dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

LibWeb: Avoid invalid WebDriver key modifier values

Browse source 
Clear key modifier bits through their underlying integer values when
releasing WebDriver keys. The enum bitwise complement can otherwise
materialize values outside the KeyModifier enumerators, which trips
UBSan when browser history shortcut actions release Alt or Meta.

The WebDriver session history test covers this through browser shortcut
back and forward actions.
This commit is contained in:
Andreas Kling 2026-06-14 00:12:07 +02:00 committed by Andreas Kling
parent fd2e9e0fb3
commit 69f1c0e432
1 changed files with 7 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
Libraries/LibWeb/WebDriver/Actions.cpp
View file

@ -1051,28 +1051,31 @@ static ErrorOr<void, WebDriver::Error> dispatch_key_up_action(ActionObject::KeyF
// guidelines in [UI-EVENTS].
auto modifiers = global_key_state.modifiers();
auto clear_modifier = [](UIEvents::KeyModifier& modifiers, UIEvents::KeyModifier modifier) {
modifiers = static_cast<UIEvents::KeyModifier>(to_underlying(modifiers) & ~to_underlying(modifier));
};
// 7. If key is "Alt", let source's alt property be false.
if (key == "Alt"sv) {
modifiers &= ~UIEvents::KeyModifier::Mod_Alt;
clear_modifier(modifiers, UIEvents::KeyModifier::Mod_Alt);
source.alt = false;
}
// 8. If key is "Shift", let source's shift property be false.
else if (key == "Shift"sv) {
modifiers &= ~UIEvents::KeyModifier::Mod_Shift;
clear_modifier(modifiers, UIEvents::KeyModifier::Mod_Shift);
source.shift = false;
}
// 9. If key is "Control", let source's ctrl property be false.
else if (key == "Control"sv) {
modifiers &= ~UIEvents::KeyModifier::Mod_Ctrl;
clear_modifier(modifiers, UIEvents::KeyModifier::Mod_Ctrl);
source.ctrl = false;
}
// 10. If key is "Meta", let source's meta property be false.
else if (key == "Meta"sv) {
modifiers &= ~UIEvents::KeyModifier::Mod_Super;
clear_modifier(modifiers, UIEvents::KeyModifier::Mod_Super);
source.meta = false;
}