DevTools: Fix tainted Function.prototype methods may disable console.

Source/core/inspector/InjectedScriptSource.js

 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 100 matching lines @@
  */
 function bind(func, thisObject, var_args)
 {
     var args = slice(arguments, 2);
 
     /**
      * @param {...} var_args
      */
     function bound(var_args)
     {
-        return func.apply(thisObject, concat(args, slice(arguments)));
+        return InjectedScriptHost.callFunction(func, thisObject, concat(args, slice(arguments)));
     }
     bound.toString = function()
     {
         return "bound: " + func;
     };
     return bound;
 }
 
 /**
  * @param {T} obj
@@ skipping 12 matching lines @@
  * @param {*} obj
  * @return {boolean}
  */
 function isArrayLike(obj)
 {
     try {
         if (typeof obj !== "object")
             return false;
         if (typeof obj.splice === "function")
             return isFinite(obj.length);
-        var str = Object.prototype.toString.call(obj);
+        var str = InjectedScriptHost.callFunction(Object.prototype.toString, obj);
         if (str === "[object Array]" ||
             str === "[object Arguments]" ||
             str === "[object HTMLCollection]" ||
             str === "[object NodeList]" ||
             str === "[object DOMTokenList]")
             return isFinite(obj.length);
     } catch (e) {
     }
     return false;
 }
@@ skipping 205 matching lines @@
     },
 
     /**
      * @param {string} methodName
      * @param {string} args
      * @return {*}
      */
     dispatch: function(methodName, args)
     {
         var argsArray = InjectedScriptHost.eval("(" + args + ")");
-        var result = this[methodName].apply(this, argsArray);
+        var result = InjectedScriptHost.callFunction(this[methodName], this, argsArray);
         if (typeof result === "undefined") {
             inspectedWindow.console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
             result = null;
         }
         return result;
     },
 
     /**
      * @param {string} objectId
      * @param {boolean} ownProperties
@@ skipping 120 matching lines @@
                 var property = properties[i];
                 if (propertyProcessed[property])
                     continue;
 
                 var name = property;
                 if (isSymbol(property))
                     name = injectedScript._describe(property);
 
                 try {
                     propertyProcessed[property] = true;
-                    var descriptor = nullifyObjectProto(InjectedScriptHost.suppressWarningsAndCall(Object, Object.getOwnPropertyDescriptor, o, property));
+                    var descriptor = nullifyObjectProto(InjectedScriptHost.suppressWarningsAndCallFunction(Object.getOwnPropertyDescriptor, Object, [o, property]));
                     if (descriptor) {
                         if (accessorPropertiesOnly && !("get" in descriptor || "set" in descriptor))
                             continue;
                     } else {
                         // Not all bindings provide proper descriptors. Fall back to the writable, configurable property.
                         if (accessorPropertiesOnly)
                             continue;
                         try {
                             descriptor = { name: name, value: o[property], writable: false, configurable: false, enumerable: false, __proto__: null };
                             if (o === object)
@@ skipping 41 matching lines @@
     /**
      * @param {string} expression
      * @param {string} objectGroup
      * @param {boolean} injectCommandLineAPI
      * @param {boolean} returnByValue
      * @param {boolean} generatePreview
      * @return {*}
      */
     evaluate: function(expression, objectGroup, injectCommandLineAPI, returnByValue, generatePreview)
     {
-        return this._evaluateAndWrap(InjectedScriptHost.evaluateWithExceptionDetails, InjectedScriptHost, expression, objectGroup, false, injectCommandLineAPI, returnByValue, generatePreview);
+        return this._evaluateAndWrap(null, null, expression, objectGroup, false, injectCommandLineAPI, returnByValue, generatePreview);
     },
 
     /**
      * @param {string} objectId
      * @param {string} expression
      * @param {string} args
      * @param {boolean} returnByValue
      * @return {!Object|string}
      */
     callFunctionOn: function(objectId, expression, args, returnByValue)
@@ skipping 15 matching lines @@
             }
         }
 
         try {
             var objectGroup = this._idToObjectGroupName[parsedObjectId.id];
             var func = InjectedScriptHost.eval("(" + expression + ")");
             if (typeof func !== "function")
                 return "Given expression does not evaluate to a function";
 
             return { wasThrown: false,
-                     result: this._wrapObject(func.apply(object, resolvedArgs), objectGroup, returnByValue),
+                     result: this._wrapObject(InjectedScriptHost.callFunction(func, object, resolvedArgs), objectGroup, returnByValue),
                      __proto__: null };
         } catch (e) {
             return this._createThrownValue(e, objectGroup, false);
         }
     },
 
     /**
      * Resolves a value from CallArgument description.
      * @param {!RuntimeAgent.CallArgument} callArgumentJson
      * @return {*} resolved value
@@ skipping 16 matching lines @@
         } else if ("value" in callArgumentJson) {
             var value = callArgumentJson.value;
             if (callArgumentJson.type === "number" && typeof value !== "number")
                 value = Number(value);
             return value;
         }
         return undefined;
     },
 
     /**
-     * @param {!Function} evalFunction
-     * @param {!Object} object
+     * @param {?function(string):*} evalFunction
+     * @param {?Object} object
      * @param {string} expression
      * @param {string} objectGroup
      * @param {boolean} isEvalOnCallFrame
      * @param {boolean} injectCommandLineAPI
      * @param {boolean} returnByValue
      * @param {boolean} generatePreview
      * @param {!Array.<!Object>=} scopeChain
      * @return {!Object}
      */
     _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame, injectCommandLineAPI, returnByValue, generatePreview, scopeChain)
@@ skipping 19 matching lines @@
         var remoteObject = this._wrapObject(value, objectGroup, false, generatePreview && !(value instanceof Error));
         if (!remoteObject.description){
             try {
                 remoteObject.description = toStringDescription(value);
             } catch (e) {}
         }
         return { wasThrown: true, result: remoteObject, exceptionDetails: exceptionDetails, __proto__: null };
     },
 
     /**
-     * @param {!Function} evalFunction
-     * @param {!Object} object
+     * @param {?function(string):*} evalFunction
+     * @param {?Object} object
      * @param {string} objectGroup
      * @param {string} expression
      * @param {boolean} isEvalOnCallFrame
      * @param {boolean} injectCommandLineAPI
      * @param {!Array.<!Object>=} scopeChain
      * @return {*}
      */
     _evaluateOn: function(evalFunction, object, objectGroup, expression, isEvalOnCallFrame, injectCommandLineAPI, scopeChain)
     {
         // Only install command line api object for the time of evaluation.
@@ skipping 17 matching lines @@
                     prefix = "with (__scopeChainForEval[" + i + "] || { __proto__: null }) {" + (suffix ? " " : "") + prefix;
                     if (suffix)
                         suffix += " }";
                     else
                         suffix = "}";
                 }
             }
 
             if (prefix)
                 expression = prefix + "\n" + expression + "\n" + suffix;
-            var wrappedResult = evalFunction.call(object, expression);
+            var wrappedResult = evalFunction ? InjectedScriptHost.callFunction(evalFunction, object, [expression]) : InjectedScriptHost.evaluateWithExceptionDetails(expression);
             if (objectGroup === "console" && !wrappedResult.exceptionDetails)
                 this._lastResult = wrappedResult.result;
             return wrappedResult;
         } finally {
             if (injectCommandLineAPI)
                 delete inspectedWindow.__commandLineAPI;
             if (injectScopeChain)
                 delete inspectedWindow.__scopeChainForEval;
         }
     },
@@ skipping 29 matching lines @@
      * @param {boolean} generatePreview
      * @return {*}
      */
     evaluateOnCallFrame: function(topCallFrame, asyncCallStacks, callFrameId, expression, objectGroup, injectCommandLineAPI, returnByValue, generatePreview)
     {
         var parsedCallFrameId = nullifyObjectProto(InjectedScriptHost.eval("(" + callFrameId + ")"));
         var callFrame = this._callFrameForParsedId(topCallFrame, parsedCallFrameId, asyncCallStacks);
         if (!callFrame)
             return "Could not find call frame with given id";
         if (parsedCallFrameId["asyncOrdinal"])
-            return this._evaluateAndWrap(InjectedScriptHost.evaluateWithExceptionDetails, InjectedScriptHost, expression, objectGroup, false, injectCommandLineAPI, returnByValue, generatePreview, callFrame.scopeChain);
+            return this._evaluateAndWrap(null, null, expression, objectGroup, false, injectCommandLineAPI, returnByValue, generatePreview, callFrame.scopeChain);
         return this._evaluateAndWrap(callFrame.evaluateWithExceptionDetails, callFrame, expression, objectGroup, true, injectCommandLineAPI, returnByValue, generatePreview);
     },
 
     /**
      * @param {!Object} topCallFrame
      * @param {string} callFrameId
      * @return {*}
      */
     restartFrame: function(topCallFrame, callFrameId)
     {
@@ skipping 142 matching lines @@
      * @return {?Object}
      */
     injectModule: function(name, source)
     {
         delete this._modules[name];
         var moduleFunction = InjectedScriptHost.eval("(" + source + ")");
         if (typeof moduleFunction !== "function") {
             inspectedWindow.console.error("Web Inspector error: A function was expected for module %s evaluation", name);
             return null;
         }
-        var module = moduleFunction.call(inspectedWindow, InjectedScriptHost, inspectedWindow, injectedScriptId, this);
+        var module = InjectedScriptHost.callFunction(moduleFunction, inspectedWindow, [InjectedScriptHost, inspectedWindow, injectedScriptId, this]);
         this._modules[name] = module;
         return module;
     },
 
     /**
      * @param {*} object
      * @return {boolean}
      */
     _isDefined: function(object)
     {
@@ skipping 74 matching lines @@
                 className += "[" + obj.length + "]";
             return className;
         }
 
         // NodeList in JSC is a function, check for array prior to this.
         if (typeof obj === "function")
             return toString(obj);
 
         if (isSymbol(obj)) {
             try {
-                return Symbol.prototype.toString.call(obj) || "Symbol";
+                return InjectedScriptHost.callFunction(Symbol.prototype.toString, obj) || "Symbol";
             } catch (e) {
                 return "Symbol";
             }
         }
 
         if (obj instanceof Error && !!obj.message)
             return className + ": " + obj.message;
 
         return className;
     }
@@ skipping 442 matching lines @@
                 push(nodes, node);
             return nodes;
         }
     },
 
     /**
      * @return {*}
      */
     dir: function(var_args)
     {
-        return inspectedWindow.console.dir.apply(inspectedWindow.console, arguments)
+        return InjectedScriptHost.callFunction(inspectedWindow.console.dir, inspectedWindow.console, slice(arguments));
     },
 
     /**
      * @return {*}
      */
     dirxml: function(var_args)
     {
-        return inspectedWindow.console.dirxml.apply(inspectedWindow.console, arguments)
+        return InjectedScriptHost.callFunction(inspectedWindow.console.dirxml, inspectedWindow.console, slice(arguments));
     },
 
     /**
      * @return {!Array.<string>}
      */
     keys: function(object)
     {
         return Object.keys(object);
     },
 
     /**
      * @return {!Array.<*>}
      */
     values: function(object)
     {
         var result = [];
         for (var key in object)
             push(result, object[key]);
         return result;
     },
 
     /**
      * @return {*}
      */
     profile: function(opt_title)
     {
-        return inspectedWindow.console.profile.apply(inspectedWindow.console, arguments)
+        return InjectedScriptHost.callFunction(inspectedWindow.console.profile, inspectedWindow.console, slice(arguments));
     },
 
     /**
      * @return {*}
      */
     profileEnd: function(opt_title)
     {
-        return inspectedWindow.console.profileEnd.apply(inspectedWindow.console, arguments)
+        return InjectedScriptHost.callFunction(inspectedWindow.console.profileEnd, inspectedWindow.console, slice(arguments));
     },
 
     /**
      * @param {!Object} object
      * @param {!Array.<string>|string=} opt_types
      */
     monitorEvents: function(object, opt_types)
     {
         if (!object || !object.addEventListener || !object.removeEventListener)
             return;
@@ skipping 90 matching lines @@
         InjectedScriptHost.monitorFunction(fn);
     },
 
     unmonitor: function(fn)
     {
         InjectedScriptHost.unmonitorFunction(fn);
     },
 
     table: function(data, opt_columns)
     {
-        inspectedWindow.console.table.apply(inspectedWindow.console, arguments);
+        InjectedScriptHost.callFunction(inspectedWindow.console.table, inspectedWindow.console, slice(arguments));
     },
 
     /**
      * @param {number} num
      */
     _inspectedObject: function(num)
     {
         return InjectedScriptHost.inspectedObject(num);
     },
 
@@ skipping 29 matching lines @@
      */
     _logEvent: function(event)
     {
         inspectedWindow.console.log(event.type, event);
     }
 }
 
 injectedScript._commandLineAPIImpl = new CommandLineAPIImpl();
 return injectedScript;
 })