Introduce access control in propertyIsEnumerable....

src/objects.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 248 matching lines @@
         break;
       }
     }
   }
 
   Top::ReportFailedAccessCheck(this, v8::ACCESS_GET);
   return Heap::undefined_value();
 }
 
 
+PropertyAttributes JSObject::GetPropertyAttributeWithFailedAccessCheck(
+  Object* receiver,

[Mads Ager (chromium), 2008/10/28 20:02:38]

Parameters should be indented by four spaces instead of two.

+  LookupResult* result,
+  String* name) {
+  if (result->IsValid()) {
+    switch (result->type()) {
+      case CALLBACKS: {
+        // Only allow API accessors.
+        Object* obj = result->GetCallbackObject();
+        if (obj->IsAccessorInfo()) {
+          AccessorInfo* info = AccessorInfo::cast(obj);
+          if (info->all_can_read()) {
+            return result->GetAttributes();
+          }
+        }
+        break;
+      }
+      case NORMAL:
+      case FIELD:
+      case CONSTANT_FUNCTION: {

[Mads Ager (chromium), 2008/10/28 20:02:38]

I think you might have to pass in a boolean indicating whether or not to search
the prototype chain.  The ECMA-262 standard says that propertyIsEnumerable does
not take the prototype chain into account (note to section 15.2.4.7), so we
probably should not search for accessors in the prototype chain in that case.

+        // Search ALL_CAN_READ accessors in prototype chain.
+        LookupResult r;
+        result->holder()->LookupRealNamedPropertyInPrototypes(name, &r);
+        if (r.IsValid()) {
+          return GetPropertyAttributeWithFailedAccessCheck(receiver, &r, name);
+        }
+        break;
+      }
+      case INTERCEPTOR: {
+        // If the object has an interceptor, try real named properties.
+        // No access check in GetPropertyAttributeWithInterceptor.
+        LookupResult r;
+        result->holder()->LookupRealNamedProperty(name, &r);

[Mads Ager (chromium), 2008/10/28 20:02:38]

Similarly here, we probably need the boolean indicating whether or not to search
the prototype chain.  That is, whether this should be a LookupRealNamedProperty
or only a LocalLookupRealNamedProperty.

+        if (r.IsValid()) {
+          return GetPropertyAttributeWithFailedAccessCheck(receiver, &r, name);
+        }
+        break;
+      }
+      default: {
+        break;
+      }
+    }
+  }
+
+  Top::ReportFailedAccessCheck(this, v8::ACCESS_GET);
+  return ABSENT;
+}
+
+
 Object* JSObject::GetLazyProperty(Object* receiver,
                                   LookupResult* result,
                                   String* name,
                                   PropertyAttributes* attributes) {
   HandleScope scope;
   Handle<Object> this_handle(this);
   Handle<Object> receiver_handle(receiver);
   Handle<String> name_handle(name);
   bool pending_exception;
   LoadLazy(Handle<JSFunction>(JSFunction::cast(result->GetValue())),
@@ skipping 1434 matching lines @@
 }
 
 
 PropertyAttributes JSObject::GetPropertyAttribute(JSObject* receiver,
                                                   LookupResult* result,
                                                   String* name,
                                                   bool continue_search) {
   // Check access rights if needed.
   if (IsAccessCheckNeeded() &&
       !Top::MayNamedAccess(this, name, v8::ACCESS_HAS)) {
-    Top::ReportFailedAccessCheck(this, v8::ACCESS_HAS);
-    return ABSENT;
+    return GetPropertyAttributeWithFailedAccessCheck(receiver, result, name);

[Mads Ager (chromium), 2008/10/28 20:02:38]

I think we need to propagate the continue_search argument here.

   }
   if (result->IsValid()) {
     switch (result->type()) {
       case NORMAL:  // fall through
       case FIELD:
       case CONSTANT_FUNCTION:
       case CALLBACKS:
         return result->GetAttributes();
       case INTERCEPTOR:
         return result->holder()->
@@ skipping 4989 matching lines @@
   // No break point.
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 
 
 } }  // namespace v8::internal