Skip to content

Restrict control transfers to standard requests and protected classes #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
reillyeon merged 3 commits into from
Jun 5, 2026
Merged

Restrict control transfers to standard requests and protected classes #270

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3aaee07
Restrict control transfers to standard requests and protected classes
Jun 4, 2026
eb40e25
Restructure control transfer validation algorithm for clarity
Jun 4, 2026
ef9af36
Remove prompt link-default (warning is acceptable)
Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 34 additions & 10 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1476,8 +1476,8 @@ method, when invoked, MUST run the following steps:
1. Let |global| be [=this=]'s [=relevant global object=].
1. If [=check if the device is configured=] with [=this=] returns a
{{Promise}}, return that value.
1. If [=check the validity of the control transfer parameters=] with [=this=]
and |setup| returns a {{Promise}}, return that value.
1. If [=check the validity of the control transfer parameters=] with [=this=],
|setup|, and {{"in"}} returns a {{Promise}}, return that value.
1. Let |promise| be [=a new promise=].
1. Run the following steps [=in parallel=].
1. If |length| is greater than 0, let |buffer| be a host buffer with space
Expand Down Expand Up @@ -1515,8 +1515,8 @@ method, when invoked, MUST run the following steps:
1. Let |global| be [=this=]'s [=relevant global object=].
1. If [=check if the device is configured=] with [=this=] returns a
{{Promise}}, return that value.
1. If [=check the validity of the control transfer parameters=] with [=this=]
and |setup| returns a {{Promise}}, return that value.
1. If [=check the validity of the control transfer parameters=] with [=this=],
|setup|, and {{"out"}} returns a {{Promise}}, return that value.
1. [=Get a copy of the buffer source=] |data| and let the result be |bytes|.
1. Let |promise| be [=a new promise=].
1. Run the following steps [=in parallel=].
Expand Down Expand Up @@ -1797,34 +1797,58 @@ Issue(36): What configuration is the device in after it resets?

<div algorithm="check the validity of the control transfer parameters">
To <dfn>check the validity of the control transfer parameters</dfn> with the
given {{USBDevice}} |device| and {{USBControlTransferParameters}} |setup|,
perform the following steps:
given {{USBDevice}} |device|, {{USBControlTransferParameters}} |setup|, and
{{USBDirection}} |direction|, perform the following steps:

1. Let |configuration| be the result of [=finding the current configuration=]
with |device|.
1. If |configuration| is `null`, return `undefined`.
1. If |setup|.{{USBControlTransferParameters/requestType}} is {{"standard"}},
perform the following steps:
1. If |direction| is {{"out"}}, return [=a promise rejected with=] a
"{{SecurityError}}" {{DOMException}}.
1. If |setup|.{{USBControlTransferParameters/request}} is not one of
`0x00` (GET_STATUS), `0x06` (GET_DESCRIPTOR), `0x08` (GET_CONFIGURATION),
`0x0A` (GET_INTERFACE) or `0x0C` (SYNCH_FRAME), return [=a promise
rejected with=] a "{{SecurityError}}" {{DOMException}}.
1. If |setup|.{{USBControlTransferParameters/requestType}} is {{"class"}},
perform the following steps:
1. Let |interfaceNumber| be the lower 8 bits of
|setup|.{{USBControlTransferParameters/index}}.
1. Let |interfaceIndex| be the result of [=finding the interface index=]
with |interfaceNumber| and |configuration|.
1. If |interfaceIndex| is not `-1`, perform the following steps:
1. Let |interface| be
|configuration|.{{USBConfiguration/[[interfaces]]}}[|interfaceIndex|].
1. If |interface|.{{USBInterface/[[isProtectedClass]]}} is `true`,
return [=a promise rejected with=] a "{{SecurityError}}"
{{DOMException}}.
1. If |setup|.{{USBControlTransferParameters/recipient}} is {{"interface"}},
perform the following steps:
1. Let |interfaceNumber| be the lower 8 bits of
|setup|.{{USBControlTransferParameters/index}}.
1. Let |interfaceIndex| be the result of [=finding the interface index=]
with |interfaceNumber| and |configuration|.
1. If |interfaceIndex| is equal to `-1`, return [=a promise rejected with=]
a "{{NotFoundError}}" {{DOMException}}.
1. If |interfaceIndex| is `-1`, return [=a promise rejected with=] a
"{{NotFoundError}}" {{DOMException}}.
1. Let |interface| be
|configuration|.{{USBConfiguration/[[interfaces]]}}[|interfaceIndex|].
1. If |interface|.{{USBInterface/[[isProtectedClass]]}} is `true`, return [=a
promise rejected with=] a "{{SecurityError}}" {{DOMException}}.
1. If the result of [=finding if the interface is claimed=] with
|interface| is not `true`, return [=a promise rejected with=] an
"{{InvalidStateError}}" {{DOMException}}.
1. If |setup|.{{USBControlTransferParameters/recipient}} is {{"endpoint"}}, run
the following steps:
1. If |setup|.{{USBControlTransferParameters/recipient}} is {{"endpoint"}},
perform the following steps:
1. Let |endpointAddress| be |setup|.{{USBControlTransferParameters/index}}.
1. Let |endpoint| be the result of [=finding the endpoint=] with
|endpointAddress| and |device|.
1. If |endpoint| is `null`, return [=a promise rejected with=] a
"{{NotFoundError}}" {{DOMException}}.
1. Let |alternate| be |endpoint|.{{USBEndpoint/[[alternateInterface]]}}.
1. Let |interface| be |alternate|.{{USBAlternateInterface/[[interface]]}}.
1. If |interface|.{{USBInterface/[[isProtectedClass]]}} is `true`, return [=a
promise rejected with=] a "{{SecurityError}}" {{DOMException}}.
1. If the result of [=finding if the interface is claimed=] with |interface|
is `false`, return [=a promise rejected with=] an
"{{InvalidStateError}}" {{DOMException}}.
Expand Down
Loading