Don't run handleEvent getter in V8EventListener::getListenerFunction if script is forbidden.

Don't run handleEvent getter in V8EventListener::getListenerFunction if script is forbidden.

It results in arbitrary code execution under ScriptForbiddenScopes. :(

BUG=655904
Committed: https://crrev.com/610b88604db99184334982ab982d758296718879
Cr-Commit-Position: refs/heads/master@{#425763}

[esprehn, 2016-10-14 23:03:17]

The CQ bit was checked by esprehn@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-14 23:03:47]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-15 02:54:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-15 02:54:16]

Dry run: This issue passed the CQ dry run.

[esprehn, 2016-10-15 03:35:54]

esprehn@chromium.org changed reviewers:
+ haraken@chromium.org, jochen@chromium.org

[esprehn, 2016-10-15 03:36:17]

Description was changed from

==========
Don't run handleEvent getter in V8EventListener::getListenerFunction if script
is forbidden.

BUG=655904
==========

to

==========
Don't run handleEvent getter in V8EventListener::getListenerFunction if script
is forbidden.

It results in arbitrary code execution under ScriptForbiddenScopes. :(

BUG=655904
==========

[haraken, 2016-10-15 05:23:24]

LGTM

However, there're a lot of other places in bindings where Get() can invoke
arbitrary JS...

[jochen (gone - plz use gerrit), 2016-10-17 09:52:42]

lgtm

[jochen (gone - plz use gerrit), 2016-10-17 09:53:10]

btw, if we fire events, would we also do a microtask checkpoint?

[esprehn, 2016-10-17 18:44:59]

The CQ bit was checked by esprehn@chromium.org

[commit-bot: I haz the power, 2016-10-17 18:45:54]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-17 20:11:02]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-10-17 20:14:09]

Description was changed from

==========
Don't run handleEvent getter in V8EventListener::getListenerFunction if script
is forbidden.

It results in arbitrary code execution under ScriptForbiddenScopes. :(

BUG=655904
==========

to

==========
Don't run handleEvent getter in V8EventListener::getListenerFunction if script
is forbidden.

It results in arbitrary code execution under ScriptForbiddenScopes. :(

BUG=655904

Committed: https://crrev.com/610b88604db99184334982ab982d758296718879
Cr-Commit-Position: refs/heads/master@{#425763}
==========

[commit-bot: I haz the power, 2016-10-17 20:14:10]

Patchset 1 (id:??) landed as
https://crrev.com/610b88604db99184334982ab982d758296718879
Cr-Commit-Position: refs/heads/master@{#425763}