CVE-2024-23271

Overview

Impact:

Description: A malicious website may cause unexpected cross-origin behavior

Researchers: James Lee (@Windowsrcer)

Attribute	Value
CVE	CVE-2024-23271
Bugzilla	265812
Component	WebCore
Bug Class	CrossOrigin
Severity	medium
Commit	cd10fd03842d94b7…
Advisory	Apple Advisory

Root Cause Analysis

A logic issue was addressed with improved checks.

Files Changed

Source Files

Source/WebCore/ChangeLog
Source/WebCore/css/CSSSelector.cpp

Test Files

LayoutTests/ChangeLog
LayoutTests/TestExpectations

Patch Preview

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 409133b0ed61..e0a3e7cb2553 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2020-08-18  Antti Koivisto  <[email protected]>
+
+        The CSS specificity of :host() pseudo-classes is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=202494
+        <rdar://problem/66292568>
+
+        Reviewed by Anders Carlsson.
+
+        * TestExpectations:
+
 2020-08-18  Diego Pino Garcia  <[email protected]>
 
         [GTK] Unreviewed test gardening. Update test baseline after r265749.
diff --git a/LayoutTests/TestExpectations b/LayoutTests/TestExpectations
index e17f48539072..1d87e2921dd0 100644
--- a/LayoutTests/TestExpectations
+++ b/LayoutTests/TestExpectations
@@ -4420,7 +4420,6 @@ webkit.org/b/214461 imported/w3c/web-platform-tests/css/css-pseudo/spelling-erro
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-context-specificity-001.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-context-specificity-002.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-context-specificity-003.html [ ImageOnlyFailure ]
-webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-specificity.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/host-with-default-namespace-001.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/shadow-directionality-001.tentative.html [ ImageOnlyFailure ]
 webkit.org/b/214462 imported/w3c/web-platform-tests/css/css-scoping/shadow-directionality-002.tentative.html [ ImageOnlyFailure ]
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 3433c7799ce4..383409fd4bc2 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2020-08-18  Antti Koivisto  <[email protected]>
+
+        The CSS specificity of :host() pseudo-classes is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=202494
+        <rdar://problem/66292568>
+
+        Reviewed by Anders Carlsson.
+
+        https://drafts.csswg.org/css-scoping/#host-selector
+
+        “The specificity of :host() is that of a pseudo-class, plus the specificity of its argument.”
+
+        * css/CSSSelector.cpp:
+        (WebCore::simpleSelectorSpecificityInternal):
+
 2020-08-18  Youenn Fablet  <[email protected]>
 
         Add a JS built-in routine to mark a promise as handled
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index afd9bab0f9e6..c810b21d9c98 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -128,6 +128,7 @@ static unsigned simpleSelectorSpecificityInternal(const CSSSelector& simpleSelec
             return 0;
         case CSSSelector::PseudoClassNthChild:
         case CSSSelector::PseudoClassNthLastChild:
+        case CSSSelector::PseudoClassHost:
             return CSSSelector::addSpecificities(static_cast<unsigned>(SelectorSpecificityIncrement::ClassB), simpleSelector.selectorList() ? maxSpecificity(*simpleSelector.selectorList()) : 0);
         default:
             break;