[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.2.1-2-29-g5dbcb1c

[Michael Gilbert]

The following commit has been merged in the debian/unstable branch:
commit 725dfa03752647edaca1c3969f098a9d62010aa4
Author: Michael Gilbert <michael.s.gilbert at gmail.com>
Date:   Mon Jun 28 21:31:35 2010 -0400

    fix cve-2010-1422

diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 681172d..025666a 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -2151,7 +2151,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 
     if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
         node->dispatchEvent(keydown, ec);
-        return keydown->defaultHandled() || keydown->defaultPrevented();
+        // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
+        bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
+        return keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
     }
 
     // Run input method in advance of DOM event handling.  This may result in the IM
@@ -2171,7 +2173,9 @@ bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
     }
 
     node->dispatchEvent(keydown, ec);
-    bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented();
+    // If frame changed as a result of keydown dispatch, then return early to avoid sending a subsequent keypress message to the new frame.
+    bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
+    bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
     if (handledByInputMethod || (keydownResult && !backwardCompatibilityMode))
         return keydownResult;
     
diff --git a/debian/changelog b/debian/changelog
index f665caf..e2c33c8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,7 @@ webkit (1.2.1-3) UNRELEASED; urgency=low
   * Fix cve-2010-1417: possible code execution in the css implementation (this
     currently duplicated as cve-2010-1665 in the cve tracker).
   * Fix cve-2010-1418: remote web script and/or html injection.
+  * Fix cve-2010-1422: keyboard focus hijack.
 
  -- Michael Gilbert <michael.s.gilbert at gmail.com>  Thu, 27 May 2010 20:36:41 -0400
 
diff --git a/debian/patches/cve-2010-1422.patch b/debian/patches/cve-2010-1422.patch
new file mode 100644
index 0000000..b8c9faf
--- /dev/null
+++ b/debian/patches/cve-2010-1422.patch
@@ -0,0 +1,29 @@
+description: fix cve-2010-1422
+author: Michael Gilbert <michael.s.gilbert at gmail.com>
+origin: http://trac.webkit.org/changeset/58829
+Index: webkit-1.2.1/WebCore/page/EventHandler.cpp
+===================================================================
+--- webkit-1.2.1.orig/WebCore/page/EventHandler.cpp	2010-05-13 16:31:30.000000000 -0400
++++ webkit-1.2.1/WebCore/page/EventHandler.cpp	2010-06-28 21:29:21.000000000 -0400
+@@ -2151,7 +2151,9 @@
+ 
+     if (initialKeyEvent.type() == PlatformKeyboardEvent::RawKeyDown) {
+         node->dispatchEvent(keydown, ec);
+-        return keydown->defaultHandled() || keydown->defaultPrevented();
++        // If frame changed as a result of keydown dispatch, then return true to avoid sending a subsequent keypress message to the new frame.
++        bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
++        return keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
+     }
+ 
+     // Run input method in advance of DOM event handling.  This may result in the IM
+@@ -2171,7 +2173,9 @@
+     }
+ 
+     node->dispatchEvent(keydown, ec);
+-    bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented();
++    // If frame changed as a result of keydown dispatch, then return early to avoid sending a subsequent keypress message to the new frame.
++    bool changedFocusedFrame = m_frame->page() && m_frame != m_frame->page()->focusController()->focusedOrMainFrame();
++    bool keydownResult = keydown->defaultHandled() || keydown->defaultPrevented() || changedFocusedFrame;
+     if (handledByInputMethod || (keydownResult && !backwardCompatibilityMode))
+         return keydownResult;
+     
diff --git a/debian/patches/series b/debian/patches/series
index d156010..4bf25a5 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@ cve-2010-1417+1665.patch
 cve-2010-1418-part1.patch
 cve-2010-1418-part2.patch
 cve-2010-1418-part3.patch
+cve-2010-1422.patch

-- 
WebKit Debian packaging