00
2022-12-07 16:43:06 +00:00
2022-10-20 15:16:23 +02:00
2022-12-15 06:56:37 -05:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-12-20 10:34:19 +01:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-12-06 08:54:33 +01:00
2022-12-15 06:56:37 -05:00
2022-10-09 10:14:57 +02:00
2022-10-09 10:14:57 +02:00