Issue 7038046: Insert meta tag turning on content-security-protection for chrome://settings, history, downloads ...

Issue 7038046: Insert meta tag turning on content-security-protection for chrome://settings, history, downloads ... (Closed)

Created:
9 years, 7 months ago by Tom Sepez

Modified:
9 years, 7 months ago

Reviewers:
arv (Not doing code reviews), Evan Stade, abarth-chromium

CC:
chromium-reviews, arv (Not doing code reviews)

Base URL:
svn://svn.chromium.org/chrome/trunk/src/

Visibility:
Public.

Description

Insert meta tag turning on content-security-protection for chrome://settings, history, downloads pages now that the webkit inspector has been revised to stop calling JS eval(). Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=86708

Patch Set 1 #

Patch Set 2 : '' #

Patch Set 3 : '' #

Total comments: 1

Patch Set 4 : '' #

Patch Set 5 : '' #

Patch Set 6 : '' #

Total comments: 1

Patch Set 7 : '' #

Created: 9 years, 7 months ago

Download [raw] [tar.bz2]

	Unified diffs	Side-by-side diffs	Delta from patch set	Stats (+54 lines, -15 lines)			Patch
M	chrome/browser/resources/downloads.html	View	1 2 3 4 5 6	3 chunks	+10 lines, -7 lines	0 comments	Download
M	chrome/browser/resources/downloads.js	View	1 2 3 4 5 6	1 chunk	+12 lines, -0 lines	0 comments	Download
M	chrome/browser/resources/history.html	View	1 2 3 4 5 6	3 chunks	+9 lines, -6 lines	0 comments	Download
M	chrome/browser/resources/history.js	View	1 2 3 4 5 6	1 chunk	+11 lines, -0 lines	0 comments	Download
M	chrome/browser/resources/options/options.html	View	1 2 3 4 5 6	1 chunk	+5 lines, -0 lines	0 comments	Download
M	chrome/test/data/webui/test_api.js	View	1 2 3 4 5 6	1 chunk	+7 lines, -2 lines	0 comments	Download

Messages

Total messages: 22 (0 generated)

Expand Messages | Collapse Messages

Tom Sepez

Heh. Missed a few in downloads and history: <body onload="load();" i18n-values=".style.fontFamily:fontfamily;.style.fontSize:fontsize"> <a href="" onclick="setSearch(''); return ...

9 years, 7 months ago (2011-05-20 22:48:06 UTC) #3

Tom Sepez

Please review changes to JS. Also, I moved the inclusion of the new script down ...

9 years, 7 months ago (2011-05-23 18:16:14 UTC) #5

abarth-chromium

http://codereview.chromium.org/7038046/diff/5001/chrome/browser/resources/downloads.js File chrome/browser/resources/downloads.js (right): http://codereview.chromium.org/7038046/diff/5001/chrome/browser/resources/downloads.js#newcode597 chrome/browser/resources/downloads.js:597: $('search-form').onclick = function () { Shouldn't one of these ...

9 years, 7 months ago (2011-05-23 18:22:07 UTC) #6

Tom Sepez

Current hangup is chrome/test/data/webui/test_api.js ... function runTest(currentTest, testArguments) { try { currentTest = eval(currentTest); console.log('Running ...

9 years, 7 months ago (2011-05-23 20:37:15 UTC) #8

abarth-chromium

Maybe add 'unsafe-eval' as a script-src for now and then iterate? Adam On Mon, May ...

9 years, 7 months ago (2011-05-23 20:56:45 UTC) #9

Tom Sepez

Can probably replace the eval(currentTest) with this[currentTest], for the cases where we're passing a string ...

9 years, 7 months ago (2011-05-23 21:00:35 UTC) #10

abarth-chromium

That could work. maybe try it and see what the trybot thinks. Adam On Mon, ...

9 years, 7 months ago (2011-05-23 21:05:11 UTC) #11

Tom Sepez

Suspect the RTL failures are caused by third_party/bidichecker/bidichecker_packaged.js: ...if(b)try{return eval("("+a+")")}catch(c){}...

9 years, 7 months ago (2011-05-23 22:48:36 UTC) #12

abarth-chromium

> ...if(b)try{return eval("("+a+")")}catch(c){}... ^^^ That looks suspiciously like an attempt at JSON.parse.

9 years, 7 months ago (2011-05-23 22:58:59 UTC) #13

Tom Sepez

Interestingly, that eval didn't get hit. Time to look for other -- oh: var Mb=new ...

9 years, 7 months ago (2011-05-23 23:43:19 UTC) #14

abarth-chromium

That's easily fixable by using a real function: var Mb = function(a) { return a; ...

9 years, 7 months ago (2011-05-23 23:46:06 UTC) #15

abarth-chromium

On 2011/05/24 00:01:48, Tom Sepez wrote: > and ... window.execScript() for good measure, too. execScript ...

9 years, 7 months ago (2011-05-24 00:04:25 UTC) #17

Tom Sepez

closure/goog/json/json.js: /** * Parses a JSON string and returns the result. This throws an exception ...

9 years, 7 months ago (2011-05-24 00:33:38 UTC) #18

closure/goog/json/json.js:
/**                                                                             
 * Parses a JSON string and returns the result. This throws an exception if     
 * the string is an invalid JSON string.                                        
 *                                                                              
 * Note that this is very slow on large strings. If you trust the source of     
 * the string then you should use unsafeParse instead.                          
 *                                                                              
 * @param {*} s The JSON string to parse.                                       
 * @return {Object} The object generated from the JSON string.                  
 */
goog.json.parse = function(s) {
  var o = String(s);
  if (goog.json.isValid_(o)) {
    /** @preserveTry */
    try {
      return eval('(' + o + ')');
    } catch (ex) {
    }
  }
  throw Error('Invalid JSON string: ' + o);
};



closure/goog/base.js:
/**                                                                             
 * Builds an object structure for the provided namespace path,                  
 * ensuring that names that already exist are not overwritten. For              
 * example:                                                                     
 * "a.b.c" -> a = {};a.b={};a.b.c={};                                           
 * Used by goog.provide and goog.exportSymbol.                                  
 * @param {string} name name of the object that this file defines.              
 * @param {*=} opt_object the object to expose at the end of the path.          
 * @param {Object=} opt_objectToExportTo The object to add the path to; default
 *     is |goog.global|.                                                        
 * @private                                                                     
 */
goog.exportPath_ = function(name, opt_object, opt_objectToExportTo) {
  var parts = name.split('.');
  var cur = opt_objectToExportTo || goog.global;

  // Internet Explorer exhibits strange behavior when throwing errors from      
  // methods externed in this manner.  See the testExportSymbolExceptions in    
  // base_test.html for an example.                                             
  if (!(parts[0] in cur) && cur.execScript) {
    cur.execScript('var ' + parts[0]);
  }
...


closure/goog/reflect/reflect.js:
/**                                                                             
 * To assert to the compiler that an operation is needed when it would          
 * otherwise be stripped. For example:                                          
 * <code>                                                                       
 *     // Force a layout                                                        
 *     goog.reflect.sinkValue(dialog.offsetHeight);                             
 * </code>                                                                      
 * @type {Function}                                                             
 */
goog.reflect.sinkValue = new Function('a', 'return a');

Tom Sepez

Latest patch takes the easy way out with unsafe-eval. We still move the inline handlers ...

9 years, 7 months ago (2011-05-24 21:38:00 UTC) #19

abarth-chromium

LGTM. (Not sure if someone else should review this patch also.) http://codereview.chromium.org/7038046/diff/10002/chrome/test/data/webui/test_api.js File chrome/test/data/webui/test_api.js (right): ...

9 years, 7 months ago (2011-05-24 21:41:17 UTC) #20

erv, evan -- could you take a look at this?

Expand Messages | Collapse Messages