Commit graph

60246 commits

Author SHA1 Message Date
Timothy Flynn de80f544d8 AK: Disallow calling String methods that return a view on rvalues
This prevents, for example:

    StringView view = "foo"_string.bytes_as_string_view();

This prevents a class of potential UAF.
2024-04-04 11:23:21 +02:00
Timothy Flynn 38ca0f8db9 LibDesktop: Avoid UAF when launching a process with escalation
The value returned by executable() was a temporarily allocated string
which we were holding a view into.
2024-04-04 11:23:21 +02:00
Timothy Flynn e57d739705 HackStudio: Avoid UAF when loading the GML preview
The value returned by editor().text() was a temporarily allocated string
which we were holding a view into.
2024-04-04 11:23:21 +02:00
Timothy Flynn decc00dcdf LibGLSL: Avoid UAF when creating a preprocessor instance
The intialization of Definition::value allocates a string that we were
holding a view into. Store the result as a String to keep it alive; its
only usage is passing it to GenericLexer in another function.
2024-04-04 11:23:21 +02:00
Timothy Flynn 3dee703227 LibWeb: Avoid UAF parsing an XML document's charset
The value returned by get_final_encoding() was a temporarily allocated
string which we were holding a view into.
2024-04-04 11:23:21 +02:00
Timothy Flynn 48fb343230 LibWeb: Change HTMLParser's factory to accept the encoding as StringView
No need to force an allocation. This makes a future patch a bit simpler,
where we will have the encoding as a String. With this patch, we won't
have to convert it to a ByteString.
2024-04-04 11:23:21 +02:00
Timothy Flynn 683c08744a Userland: Avoid some conversions from rvalue strings to StringView
These are all actually fine, there is no UAF here. But once e.g.
`ByteString::view() &&` is deleted, these instances won't compile.
2024-04-04 11:23:21 +02:00
Timothy Flynn 23b25333a5 LibCrypto: Avoid needless ByteString usage in unit tests 2024-04-04 11:23:21 +02:00
Timothy Flynn b5f22b6e90 AK+Userland: Remove some needlessly explicit conversions to StringView 2024-04-04 11:23:21 +02:00
Timothy Flynn c23060e21b Userland: Avoid some now-unneeded explicit conversions to Bytes 2024-04-04 11:23:21 +02:00
Timothy Flynn e0bddbb65e AK: Add a Stream::write_until_depleted overload for string types
All string types currently have to invoke this function as:

    stream.write_until_depleted("foo"sv.bytes());

This isn't very ergonomic, but more importantly, this overload will
allow String/ByteString instances to be written in this manner once
e.g. `ByteString::view() &&` is deleted.
2024-04-04 11:23:21 +02:00
Timothy Flynn c7ea710b55 AK: Return a constant reference from JsonValue::as_string
Rather than making a copy of the held string, this returns a reference
so that expressions like the following:

    do_something(json.as_string().view());

are not disallowed once `ByteString::view() &&` is deleted.
2024-04-04 11:23:21 +02:00
Andrew Kaster 6d38d55fc8 LibWebView: Collect memory and cpu usage for helpers on Linux 2024-04-04 09:41:01 +02:00
0x4261756D a005aae497 LibJS: Add missing Base::visit_edges() in FetchAlgorithms and Navigable
These are empty calls since `Base` is JS::Cell  but they *are* missing
and LibJSGCVerifier complains otherwise.
2024-04-04 07:50:13 +02:00
0x4261756D f489c3d9c2 LibJSGCVerifier: Fix false positives in HeapFunction::visit_edges()
clang doesn't make all `Base::visit_edges()` calls CXXMemberCallExprs
This would lead to false positives like in HeapFunction,
where the matcher would fail to match and report a warning.
Also previously the matcher would succeed
if the visited class is missing the call to `Base::visit_edges()`
but an included class has a correct method.

The new matcher checks the current class for `visit_edges`-overrides
and matches all `visit_edges`-memberExprs inside,
checking those for starting with `Base::`.
This seems to get rid of the false positives
and should be more correct detecting missing calls.
2024-04-04 07:50:13 +02:00
0x4261756D 7743dcf4a9 LibJSGCVerifier: Fix dangling-reference errors
When building, clang would throw errors about dangling references.
Extracting `template_args` to a variable before the loop and
indexing into that seems to fix the errors.
2024-04-04 07:50:13 +02:00
Andrew Kaster bf722d49b0 LibWeb: Remove WebContent include from SVGDecodedImageData
This is a layering violation, and is not used. Caught by the gn build.
2024-04-04 07:47:16 +02:00
Timothy Flynn 69b5d7c0e6 LibWeb: Avoid UAF when encoding a fetch request body via URLSearchParams 2024-04-03 17:14:01 -04:00
Andreas Kling d91d6ee205 LibWeb: Stop leaking entire realms via Blob URLs
This patch implements the File API spec's supplemental steps for
document's "unloading document cleanup steps" so that we now remove blob
URLs associated with the document's relevant settings object when the
document is being unloaded.

Fixes two realm leaks when running our test suite.
2024-04-03 22:20:50 +02:00
Aliaksandr Kalenik 696cf7b9fb LibWeb: Fix "destroy the child navigable" to call Document::destroy()
f66d33423b was not sufficient to ensure
document destruction when a child navigable is destroyed. This is
because a navigable was remove from the set of all navigables too early
which led to `Navigable::navigable_with_active_document()` being unable
to find a navigable that is still in the process of destruction.

This change solves that by making all steps of a navigable destruction
to happen in afterAllDestruction callback.

Unfortunately, writing a test to verify document destruction is
challenging because no events are emitted to indicate that it has
happened.
2024-04-03 21:17:57 +02:00
stelar7 35676491ec LibWeb: Implement ED25519 verify for SubtleCrypto 2024-04-03 13:10:01 -06:00
stelar7 9ad10566b2 LibWeb: Implement ED25519 sign for SubtleCrypto 2024-04-03 13:10:01 -06:00
stelar7 ec015034bd LibWeb: Implement ED25519 generateKey for SubtleCrypto 2024-04-03 13:10:01 -06:00
stelar7 069295d132 LibWeb: Improve NotSupported error message for normalize_an_algorithm 2024-04-03 13:10:01 -06:00
stelar7 54a3ffcd42 LibCrypto: Add early exit to SECP.verify if signature is invalid 2024-04-03 13:10:01 -06:00
stelar7 ae230c9150 LibWeb: Implement most of ECDSA verify for SubtleCrypto 2024-04-03 13:10:01 -06:00
stelar7 6906b7c1e6 LibWeb: Implement skeleton of SubtleCrypto.verify 2024-04-03 13:10:01 -06:00
stelar7 bc2a5e24bc LibWeb: Implement skeleton of ECDSA sign for SubtleCrypto 2024-04-03 13:10:01 -06:00
stelar7 41449814db LibWeb: Implement generateKey for ECDSA 2024-04-03 13:10:01 -06:00
stelar7 cfae6523be LibWeb: Implement skeleton of SubtleCrypto.sign 2024-04-03 13:10:01 -06:00
Andrew Kaster d1fdfead54 LibWebView+Browser: Collect memory and cpu usage for helpers on Serenity 2024-04-03 20:56:33 +02:00
Timothy Flynn d6c8218089 Ladybird/Qt: Show the tab bar by default
We currently only show the tab bar when we have more than one tab open.
This has caused confusion in the past, as it's a bit less obvious that
the browser supports tabs. For example:

https://hackaday.com/2023/10/10/jennys-daily-drivers-serenityos-and-in-particular-ladybird/
"it’s a single window with no tabs"
2024-04-03 20:56:04 +02:00
Timothy Flynn ecce4ad426 Ladybird/Qt: Set the tab tooltip to its full title
If a tab's title is cut off due to its size, setting a tool tip will
allow for viewing the full title.
2024-04-03 20:56:04 +02:00
Timothy Flynn 2713d4651d Ladybird/Qt: Specify a minimum and maxium tab width
By default, Qt will grow the width of a tab button to fit the title text
of the tab. For long titles or file:// URLs, this looks rather bad. This
sets a min/max tab width to prevent such infinite growth.

To do this, we have to subclass both QTabWidget and QTabBar, because the
functions to be called/overridden are protected.
2024-04-03 20:56:04 +02:00
Timothy Flynn 0234add5fa Ladybird/Qt: Replace the default tab close icon with a vector icon
The default icon used by Qt is a bit jarring. Replace it with an icon
that resembles our other homemade icons.
2024-04-03 20:56:04 +02:00
Timothy Flynn b577782247 Ladybird/Qt: Move the TVG icon loader to a utility file
It will be needed outside of Tab.
2024-04-03 20:56:04 +02:00
Timothy Flynn 1fc995d4aa Ladybird/Qt: Add a hover effect to the audio play state button
By default, a flat QPushButton does not have a hover effect. Add a small
subclass to provide such an effect to make it clearer it is a button.
2024-04-03 20:56:04 +02:00
Timothy Flynn 22ab12e4a1 Meta: Port recent changes to the GN build
ccebc7a905
2024-04-03 20:56:04 +02:00
Andreas Kling fb263e232a LibWeb: Fix typo: covert_number_to_string => convert_number_to_string 2024-04-03 18:17:24 +02:00
Andreas Kling ffac32d20e LibWeb: Use JS::HeapFunction for WebIDL promise reaction steps
Switching away from SafeFunction immediately backfired here, as we're
dealing with two layers of captures, not one.

Let's do the correct fix, which is to use HeapFunction. This makes the
API and its behavior explicit, and keeps captures alive as long as the
HeapFunction is alive.

Fixes #23819.
2024-04-03 18:14:33 +02:00
Andreas Kling f1eb837c3d LibWeb: Remove unnecessary JS::Handle in AbortSignal::timeout()
This fixes yet another GC reference cycle.
2024-04-03 18:14:33 +02:00
Andreas Kling 32d065011b LibWeb: Use Core::Timer in AnimationFrameCallbackDriver
There was no need to use a Platform::Timer here since we're not making
use of the automatic SafeFunction behavior anyway.
2024-04-03 18:14:33 +02:00
Andreas Kling 518cedc8f3 LibWeb: Don't store root as JS::Handle in IntersectionObserver
Instead, use a JS::GCPtr and visit it, to prevent GC reference cycles.
2024-04-03 18:14:33 +02:00
Andreas Kling 52fa415779 LibWeb: Use JS::SafeFunction for ResourceLoader callbacks
This is one of the cases where SafeFunction actually makes sense.
Since every resource load will always either succeed, fail, or time out,
it's okay to use a SafeFunction since we know it will eventually get
destroyed.

Until it does, this allows it to keep any captures alive.
2024-04-03 18:14:33 +02:00
Andreas Kling a9842ebe48 LibWeb: Use JS::HeapFunction in Fetch::Fetching::PendingResponse
This fixes a long-standing realm leak.
2024-04-03 18:14:33 +02:00
Andreas Kling 338dde70a1 LibJS: Don't create Handles in Promise.finally()
Capturing Handles like this was creating unbreakable GC reference cycles
and causing us to leak entire realms.
2024-04-03 18:14:33 +02:00
Andrew Kaster 12fce55caf LibWeb: Don't load favicons twice for non-SVG documents
This seems to be a rebase mishap in bdb8af94ee.
2024-04-03 09:56:53 -06:00
Stanisław Wiśniewski 5f7745641d LibC: Precompute directory_name length in ttyname_r_for_directory() 2024-04-03 09:48:05 -06:00
Stanisław Wiśniewski 72911cd006 LibC: Verify pointer returned by malloc() 2024-04-03 09:48:05 -06:00
mobounya bdb8af94ee LibWeb: Don't load fallback icon for SVG documents
Skip loading a fallback favicon if Document represents a decoded SVG.

Issue: #23405
2024-04-03 09:45:31 -06:00