Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(10)

Issue 1903303002: Ensure that privates are private. (Closed)

Created:
4 years, 8 months ago by robwu
Modified:
4 years, 8 months ago
Reviewers:
Devlin
CC:
chromium-reviews, chromium-apps-reviews_chromium.org, extensions-reviews_chromium.org
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Ensure that privates are private. - Remove JS code injection functionality from UtilsNativeHandler. - Ensure that utils.expose only exposes public properties. - Prevent privates from getting poisoned via arbitrary constructor invocations. - Prevent privates from leaking through prototypes. BUG=603748 Committed: https://crrev.com/77e0fbe12e32b16d5c1d7c0380b45fde363004b2 Cr-Commit-Position: refs/heads/master@{#389292}

Patch Set 1 #

Total comments: 4

Patch Set 2 : Fix utils.expose #

Total comments: 9

Patch Set 3 : Up to #12 + use v8::Maybe version #

Patch Set 4 : Add $Object.setPrototypeOf #

Patch Set 5 : rebase for safe_builtins conflict #

Total comments: 6

Patch Set 6 : Nits + disable DCHECK #

Patch Set 7 : Fix for failing tests #

Unified diffs Side-by-side diffs Delta from patch set Stats (+285 lines, -207 lines) Patch
M chrome/renderer/resources/extensions/automation/automation_event.js View 1 2 3 1 chunk +15 lines, -5 lines 0 comments Download
M chrome/renderer/resources/extensions/automation/automation_node.js View 1 2 3 1 chunk +51 lines, -40 lines 0 comments Download
M chrome/renderer/resources/extensions/enterprise_platform_keys/key_pair.js View 1 2 3 1 chunk +11 lines, -3 lines 0 comments Download
M chrome/renderer/resources/extensions/enterprise_platform_keys/subtle_crypto.js View 1 2 3 2 chunks +12 lines, -9 lines 0 comments Download
M chrome/renderer/resources/extensions/enterprise_platform_keys/token.js View 1 2 3 1 chunk +11 lines, -2 lines 0 comments Download
M chrome/renderer/resources/extensions/platform_keys/key.js View 1 2 3 1 chunk +11 lines, -4 lines 0 comments Download
M chrome/renderer/resources/extensions/platform_keys/subtle_crypto.js View 1 2 3 1 chunk +12 lines, -6 lines 0 comments Download
M chrome/renderer/resources/extensions/web_view/chrome_web_view.js View 1 2 3 4 chunks +14 lines, -6 lines 0 comments Download
M extensions/renderer/module_system.cc View 1 2 3 4 1 chunk +4 lines, -0 lines 0 comments Download
M extensions/renderer/module_system_unittest.cc View 1 2 3 4 1 chunk +10 lines, -0 lines 0 comments Download
M extensions/renderer/resources/event.js View 1 2 3 4 1 chunk +16 lines, -11 lines 0 comments Download
M extensions/renderer/resources/messaging.js View 1 2 3 1 chunk +14 lines, -9 lines 0 comments Download
M extensions/renderer/resources/utils.js View 1 2 3 4 5 6 5 chunks +65 lines, -16 lines 0 comments Download
M extensions/renderer/resources/web_request_internal_custom_bindings.js View 1 2 3 1 chunk +14 lines, -11 lines 0 comments Download
M extensions/renderer/safe_builtins.cc View 1 2 3 4 1 chunk +1 line, -1 line 0 comments Download
M extensions/renderer/utils_native_handler.h View 1 1 chunk +0 lines, -5 lines 0 comments Download
M extensions/renderer/utils_native_handler.cc View 1 3 chunks +0 lines, -65 lines 0 comments Download
M extensions/test/data/utils_unittest.js View 1 2 3 4 5 6 2 chunks +24 lines, -14 lines 0 comments Download

Messages

Total messages: 27 (9 generated)
robwu
4 years, 8 months ago (2016-04-20 16:34:47 UTC) #2
Devlin
https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc File extensions/renderer/utils_native_handler.cc (right): https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc#newcode60 extensions/renderer/utils_native_handler.cc:60: " function %s() {\n" Wow. I don't think I've ...
4 years, 8 months ago (2016-04-20 17:42:07 UTC) #3
robwu
https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc File extensions/renderer/utils_native_handler.cc (right): https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc#newcode60 extensions/renderer/utils_native_handler.cc:60: " function %s() {\n" On 2016/04/20 17:42:07, Devlin wrote: ...
4 years, 8 months ago (2016-04-21 08:48:11 UTC) #4
Devlin
On 2016/04/21 08:48:11, robwu wrote: > https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc > File extensions/renderer/utils_native_handler.cc (right): > > https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc#newcode60 > ...
4 years, 8 months ago (2016-04-21 16:32:32 UTC) #5
Devlin
On 2016/04/21 16:32:32, Devlin wrote: > On 2016/04/21 08:48:11, robwu wrote: > > > https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc ...
4 years, 8 months ago (2016-04-21 16:33:05 UTC) #6
robwu
https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc File extensions/renderer/utils_native_handler.cc (right): https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc#newcode60 extensions/renderer/utils_native_handler.cc:60: " function %s() {\n" On 2016/04/21 16:33:05, Devlin wrote: ...
4 years, 8 months ago (2016-04-21 17:29:36 UTC) #7
robwu
https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc File extensions/renderer/utils_native_handler.cc (right): https://codereview.chromium.org/1903303002/diff/1/extensions/renderer/utils_native_handler.cc#newcode60 extensions/renderer/utils_native_handler.cc:60: " function %s() {\n" On 2016/04/21 17:29:35, robwu wrote: ...
4 years, 8 months ago (2016-04-21 17:33:37 UTC) #8
Devlin
Any of those would probably be fine. Another option which might be cleaner could also ...
4 years, 8 months ago (2016-04-21 18:31:39 UTC) #9
robwu
On 2016/04/21 18:31:39, Devlin wrote: > Any of those would probably be fine. Another option ...
4 years, 8 months ago (2016-04-22 16:48:51 UTC) #11
Devlin
I'm getting "error: old chunk mismatch" when I try to see side-by-side, so I'd like ...
4 years, 8 months ago (2016-04-22 17:08:21 UTC) #12
robwu
On 2016/04/22 17:08:21, Devlin wrote: > I'm getting "error: old chunk mismatch" when I try ...
4 years, 8 months ago (2016-04-22 17:37:40 UTC) #13
Devlin
lgtm w/ nits https://codereview.chromium.org/1903303002/diff/20001/chrome/renderer/resources/extensions/automation/automation_event.js File chrome/renderer/resources/extensions/automation/automation_event.js (right): https://codereview.chromium.org/1903303002/diff/20001/chrome/renderer/resources/extensions/automation/automation_event.js#newcode26 chrome/renderer/resources/extensions/automation/automation_event.js:26: On 2016/04/22 17:37:40, robwu wrote: > ...
4 years, 8 months ago (2016-04-22 18:52:46 UTC) #14
robwu
https://codereview.chromium.org/1903303002/diff/80001/extensions/renderer/resources/utils.js File extensions/renderer/resources/utils.js (right): https://codereview.chromium.org/1903303002/diff/80001/extensions/renderer/resources/utils.js#newcode80 extensions/renderer/resources/utils.js:80: * be a named function, and the name appears ...
4 years, 8 months ago (2016-04-22 20:33:43 UTC) #15
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1903303002/100001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1903303002/100001
4 years, 8 months ago (2016-04-22 20:35:10 UTC) #18
commit-bot: I haz the power
Try jobs failed on following builders: mac_chromium_rel_ng on tryserver.chromium.mac (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_ng/builds/216242)
4 years, 8 months ago (2016-04-22 21:10:39 UTC) #20
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1903303002/120001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1903303002/120001
4 years, 8 months ago (2016-04-22 22:58:30 UTC) #23
commit-bot: I haz the power
Committed patchset #7 (id:120001)
4 years, 8 months ago (2016-04-22 23:17:05 UTC) #25
commit-bot: I haz the power
4 years, 8 months ago (2016-04-22 23:19:14 UTC) #27
Message was sent while issue was closed.
Patchset 7 (id:??) landed as
https://crrev.com/77e0fbe12e32b16d5c1d7c0380b45fde363004b2
Cr-Commit-Position: refs/heads/master@{#389292}

Powered by Google App Engine
This is Rietveld 408576698