Blink bindings: use v8 to enforce method call access checks

third_party/WebKit/Source/bindings/core/v8/V8DOMConfiguration.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 330 matching lines @@
   if (method.holderCheckConfiguration == V8DOMConfiguration::DoNotCheckHolder)
     signature = v8::Local<v8::Signature>();
 
   DCHECK(method.propertyLocationConfiguration);
   if (method.propertyLocationConfiguration &
       (V8DOMConfiguration::OnInstance | V8DOMConfiguration::OnPrototype)) {
     v8::Local<v8::FunctionTemplate> functionTemplate =
         v8::FunctionTemplate::New(isolate, callback, v8::Local<v8::Value>(),
                                   signature, method.length);
     functionTemplate->RemovePrototype();
+    if (method.accessCheckConfiguration == V8DOMConfiguration::CheckAccess)
+      functionTemplate->SetAcceptAnyReceiver(false);
     if (method.propertyLocationConfiguration & V8DOMConfiguration::OnInstance)
       instanceTemplate->Set(
           name, functionTemplate,
           static_cast<v8::PropertyAttribute>(method.attribute));
     if (method.propertyLocationConfiguration & V8DOMConfiguration::OnPrototype)
       prototypeTemplate->Set(
           name, functionTemplate,
           static_cast<v8::PropertyAttribute>(method.attribute));
   }
   if (method.propertyLocationConfiguration & V8DOMConfiguration::OnInterface) {
     // Operations installed on the interface object must be static
     // operations, so no need to specify a signature, i.e. no need to do
     // type check against a holder.
     v8::Local<v8::FunctionTemplate> functionTemplate =
         v8::FunctionTemplate::New(isolate, callback, v8::Local<v8::Value>(),
                                   v8::Local<v8::Signature>(), method.length);
     functionTemplate->RemovePrototype();
+    // TODO(dcheng): Does this need an access check?

[dcheng, 2017/02/27 05:34:19]

I don't think it does, since I think this implies a static method?

[haraken, 2017/02/27 05:49:25]

Agreed. We won't need the access check. I'm okay with adding the check just in
case though.

[dcheng, 2017/02/27 07:52:26]

Hmm... it's not possible to do an access check in that case though, since there
is no |impl|. I will just remove the TODO and write a comment why an access
check is not necessary in this case.

[Yuki, 2017/03/01 08:40:11]

Just FYI, the spec doesn't require any access check here because the property is
a data property.  There is no way to perform a security check when just getting
a data property.

     interfaceTemplate->Set(
         name, functionTemplate,
         static_cast<v8::PropertyAttribute>(method.attribute));
   }
 }
 
 void installMethodInternal(
     v8::Isolate* isolate,
     v8::Local<v8::Object> instance,
     v8::Local<v8::Object> prototype,
@@ skipping 286 matching lines @@
 void V8DOMConfiguration::setClassString(
     v8::Isolate* isolate,
     v8::Local<v8::ObjectTemplate> objectTemplate,
     const char* classString) {
   objectTemplate->Set(
       v8::Symbol::GetToStringTag(isolate), v8AtomicString(isolate, classString),
       static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontEnum));
 }
 
 }  // namespace blink