DevTools: Switch from Value to JSON.

webkit/glue/devtools/js/inject_dispatch.js

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * @fileoverview Injects 'injected' object into the inspectable page.
  */
 
 /**
  * Dispatches host calls into the injected function calls.
@@ skipping 10 matching lines @@
 /**
  * Main dispatch method, all calls from the host go through this one.
  * @param {string} functionName Function to call
  * @param {string} json_args JSON-serialized call parameters.
  * @return {string} JSON-serialized result of the dispatched call.
  */
 function devtools$$dispatch(functionName, json_args) {
   var params = JSON.parse(json_args);
   var result = devtools$$obj[functionName].apply(devtools$$obj, params);
   return JSON.stringify(result);
-};
+}
+
+
+/**
+ * Removes malicious functions from the objects so that the pure JSON.stringify
+ * was used.
+ */
+function sanitizeJson(obj) {
+  for (var name in obj) {
+    var property = obj[name];
+    var type = typeof property;
+    if (type === "function") {
+      obj[name] = null;

[yurys, 2009/08/26 11:51:42]

is it safe to do in the 'for in' loop?

+    } else if (type === "object") {
+      sanitizeJson(property);

[yurys, 2009/08/26 11:51:42]

this will fail if property is null because typeof null ==
'object'

+    }
+  }
+  return obj;
+}
 
 
 /**
  * This is called by the InspectorFrontend for serialization.
  * We serialize the call and send it to the client over the IPC
  * using dispatchOut bound method.
  */
 var dispatch = function(method, var_args) {
   // Handle all messages with non-primitieve arguments here.
   var args = Array.prototype.slice.call(arguments);
 
   if (method == 'inspectedWindowCleared' ||
       method == 'reset' ||
       method == 'setAttachedWindow') {
     // Filter out messages we don't need here.
     // We do it on the sender side since they may have non-serializable
     // parameters.
     return;
   }
-  var call = JSON.stringify(args);
+
+  var call = JSON.stringify(sanitizeJson(args));
   DevToolsAgentHost.dispatch(call);
 };