Prevent recursive call of Document::execCommand() to protect from attack code

Source/core/editing/CompositeEditCommand.cpp

 /*
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 55 matching lines @@
 #include "core/rendering/InlineTextBox.h"
 #include "core/rendering/RenderBlock.h"
 #include "core/rendering/RenderText.h"
 
 using namespace std;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+namespace {
+class ReentrancyGuard {

[eseidel, 2013/11/15 07:29:52]

We don't have one of these already somewhere?

[yosin_UTC9, 2013/11/15 09:35:17]

No. How about using Locker<T>? See http://crrev.com/72463005

+public:
+    static bool isRecursiveCall() { return s_nestingCounter; }
+
+    class Scope {
+    public:
+        Scope() { ++s_nestingCounter; }
+        ~Scope() { --s_nestingCounter; }
+    };
+    friend class Scope;
+
+private:
+    static int s_nestingCounter;
+};
+int ReentrancyGuard::s_nestingCounter;
+}
+
 PassRefPtr<EditCommandComposition> EditCommandComposition::create(Document* document,
     const VisibleSelection& startingSelection, const VisibleSelection& endingSelection, EditAction editAction)
 {
     return adoptRef(new EditCommandComposition(document, startingSelection, endingSelection, editAction));
 }
 
 EditCommandComposition::EditCommandComposition(Document* document, const VisibleSelection& startingSelection, const VisibleSelection& endingSelection, EditAction editAction)
     : m_document(document)
     , m_startingSelection(startingSelection)
     , m_endingSelection(endingSelection)
@@ skipping 65 matching lines @@
 {
 }
 
 CompositeEditCommand::~CompositeEditCommand()
 {
     ASSERT(isTopLevelCommand() || !m_composition);
 }
 
 void CompositeEditCommand::apply()
 {
+    // We don't allow recusrive |apply()| to protect against attack code.
+    // Recursive call of |apply()| could be happened by moving iframe
+    // with script triggered by insertion, e.g. <iframe src="javascript:...">
+    // <iframe onload="...">. This usage is valid as of the specification
+    // although, it isn't common use case, rather it is used as attack code.
+    if (ReentrancyGuard::isRecursiveCall())
+        return;
+
     if (!endingSelection().isContentRichlyEditable()) {
         switch (editingAction()) {
         case EditActionTyping:
         case EditActionPaste:
         case EditActionDrag:
         case EditActionSetWritingDirection:
         case EditActionCut:
         case EditActionUnspecified:
             break;
         default:
             ASSERT_NOT_REACHED();
             return;
         }
     }
     ensureComposition();
 
     // Changes to the document may have been made since the last editing operation that require a layout, as in <rdar://problem/5658603>.
     // Low level operations, like RemoveNodeCommand, don't require a layout because the high level operations that use them perform one
     // if one is necessary (like for the creation of VisiblePositions).
     document().updateLayoutIgnorePendingStylesheets();
 
     Frame* frame = document().frame();
     ASSERT(frame);
     {
-        EventQueueScope scope;
+        EventQueueScope eventQueueScope;
+        ReentrancyGuard::Scope reentrancyGuardScope;
         doApply();
     }
 
     // Only need to call appliedEditing for top-level commands,
     // and TypingCommands do it on their own (see TypingCommand::typingAddedToOpenCommand).
     if (!isTypingCommand())
         frame->editor().appliedEditing(this);
     setShouldRetainAutocorrectionIndicator(false);
 }
 
@@ skipping 1267 matching lines @@
     return node.release();
 }
 
 PassRefPtr<Element> createBlockPlaceholderElement(Document& document)
 {
     RefPtr<Element> breakNode = document.createElement(brTag, false);
     return breakNode.release();
 }
 
 } // namespace WebCore