nagai/fune
3
0
Fork 0
forked from mirrors/gecko-dev
Code Pull requests Activity

Bug 1726039 - Eliminate security errors from exotic objects which disallow private fields r=jandem

Browse source 
Depends on D122780

Differential Revision: https://phabricator.services.mozilla.com/D158265
This commit is contained in:
Matthew Gaudet 2022-10-26 21:53:36 +00:00
parent 47be3bc251
commit de0e01d414
2 changed files with 21 additions and 12 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

21
js/src/proxy/Proxy.cpp
View file

@ -200,6 +200,11 @@ bool Proxy::defineProperty(JSContext* cx, HandleObject proxy, HandleId id,
return false;
}
const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
// We shouldn't be definining a private field if we are supposed to throw;
// this ought to have been caught by CheckPrivateField.
MOZ_ASSERT_IF(id.isPrivateName(), !handler->throwOnPrivateField());
AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::SET, true);
if (!policy.allowed()) {
if (!policy.returnValue()) {
@ -402,6 +407,14 @@ bool Proxy::hasOwn(JSContext* cx, HandleObject proxy, HandleId id, bool* bp) {
}
const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
*bp = false; // default result if we refuse to perform this action
// If the handler is supposed to throw, we'll never have a private field so
// simply return, as we shouldn't throw an invalid security error when
// checking for the presence of a private field (WeakMap model).
if (id.isPrivateName() && handler->throwOnPrivateField()) {
return true;
}
AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::GET, true);
if (!policy.allowed()) {
return policy.returnValue();
@ -446,6 +459,10 @@ MOZ_ALWAYS_INLINE bool Proxy::getInternal(JSContext* cx, HandleObject proxy,
return false;
}
const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
// Shouldn't have gotten here, as this should have been caught earlier.
MOZ_ASSERT_IF(id.isPrivateName(), !handler->throwOnPrivateField());
vp.setUndefined(); // default result if we refuse to perform this action
AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::GET, true);
if (!policy.allowed()) {
@ -517,6 +534,10 @@ MOZ_ALWAYS_INLINE bool Proxy::setInternal(JSContext* cx, HandleObject proxy,
}
const BaseProxyHandler* handler = proxy->as<ProxyObject>().handler();
// Should have been handled already.
MOZ_ASSERT_IF(id.isPrivateName(), !handler->throwOnPrivateField());
AutoEnterPolicy policy(cx, handler, proxy, id, BaseProxyHandler::SET, true);
if (!policy.allowed()) {
if (!policy.returnValue()) {

12
testing/web-platform/meta/js/behaviours/HostEnsureCanAddPrivateElement.window.js.ini
View file

@ -1,12 +0,0 @@
[HostEnsureCanAddPrivateElement.window.html]
[Cross Origin (port): WindowProxy]
expected: FAIL # SecurityError
[Cross Origin (remote): WindowProxy]
expected: FAIL # SecurityError
[Same Origin + document.domain WindowProxy]
expected: FAIL # SecurityError
[(After document.domain set) Same Origin + document.domain WindowProxy does carry private fields after navigation]
expected: FAIL # SecurityError