Sanitize inheritance in callers of utils.expose

extensions/renderer/safe_builtins.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/safe_builtins.h"
 
 #include "base/logging.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "extensions/renderer/script_context.h"
@@ skipping 58 matching lines @@
     "// Save only what is needed by the extension modules.\n"
     "saveBuiltin(Object,\n"
     "            ['hasOwnProperty'],\n"
     "            ['create', 'defineProperty', 'freeze',\n"
     "             'getOwnPropertyDescriptor', 'getPrototypeOf', 'keys',\n"
     "             'assign', 'setPrototypeOf']);\n"
     "saveBuiltin(Function,\n"
     "            ['apply', 'bind', 'call']);\n"
     "saveBuiltin(Array,\n"
     "            ['concat', 'forEach', 'indexOf', 'join', 'push', 'slice',\n"
-    "             'splice', 'map', 'filter', 'unshift'],\n"
+    "             'splice', 'map', 'filter', 'unshift', 'pop', 'reverse'],\n"
     "            ['isArray']);\n"
     "saveBuiltin(String,\n"
     "            ['indexOf', 'slice', 'split', 'substr', 'toUpperCase',\n"
     "             'replace']);\n"
     "// Use exec rather than test to defend against clobbering in the\n"
     "// presence of ES2015 semantics, which read RegExp.prototype.exec.\n"
     "saveBuiltin(RegExp,\n"
     "            ['exec']);\n"
     "saveBuiltin(Error,\n"
     "            [],\n"
@@ skipping 160 matching lines @@
 
 v8::Local<v8::Object> SafeBuiltins::GetString() const {
   return Load("String", context_->v8_context());
 }
 
 v8::Local<v8::Object> SafeBuiltins::GetError() const {
   return Load("Error", context_->v8_context());
 }
 
 }  //  namespace extensions