5 ms·

> domain.endsWith("hulu.com") Huh, does that mean it would also apply on "thisisnothulu.com"? Most other endsWith calls seem to do e.g. `domain.endsWith(".hul

> domain.endsWith("hulu.com") Huh, does that mean it would also apply on "thisisnothulu.com"? Most other endsWith calls seem to do e.g. `domain.endsWith(".hulu.com")` to only match subdomains.

Sayrus 6y ago
Damn, it seems you're right and it applies to any domain ending with this instead of hulu.com subdomains. From the name of the quirk, I'm not sure this is an issue though.
Sephr 6y ago
This is to enable Safari's legacy EME implementation. I wonder if there are any vulnerabilities waiting in those unmaintained legacy codepaths https://github.com/WebKit/webkit/blob/master/Source/WebCore/page/Quirks.cpp#L141 https://github.com/WebKit/webkit/blob/master/Source/WebCore/... I first noticed this bug a year ago last February and it's been unchanged ever since.
- richdougherty 6y ago
  Definitely a vulnerability there exploitable in concert with the error in the domain name check.
deleted 6y ago
[deleted]
dillondoyle 6y ago
good catch. just on a quick glance a few lines above might possibly be a good vector to test for ads to get around autoplay sound restrictions. make a domain ending with somethingnetflix.com, iframe it, and maybe figure out if the second link below has a class that allows override to allow autoplay sound without user interaction to something like kWKWebsiteAutoplayPolicyAllow with sound on. https://github.com/WebKit/WebKit/blob/f43587ec2416b86eecef5091fe028a08e168f976/Source/WebCore/page/Quirks.cpp#L136 https://github.com/WebKit/WebKit/blob/f43587ec2416b86eecef50... https://github.com/WebKit/WebKit/blob/88278b55563e5ccdc0b3419c6c391c3becc19e40/Source/WebKit/UIProcess/API/C/WKWebsitePolicies.cpp#L82 https://github.com/WebKit/WebKit/blob/88278b55563e5ccdc0b341...
richdougherty 6y ago
I've created a WebKit bug report for this so they can fix it. https://bugs.webkit.org/show_bug.cgi?id=222130 https://bugs.webkit.org/show_bug.cgi?id=222130

> domain.endsWith("hulu.com") Huh, does that mean it would also apply on "thisisnothulu.com"? Most other endsWith calls seem to do e.g. `domain.endsWith(".hulu.com")` to only match subdomains.

Sayrus 6y ago

Damn, it seems you're right and it applies to any domain ending with this instead of hulu.com subdomains. From the name of the quirk, I'm not sure this is an issue though.

Sephr 6y ago

This is to enable Safari's legacy EME implementation. I wonder if there are any vulnerabilities waiting in those unmaintained legacy codepaths https://github.com/WebKit/webkit/blob/master/Source/WebCore/page/Quirks.cpp#L141 https://github.com/WebKit/webkit/blob/master/Source/WebCore/... I first noticed this bug a year ago last February and it's been unchanged ever since.

richdougherty 6y ago
Definitely a vulnerability there exploitable in concert with the error in the domain name check.

deleted 6y ago

[deleted]

dillondoyle 6y ago

good catch. just on a quick glance a few lines above might possibly be a good vector to test for ads to get around autoplay sound restrictions. make a domain ending with somethingnetflix.com, iframe it, and maybe figure out if the second link below has a class that allows override to allow autoplay sound without user interaction to something like kWKWebsiteAutoplayPolicyAllow with sound on. https://github.com/WebKit/WebKit/blob/f43587ec2416b86eecef5091fe028a08e168f976/Source/WebCore/page/Quirks.cpp#L136 https://github.com/WebKit/WebKit/blob/f43587ec2416b86eecef50... https://github.com/WebKit/WebKit/blob/88278b55563e5ccdc0b3419c6c391c3becc19e40/Source/WebKit/UIProcess/API/C/WKWebsitePolicies.cpp#L82 https://github.com/WebKit/WebKit/blob/88278b55563e5ccdc0b341...

richdougherty 6y ago

I've created a WebKit bug report for this so they can fix it. https://bugs.webkit.org/show_bug.cgi?id=222130 https://bugs.webkit.org/show_bug.cgi?id=222130