[Extensions] Finish freezing schema

extensions/renderer/v8_schema_registry.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/v8_schema_registry.h"
 
 #include <stddef.h>
 
 #include <utility>
 
 #include "base/logging.h"
 #include "base/values.h"
 #include "content/public/child/v8_value_converter.h"
 #include "extensions/common/extension_api.h"
 #include "extensions/renderer/object_backed_native_handler.h"
 #include "extensions/renderer/script_context.h"
 
 using content::V8ValueConverter;
 
 namespace extensions {
 
 namespace {
 
+// Recursively freezes every v8 object on |object|.
+void DeepFreeze(const v8::Local<v8::Object>& object,
+                const v8::Local<v8::Context>& context) {

[robwu, 2016/04/21 14:07:50]

As explained at https://crbug.com/604901#c8, add something equivalent to the
following line:

object->SetPrototype(context, v8::Null(context->GetIsolate()));

[Devlin, 2016/04/21 22:07:36]

Done.

This also has the happy side-effect of making a bunch of places that should have
been using safe builtins fail.

+  v8::Local<v8::Array> property_names = object->GetOwnPropertyNames();
+  for (uint32_t i = 0; i < property_names->Length(); ++i) {
+    v8::Local<v8::Value> child = object->Get(property_names->Get(i));
+    if (child->IsObject())
+      DeepFreeze(v8::Local<v8::Object>::Cast(child), context);
+  }
+  object->SetIntegrityLevel(context, v8::IntegrityLevel::kFrozen);
+}
+
 class SchemaRegistryNativeHandler : public ObjectBackedNativeHandler {
  public:
   SchemaRegistryNativeHandler(V8SchemaRegistry* registry,
                               scoped_ptr<ScriptContext> context)
       : ObjectBackedNativeHandler(context.get()),
         context_(std::move(context)),
         registry_(registry) {
     RouteFunction("GetSchema",
                   base::Bind(&SchemaRegistryNativeHandler::GetSchema,
                              base::Unretained(this)));
@@ skipping 63 matching lines @@
   v8::Context::Scope context_scope(context);
 
   const base::DictionaryValue* schema =
       ExtensionAPI::GetSharedInstance()->GetSchema(api);
   CHECK(schema) << api;
   scoped_ptr<V8ValueConverter> v8_value_converter(V8ValueConverter::create());
   v8::Local<v8::Value> value = v8_value_converter->ToV8Value(schema, context);
   CHECK(!value.IsEmpty());
 
   v8::Local<v8::Object> v8_schema(v8::Local<v8::Object>::Cast(value));
-  v8_schema->SetIntegrityLevel(context, v8::IntegrityLevel::kFrozen);
+  DeepFreeze(v8_schema, context);
   schema_cache_->Set(api, v8_schema);
 
   return handle_scope.Escape(v8_schema);
 }
 
 v8::Local<v8::Context> V8SchemaRegistry::GetOrCreateContext(
     v8::Isolate* isolate) {
   // It's ok to create local handles in this function, since this is only called
   // when we have a HandleScope.
   if (!context_holder_) {
     context_holder_.reset(new gin::ContextHolder(isolate));
     context_holder_->SetContext(v8::Context::New(isolate));
     schema_cache_.reset(new SchemaCache(isolate));
     return context_holder_->context();
   }
   return context_holder_->context();
 }
 
 }  // namespace extensions