Bindings: perform security check before downcasting to LocalDOMWindow.

third_party/WebKit/Source/bindings/templates/attributes.cpp.tmpl

 {% from 'utilities.cpp.tmpl' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 {##############################################################################}
 {% macro attribute_getter(attribute, world_suffix) %}
 static void {{attribute.name}}AttributeGetter{{world_suffix}}(
 {%- if attribute.is_data_type_property %}
 const v8::PropertyCallbackInfo<v8::Value>& info
 {%- else %}
 const v8::FunctionCallbackInfo<v8::Value>& info
 {%- endif %}) {
@@ skipping 25 matching lines @@
   {
     v8::Local<v8::Value> v8Value = privateSameObject.get(info.GetIsolate()->GetCurrentContext(), holder);
     if (!v8Value.IsEmpty()) {
       v8SetReturnValue(info, v8Value);
       return;
     }
   }
   {% endif %}
 
   {% if not attribute.is_static %}
-  {% if interface_name == 'Window' and not attribute.has_cross_origin_getter %}
+  {% set local_dom_window_only = interface_name == 'Window' and not attribute.has_cross_origin_getter %}
+  {% if local_dom_window_only %}
+  {% if attribute.is_check_security_for_receiver %}
+  {{cpp_class}}* uncheckedImpl = {{v8_class}}::toImpl(holder);
+  {% else %}
   // Same-origin attribute getters are never exposed via the cross-origin
   // interceptors. Since same-origin access requires a LocalDOMWindow, it is
   // safe to downcast here.
   LocalDOMWindow* impl = toLocalDOMWindow({{v8_class}}::toImpl(holder));
+  {% endif %}{# attribute.is_check_security_for_receiver #}
   {% else %}
   {{cpp_class}}* impl = {{v8_class}}::toImpl(holder);
-  {% endif %}
-  {% endif %}
+  {% endif %}{# local_dom_window_only #}
+  {% endif %}{# not attribute.is_static #}
 
   {% if attribute.cached_attribute_validation_method %}
   // [CachedAttribute]
   v8::Local<v8::String> propertyName = v8AtomicString(info.GetIsolate(), "{{attribute.name}}");
   if (!impl->{{attribute.cached_attribute_validation_method}}()) {
     v8::Local<v8::Value> v8Value = V8HiddenValue::getHiddenValue(ScriptState::forFunctionObject(info), holder, propertyName);
     if (!v8Value.IsEmpty() && !v8Value->IsUndefined()) {
       v8SetReturnValue(info, v8Value);
       return;
     }
   }
   {% endif %}
 
   {% if attribute.is_check_security_for_receiver and not attribute.is_data_type_property %}
   // Perform a security check for the receiver object.
   {{define_exception_state}}
+  {% if local_dom_window_only %}
+  if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), uncheckedImpl, exceptionState)) {
+  {% else %}
   if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), impl, exceptionState)) {
+  {% endif %}{# local_dom_window_only #}
     v8SetReturnValueNull(info);
     return;
   }
+  {% if local_dom_window_only %}
+  LocalDOMWindow* impl = toLocalDOMWindow(uncheckedImpl);
+  {% endif %}{# local_dom_window_only #}
   {% endif %}
 
   {% if attribute.is_check_security_for_return_value %}
   // Perform a security check for the returned object.
   {{define_exception_state}}
   if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), {{attribute.cpp_value}}, exceptionState)) {
     v8SetReturnValueNull(info);
     return;
   }
   {% endif %}
@@ skipping 197 matching lines @@
   {% endif %}
 
   {% if not attribute.is_static and not attribute.is_replaceable %}
   v8::Local<v8::Object> holder = info.Holder();
   {% if attribute.is_put_forwards %}
   {{cpp_class}}* proxyImpl = {{v8_class}}::toImpl(holder);
   {{attribute.cpp_type}} impl = WTF::getPtr(proxyImpl->{{attribute.name}}());
   if (!impl)
     return;
   {% else %}
-  {% if interface_name == 'Window' and not attribute.has_cross_origin_setter %}
-  // Same-origin attribute setters are never exposed via the cross-origin
+  {% set local_dom_window_only = interface_name == 'Window' and not attribute.has_cross_origin_setter %}
+  {% if local_dom_window_only %}
+  {% if attribute.is_check_security_for_receiver %}
+  {{cpp_class}}* uncheckedImpl = {{v8_class}}::toImpl(holder);
+  {% else %}
+  // Same-origin attributes setters are never exposed via the cross-origin
   // interceptors. Since same-origin access requires a LocalDOMWindow, it is
   // safe to downcast here.
   LocalDOMWindow* impl = toLocalDOMWindow({{v8_class}}::toImpl(holder));
+  {% endif %}{# attribute.is_check_security_for_receiver #}
   {% else %}
   {{cpp_class}}* impl = {{v8_class}}::toImpl(holder);
-  {% endif %}
+  {% endif %}{# local_dom_window_only #}
   {% endif %}
   {% endif %}
 
   {% if attribute.is_check_security_for_receiver and not attribute.is_data_type_property %}
   // Perform a security check for the receiver object.
   {{define_exception_state}}
+  {% if local_dom_window_only %}
+  if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), uncheckedImpl, exceptionState)) {
+  {% else %}
   if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), impl, exceptionState)) {
+  {% endif %}{# local_dom_window_only #}
     v8SetReturnValue(info, v8Value);
     return;
   }
+  {% if local_dom_window_only %}
+  LocalDOMWindow* impl = toLocalDOMWindow(uncheckedImpl);
+  {% endif %}{# local_dom_window_only #}
   {% endif %}
 
   {% if attribute.is_check_security_for_return_value %}
 #error Attribute setter with the security check for the return value is not supported.  Since the return value is the given value to be set, it\'s meaningless to perform the security check for the return value.
   {% endif %}
 
   {% if attribute.is_custom_element_callbacks or
         (attribute.is_reflect and not (attribute.idl_type == 'DOMString' and is_node)) %}
   // Skip on compact node DOMString getters.
   V0CustomElementProcessingStack::CallbackDeliveryScope deliveryScope;
@@ skipping 153 matching lines @@
        getter_callback_for_main_world,
        setter_callback_for_main_world,
        cached_accessor_callback,
        wrapper_type_info,
        property_attribute,
        property_location(attribute),
        holder_check,
    ] %}
 {{'{'}}{{attribute_configuration_list | join(', ')}}{{'}'}}
 {%- endmacro %}