Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(60)

Issue 1529303003: Throw TypeError when reading global references through a JSProxy (Closed)

Created:
5 years ago by Toon Verwaest
Modified:
5 years ago
Reviewers:
adamk, Jakob Kummerow
CC:
v8-reviews_googlegroups.com, Dan Ehrenberg
Base URL:
https://chromium.googlesource.com/v8/v8.git@master
Target Ref:
refs/pending/heads/master
Project:
v8
Visibility:
Public.

Description

Throw TypeError when reading global references through a JSProxy Allowing global references to be read through a proxy results in cross-origin information leaks. The ES6 spec currently does not mitigate this in any way. This CL adds a workaround that's easy for V8: throw whenever an unresolved reference would result in a proxy trap to be fired. I'm landing this so we can move forwards with staging proxies without putting users of --harmony at risk. BUG=chromium:399951 LOG=n Committed: https://crrev.com/01b8e7c7f62fe0fc74552c7d3909777fa50b3447 Cr-Commit-Position: refs/heads/master@{#32949}

Patch Set 1 #

Patch Set 2 : Also add test #

Total comments: 1

Patch Set 3 : Increased testing #

Unified diffs Side-by-side diffs Delta from patch set Stats (+22 lines, -0 lines) Patch
M src/messages.h View 1 chunk +1 line, -0 lines 0 comments Download
M src/objects.cc View 1 chunk +7 lines, -0 lines 0 comments Download
A test/mjsunit/harmony/proxies-global-reference.js View 1 2 1 chunk +14 lines, -0 lines 0 comments Download

Messages

Total messages: 19 (9 generated)
Toon Verwaest
ptal
5 years ago (2015-12-17 12:06:09 UTC) #2
Jakob Kummerow
lgtm
5 years ago (2015-12-17 12:59:44 UTC) #3
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1529303003/20001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1529303003/20001
5 years ago (2015-12-17 13:02:46 UTC) #5
adamk
This is amazing. Why didn't you think of this before? :) lgtm while we're behind ...
5 years ago (2015-12-17 13:27:54 UTC) #6
adamk
https://codereview.chromium.org/1529303003/diff/20001/test/mjsunit/harmony/proxies-global-reference.js File test/mjsunit/harmony/proxies-global-reference.js (right): https://codereview.chromium.org/1529303003/diff/20001/test/mjsunit/harmony/proxies-global-reference.js#newcode7 test/mjsunit/harmony/proxies-global-reference.js:7: __proto__ = new Proxy({}, new Proxy({}, { Maybe also ...
5 years ago (2015-12-17 13:36:41 UTC) #8
Toon Verwaest
Added the extra test.
5 years ago (2015-12-17 13:42:41 UTC) #11
adamk
Thanks, still lgtm
5 years ago (2015-12-17 13:43:23 UTC) #12
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1529303003/40001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1529303003/40001
5 years ago (2015-12-17 13:43:54 UTC) #15
commit-bot: I haz the power
Committed patchset #3 (id:40001)
5 years ago (2015-12-17 14:37:22 UTC) #17
commit-bot: I haz the power
5 years ago (2015-12-17 14:37:52 UTC) #19
Message was sent while issue was closed.
Patchset 3 (id:??) landed as
https://crrev.com/01b8e7c7f62fe0fc74552c7d3909777fa50b3447
Cr-Commit-Position: refs/heads/master@{#32949}

Powered by Google App Engine
This is Rietveld 408576698