| OLD | NEW |
|---|
| (Empty) | |
| 1 <!doctype html> |
| 2 <html> |
| 3 <body> |
| 4 <span id="status"></span> |
| 5 </body> |
| 6 <script> |
| 7 var error = ''; |
| 8 var addError = function(newError) { |
| 9 error += newError; |
| 10 document.getElementById('status').textContent = error; |
| 11 }; |
| 12 |
| 13 var succeed = function() { |
| 14 if (error != '') |
| 15 return; // Don't overwrite an existing error. |
| 16 document.getElementById('status').textContent = 'success'; |
| 17 } |
| 18 |
| 19 // Repro from crbug.com/549986. |
| 20 Object.prototype.__defineSetter__('define', function(v) { |
| 21 if (typeof v == 'function') { |
| 22 addError('Leaked gin define'); |
| 23 leakedDefine = v; |
| 24 } |
| 25 Object.defineProperty(this, 'define', {value: v}); |
| 26 }); |
| 27 |
| 28 var leakedBinding; |
| 29 Object.defineProperty(Object.prototype, 'create', {set: function(v) { |
| 30 if (typeof(v) == 'function') { |
| 31 Object.defineProperty(this, 'create', {value: function(name) { |
| 32 result = v(name); |
| 33 if (name == 'runtime') { |
| 34 try { |
| 35 leakedDefine('foo', ['test'], function(){} ); |
| 36 } catch (e) { } |
| 37 } else if (name == 'test') { |
| 38 addError('Leaked test'); |
| 39 leakedBinding = result; |
| 40 } |
| 41 return result; |
| 42 }, configurable: true}); |
| 43 } |
| 44 }}); |
| 45 |
| 46 // Bindings are lazily initialized. Poke it. |
| 47 chrome.runtime; |
| 48 // If the runtime bindings aren't created, we didn't test anything. |
| 49 if (!chrome.runtime) |
| 50 addError('chrome.runtime was not created.\n'); |
| 51 |
| 52 if (leakedBinding) { |
| 53 leakedFunctions = {}; |
| 54 leakedBinding.customHooks_[0]( |
| 55 {apiFunctions: {setHandleRequest: function(name, fun) { |
| 56 leakedFunctions[name] = fun; |
| 57 } }, compiledApi: {} }); |
| 58 |
| 59 leakedFunctions.runWithNativesEnabled(function() { |
| 60 addError('Calling activityLogger.LogEvent'); |
| 61 leakedFunctions.getModuleSystem(window).requireNative('activityLogger') |
| 62 .LogEvent('', '', 0xDEADBAD); |
| 63 }); |
| 64 } |
| 65 |
| 66 // All's well. |
| 67 succeed(); |
| 68 </script> |
| 69 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1433293004:
[Extensions] Don't allow gin::Define to be overridden (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master