[proxies] Add all-can-read/String/Symbol filtering support to GetKeys()

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/objects.h"
 
 #include <cmath>
 #include <iomanip>
 #include <sstream>
 
@@ skipping 8083 matching lines @@
     if (length == 0) {
       return Handle<FixedArray>(isolate->heap()->empty_fixed_array());
     }
     Handle<FixedArray> storage = isolate->factory()->NewFixedArray(length);
     dictionary->CopyEnumKeysTo(*storage);
     return storage;
   }
 }
 
 
+enum IndexedOrNamed { kIndexed, kNamed };
+
+
+// Returns false iff there was an exception.
+template <class Callback, IndexedOrNamed type>
+static bool GetKeysFromInterceptor(Isolate* isolate,
+                                   Handle<JSReceiver> receiver,
+                                   Handle<JSObject> object,
+                                   PropertyFilter filter,
+                                   KeyAccumulator* accumulator) {
+  if (type == kIndexed) {
+    if (!object->HasIndexedInterceptor()) return true;
+  } else {
+    if (!object->HasNamedInterceptor()) return true;
+  }
+  Handle<InterceptorInfo> interceptor(type == kIndexed
+                                          ? object->GetIndexedInterceptor()
+                                          : object->GetNamedInterceptor(),
+                                      isolate);
+  if ((filter & ONLY_ALL_CAN_READ) && !interceptor->all_can_read()) {
+    return true;
+  }
+  PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
+                                 *object);
+  v8::Local<v8::Object> result;
+  if (!interceptor->enumerator()->IsUndefined()) {
+    Callback enum_fun = v8::ToCData<Callback>(interceptor->enumerator());
+    const char* log_tag = type == kIndexed ? "interceptor-indexed-enum"
+                                           : "interceptor-named-enum";
+    LOG(isolate, ApiObjectAccess(log_tag, *object));
+    result = args.Call(enum_fun);
+  }
+  RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, false);
+  if (result.IsEmpty()) return true;
+  DCHECK(v8::Utils::OpenHandle(*result)->IsJSArray() ||
+         (v8::Utils::OpenHandle(*result)->IsJSObject() &&
+          Handle<JSObject>::cast(v8::Utils::OpenHandle(*result))
+              ->HasSloppyArgumentsElements()));
+  // The accumulator takes care of string/symbol filtering.
+  if (type == kIndexed) {
+    accumulator->AddElementKeysFromInterceptor(
+        Handle<JSObject>::cast(v8::Utils::OpenHandle(*result)));
+  } else {
+    accumulator->AddKeys(
+        Handle<JSObject>::cast(v8::Utils::OpenHandle(*result)));
+  }
+  return true;
+}
+
+
 static bool GetKeysFromJSObject(Isolate* isolate, Handle<JSReceiver> receiver,
                                 Handle<JSObject> object, PropertyFilter filter,
+                                JSReceiver::KeyCollectionType type,
                                 KeyAccumulator* accumulator) {
   accumulator->NextPrototype();
+  bool keep_going = true;
   // Check access rights if required.
   if (object->IsAccessCheckNeeded() &&
       !isolate->MayAccess(handle(isolate->context()), object)) {
-    // TODO(jkummerow): Get whitelisted (all-can-read) keys.
-    // It's probably best to implement a "GetKeysWithFailedAccessCheck"
-    // helper, which will need to look at both interceptors and accessors.
-    return false;
+    // The cross-origin spec says that [[Enumerate]] shall return an empty
+    // iterator when it doesn't have access...
+    if (type == JSReceiver::INCLUDE_PROTOS) {
+      return false;
+    }
+    // ...whereas [[OwnPropertyKeys]] shall return whitelisted properties.
+    DCHECK(type == JSReceiver::OWN_ONLY);
+    filter = static_cast<PropertyFilter>(filter | ONLY_ALL_CAN_READ);
+    keep_going = false;
   }
 
   JSObject::CollectOwnElementKeys(object, accumulator, filter);
 
   // Add the element keys from the interceptor.
-  if (object->HasIndexedInterceptor()) {
-    Handle<JSObject> result;
-    if (JSObject::GetKeysForIndexedInterceptor(object, receiver)
-            .ToHandle(&result)) {
-      accumulator->AddElementKeysFromInterceptor(result);
-    }
-    RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, false);
+  if (!GetKeysFromInterceptor<v8::IndexedPropertyEnumeratorCallback, kIndexed>(
+          isolate, receiver, object, filter, accumulator)) {
+    DCHECK(isolate->has_pending_exception());
+    return false;
   }
 
   if (filter == ENUMERABLE_STRINGS) {
     // We can cache the computed property keys if access checks are
     // not needed and no interceptors are involved.
     //
     // We do not use the cache if the object has elements and
     // therefore it does not make sense to cache the property names
     // for arguments objects.  Arguments objects will always have
     // elements.
     // Wrapped strings have elements, but don't have an elements
     // array or dictionary.  So the fast inline test for whether to
     // use the cache says yes, so we should not create a cache.
     Handle<JSFunction> arguments_function(
         JSFunction::cast(isolate->sloppy_arguments_map()->GetConstructor()));
     bool cache_enum_length =
         ((object->map()->GetConstructor() != *arguments_function) &&
          !object->IsJSValue() && !object->IsAccessCheckNeeded() &&
          !object->HasNamedInterceptor() && !object->HasIndexedInterceptor());
     // Compute the property keys and cache them if possible.
     Handle<FixedArray> enum_keys =
         JSObject::GetEnumPropertyKeys(object, cache_enum_length);
     accumulator->AddKeys(enum_keys);
   } else {
     object->CollectOwnPropertyNames(accumulator, filter);
   }
 
   // Add the property keys from the interceptor.
-  if (object->HasNamedInterceptor()) {
-    Handle<JSObject> result;
-    if (JSObject::GetKeysForNamedInterceptor(object, receiver)
-            .ToHandle(&result)) {
-      accumulator->AddKeys(result);
-    }
-    RETURN_VALUE_IF_SCHEDULED_EXCEPTION(isolate, false);
+  if (!GetKeysFromInterceptor<v8::GenericNamedPropertyEnumeratorCallback,
+                              kNamed>(isolate, receiver, object, filter,
+                                      accumulator)) {
+    DCHECK(isolate->has_pending_exception());
+    return false;
   }
-  return true;
+  return keep_going;
 }
 
 
 // Helper function for JSReceiver::GetKeys() below. Can be called recursively.
 // Returns false iff an exception was thrown.
 static bool GetKeys_Internal(Isolate* isolate, Handle<JSReceiver> receiver,
                              Handle<JSReceiver> object,
                              JSReceiver::KeyCollectionType type,
                              PropertyFilter filter,
                              KeyAccumulator* accumulator) {
@@ skipping 13 matching lines @@
                                           filter, accumulator);
       } else {
         DCHECK(type == JSReceiver::INCLUDE_PROTOS);
         result = JSProxy::Enumerate(
             isolate, receiver, Handle<JSProxy>::cast(current), accumulator);
       }
     } else {
       DCHECK(current->IsJSObject());
       result = GetKeysFromJSObject(isolate, receiver,
                                    Handle<JSObject>::cast(current), filter,
-                                   accumulator);
+                                   type, accumulator);
     }
     if (!result) {
       if (isolate->has_pending_exception()) {
         return false;
       }
       // If there was no exception, then "false" means "stop iterating".
       break;
     }
   }
   return true;
@@ skipping 7381 matching lines @@
   if (result.IsEmpty()) return isolate->factory()->undefined_value();
   Handle<Object> result_internal = v8::Utils::OpenHandle(*result);
   result_internal->VerifyApiCallResultType();
   *done = true;
   // Rebox handle before return
   return handle(*result_internal, isolate);
 }
 
 
 // Compute the property keys from the interceptor.
+// TODO(jkummerow): Deprecated.
 MaybeHandle<JSObject> JSObject::GetKeysForNamedInterceptor(
     Handle<JSObject> object, Handle<JSReceiver> receiver) {
   Isolate* isolate = receiver->GetIsolate();
   Handle<InterceptorInfo> interceptor(object->GetNamedInterceptor());
   PropertyCallbackArguments
       args(isolate, interceptor->data(), *receiver, *object);
   v8::Local<v8::Object> result;
   if (!interceptor->enumerator()->IsUndefined()) {
     v8::GenericNamedPropertyEnumeratorCallback enum_fun =
         v8::ToCData<v8::GenericNamedPropertyEnumeratorCallback>(
             interceptor->enumerator());
     LOG(isolate, ApiObjectAccess("interceptor-named-enum", *object));
     result = args.Call(enum_fun);
   }
   if (result.IsEmpty()) return MaybeHandle<JSObject>();
   DCHECK(v8::Utils::OpenHandle(*result)->IsJSArray() ||
          (v8::Utils::OpenHandle(*result)->IsJSObject() &&
           Handle<JSObject>::cast(v8::Utils::OpenHandle(*result))
               ->HasSloppyArgumentsElements()));
   // Rebox before returning.
   return handle(JSObject::cast(*v8::Utils::OpenHandle(*result)), isolate);
 }
 
 
 // Compute the element keys from the interceptor.
+// TODO(jkummerow): Deprecated.
 MaybeHandle<JSObject> JSObject::GetKeysForIndexedInterceptor(
     Handle<JSObject> object, Handle<JSReceiver> receiver) {
   Isolate* isolate = receiver->GetIsolate();
   Handle<InterceptorInfo> interceptor(object->GetIndexedInterceptor());
   PropertyCallbackArguments
       args(isolate, interceptor->data(), *receiver, *object);
   v8::Local<v8::Object> result;
   if (!interceptor->enumerator()->IsUndefined()) {
     v8::IndexedPropertyEnumeratorCallback enum_fun =
         v8::ToCData<v8::IndexedPropertyEnumeratorCallback>(
@@ skipping 196 matching lines @@
   }
 }
 
 
 void JSObject::CollectOwnPropertyNames(KeyAccumulator* keys,
                                        PropertyFilter filter) {
   if (HasFastProperties()) {
     int real_size = map()->NumberOfOwnDescriptors();
     Handle<DescriptorArray> descs(map()->instance_descriptors());
     for (int i = 0; i < real_size; i++) {
-      if ((descs->GetDetails(i).attributes() & filter) != 0) continue;
+      PropertyDetails details = descs->GetDetails(i);
+      if ((details.attributes() & filter) != 0) continue;
+      if (filter & ONLY_ALL_CAN_READ) {
+        if (details.kind() != kAccessor) continue;
+        Object* accessors = descs->GetValue(i);
+        if (!accessors->IsAccessorInfo()) continue;
+        if (!AccessorInfo::cast(accessors)->all_can_read()) continue;
+      }
       Name* key = descs->GetKey(i);
       if (key->FilterKey(filter)) continue;
       keys->AddKey(key);
     }
   } else if (IsJSGlobalObject()) {
     GlobalDictionary::CollectKeysTo(handle(global_dictionary()), keys, filter);
   } else {
     NameDictionary::CollectKeysTo(handle(property_dictionary()), keys, filter);
   }
 }
@@ skipping 15 matching lines @@
 
 
 int JSObject::NumberOfEnumElements() {
   return NumberOfOwnElements(ONLY_ENUMERABLE);
 }
 
 
 void JSObject::CollectOwnElementKeys(Handle<JSObject> object,
                                      KeyAccumulator* keys,
                                      PropertyFilter filter) {
+  if (filter & SKIP_STRINGS) return;
   uint32_t string_keys = 0;
 
   // If this is a String wrapper, add the string indices first,
   // as they're guaranteed to precede the elements in numerical order
   // and ascending order is required by ECMA-262, 6th, 9.1.12.
   if (object->IsJSValue()) {
     Object* val = JSValue::cast(*object)->value();
-    if (val->IsString()) {
+    if (val->IsString() && (filter & ONLY_ALL_CAN_READ) == 0) {
       String* str = String::cast(val);
       string_keys = str->length();
       for (uint32_t i = 0; i < string_keys; i++) {
         keys->AddKey(i);
       }
     }
   }
   ElementsAccessor* accessor = object->GetElementsAccessor();
   accessor->CollectElementIndices(object, keys, kMaxUInt32, filter, 0);
 }
@@ skipping 1935 matching lines @@
   int array_size = 0;
 
   {
     DisallowHeapAllocation no_gc;
     Dictionary<Derived, Shape, Key>* raw_dict = *dictionary;
     for (int i = 0; i < capacity; i++) {
       Object* k = raw_dict->KeyAt(i);
       if (!raw_dict->IsKey(k) || k->FilterKey(filter)) continue;
       if (raw_dict->IsDeleted(i)) continue;
       PropertyDetails details = raw_dict->DetailsAt(i);
-      PropertyAttributes attr = details.attributes();
-      if ((attr & filter) != 0) continue;
+      if ((details.attributes() & filter) != 0) continue;
+      if (filter & ONLY_ALL_CAN_READ) {
+        if (details.kind() != kAccessor) continue;
+        Object* accessors = raw_dict->ValueAt(i);
+        if (!accessors->IsAccessorInfo()) continue;
+        if (!AccessorInfo::cast(accessors)->all_can_read()) continue;
+      }
       array->set(array_size++, Smi::FromInt(i));
     }
 
     EnumIndexComparator<Derived> cmp(static_cast<Derived*>(raw_dict));
     Smi** start = reinterpret_cast<Smi**>(array->GetFirstElementAddress());
     std::sort(start, start + array_size, cmp);
   }
 
   for (int i = 0; i < array_size; i++) {
     int index = Smi::cast(array->get(i))->value();
@@ skipping 1204 matching lines @@
   if (cell->value() != *new_value) {
     cell->set_value(*new_value);
     Isolate* isolate = cell->GetIsolate();
     cell->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kPropertyCellChangedGroup);
   }
 }
 
 }  // namespace internal
 }  // namespace v8