OLD | NEW |
---|---|
(Empty) | |
1 #!/usr/bin/env python | |
Michael Achenbach
2016/09/28 09:54:05
Could you add a note where those file are copied f
kozy
2016/09/28 23:38:46
I added a comment and will remove this as soon as
| |
2 # Copyright (c) 2014 Google Inc. All rights reserved. | |
3 # | |
4 # Redistribution and use in source and binary forms, with or without | |
5 # modification, are permitted provided that the following conditions are | |
6 # met: | |
7 # | |
8 # * Redistributions of source code must retain the above copyright | |
9 # notice, this list of conditions and the following disclaimer. | |
10 # * Redistributions in binary form must reproduce the above | |
11 # copyright notice, this list of conditions and the following disclaimer | |
12 # in the documentation and/or other materials provided with the | |
13 # distribution. | |
14 # * Neither the name of Google Inc. nor the names of its | |
15 # contributors may be used to endorse or promote products derived from | |
16 # this software without specific prior written permission. | |
17 # | |
18 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS | |
19 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
20 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR | |
21 # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT | |
22 # OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, | |
23 # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT | |
24 # LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | |
25 # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | |
26 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
27 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
28 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
29 | |
30 import re | |
31 import sys | |
32 import os | |
33 | |
34 | |
35 def validate_injected_script(fileName): | |
36 f = open(fileName, "r") | |
37 lines = f.readlines() | |
38 f.close() | |
39 | |
40 proto_functions = "|".join([ | |
41 # Array.prototype.* | |
42 "concat", "every", "filter", "forEach", "indexOf", "join", "lastIndexOf" , "map", "pop", | |
43 "push", "reduce", "reduceRight", "reverse", "shift", "slice", "some", "s ort", "splice", "toLocaleString", "toString", "unshift", | |
44 # Function.prototype.* | |
45 "apply", "bind", "call", "isGenerator", "toSource", | |
46 # Object.prototype.* | |
47 "toString", | |
48 ]) | |
49 | |
50 global_functions = "|".join([ | |
51 "eval", "uneval", "isFinite", "isNaN", "parseFloat", "parseInt", "decode URI", "decodeURIComponent", | |
52 "encodeURI", "encodeURIComponent", "escape", "unescape", "Map", "Set" | |
53 ]) | |
54 | |
55 # Black list: | |
56 # - instanceof, since e.g. "obj instanceof Error" may throw if Error is over ridden and is not a function | |
57 # - Object.prototype.toString() | |
58 # - Array.prototype.* | |
59 # - Function.prototype.* | |
60 # - Math.* | |
61 # - Global functions | |
62 black_list_call_regex = re.compile(r"\sinstanceof\s+\w*|\bMath\.\w+\(|(?<!In jectedScriptHost)\.(" + proto_functions + r")\(|[^\.]\b(" + global_functions + r ")\(") | |
63 | |
64 errors_found = False | |
65 for i, line in enumerate(lines): | |
66 if line.find("suppressBlacklist") != -1: | |
67 continue | |
68 for match in re.finditer(black_list_call_regex, line): | |
69 errors_found = True | |
70 print "ERROR: Black listed expression in %s at line %02d column %02d : %s" % (os.path.basename(fileName), i + 1, match.start(), match.group(0)) | |
71 | |
72 if not errors_found: | |
73 print "OK" | |
74 | |
75 | |
76 def main(argv): | |
77 if len(argv) < 2: | |
78 print('ERROR: Usage: %s path/to/injected-script-source.js' % argv[0]) | |
79 return 1 | |
80 | |
81 validate_injected_script(argv[1]) | |
82 | |
83 if __name__ == '__main__': | |
84 sys.exit(main(sys.argv)) | |
OLD | NEW |