1582581 - xpcAccessibilityService::AddRef can run arbitrary script

Status: NEW

(Core :: Disability Access APIs, defect, P3)

Description

[Boris Zbarsky [:bzbarsky]]

It calls GetOrCreateAccService, which can notify observers, etc. At least in theory. It's pretty unexpected for taking a ref to do that.

Why is that call needed? It seems like that call is already made by NS_GetAccessibilityService and after that we shouldn't need to do it again...

Comment 1

[:Gijs (he/him)]

Maybe Yura knows the answers to the questions in comment #0.

Comment 2

[Yura Zenevich [:yzen] (please use "needinfo")]

sorry cleared by accident, I ll take a look shortly.

Comment 3

[Yura Zenevich [:yzen] (please use "needinfo")]

From what I can remember, when creating multiple references to the xpcAccessibleService, NS_GetAccessibilityService is still only called on the first time. There might be a case where there's only one reference to xpcAccessibleService held (internally as a static reference) with the nsAccessibilityService shut down. If consequently we ask for another reference to an xpcAccessibleService that call is responsible for re-starting the nsAccessibilityService.

Comment 4

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:Jamie, could you have a look please?

For more information, please visit auto_nag documentation.