make window interceptors DoNoCheckSecurity

Source/bindings/core/v8/custom/V8WindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 332 matching lines @@
         return;
 
     // Frame could have been detached in call to GetRealNamedProperty.
     frame = window->frame();
     // window is detached.
     if (!frame)
         return;
 
     // Search named items in the document.
     Document* doc = frame->document();
+    if (!doc || !doc->isHTMLDocument())
+        return;
 
-    if (doc && doc->isHTMLDocument()) {
-        if (toHTMLDocument(doc)->hasNamedItem(propName) || doc->hasElementWithId(propName)) {
-            RefPtrWillBeRawPtr<HTMLCollection> items = doc->windowNamedItems(propName);
-            if (!items->isEmpty()) {
-                if (items->hasExactlyOneItem()) {
-                    v8SetReturnValueFast(info, items->item(0), window);
-                    return;
-                }
-                v8SetReturnValueFast(info, items.release(), window);
+    // This is an AllCanRead interceptor.  Check that the caller has access to the named results.
+    if (!BindingSecurity::shouldAllowAccessToFrame(info.GetIsolate(), frame, DoNotReportSecurityError))
+        return;
+
+    if (toHTMLDocument(doc)->hasNamedItem(propName) || doc->hasElementWithId(propName)) {
+        RefPtrWillBeRawPtr<HTMLCollection> items = doc->windowNamedItems(propName);
+        if (!items->isEmpty()) {
+            if (items->hasExactlyOneItem()) {
+                v8SetReturnValueFast(info, items->item(0), window);
                 return;
             }
+            v8SetReturnValueFast(info, items.release(), window);
+            return;
         }
     }
 }
 
-bool V8Window::namedSecurityCheckCustom(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType type, v8::Local<v8::Value>)
+static bool SecurityCheck(v8::Local<v8::Object> host)

[haraken, 2015/02/12 09:45:58]

SecurityCheck => securityCheck

 {
     v8::Isolate* isolate = v8::Isolate::GetCurrent();
     v8::Handle<v8::Object> window = V8Window::findInstanceInPrototypeChain(host, isolate);
     if (window.IsEmpty())
         return false; // the frame is gone.
 
     DOMWindow* targetWindow = V8Window::toImpl(window);
     ASSERT(targetWindow);
     if (!targetWindow->isLocalDOMWindow())
         return false;
 
     LocalFrame* target = toLocalDOMWindow(targetWindow)->frame();
     if (!target)
         return false;
 
     // Notify the loader's client if the initial document has been accessed.
     if (target->loader().stateMachine()->isDisplayingInitialEmptyDocument())
         target->loader().didAccessInitialDocument();
 
-    if (key->IsString()) {

[haraken, 2015/02/12 09:45:58]

I'm assuming that the removed checks are now conducted in the V8 side, right?

[jochen (gone - plz use gerrit), 2015/02/12 09:52:17]

no, it's moved into the getter

-        DEFINE_STATIC_LOCAL(const AtomicString, nameOfProtoProperty, ("__proto__", AtomicString::ConstructFromLiteral));
-
-        AtomicString name = toCoreAtomicString(key.As<v8::String>());
-        Frame* childFrame = target->tree().scopedChild(name);
-        // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
-        // because that would generate infinite recursion.
-        if (type == v8::ACCESS_HAS && childFrame)
-            return true;
-        // We need to explicitly compare against nameOfProtoProperty because
-        // V8's JSObject::LocalLookup finds __proto__ before
-        // interceptors and even when __proto__ isn't a "real named property".
-        v8::Handle<v8::String> keyString = key.As<v8::String>();
-        if (type == v8::ACCESS_GET
-            && childFrame
-            && !host->HasRealNamedProperty(keyString)
-            && !window->HasRealNamedProperty(keyString)
-            && name != nameOfProtoProperty)
-            return true;
-    }
-
     return BindingSecurity::shouldAllowAccessToFrame(isolate, target, DoNotReportSecurityError);
 }
 
+bool V8Window::namedSecurityCheckCustom(v8::Local<v8::Object> host, v8::Local<v8::Value> key, v8::AccessType type, v8::Local<v8::Value>)
+{
+    return SecurityCheck(host);
+}
+
 bool V8Window::indexedSecurityCheckCustom(v8::Local<v8::Object> host, uint32_t index, v8::AccessType type, v8::Local<v8::Value>)
 {
-    v8::Isolate* isolate = v8::Isolate::GetCurrent();
-    v8::Handle<v8::Object> window = V8Window::findInstanceInPrototypeChain(host, isolate);
-    if (window.IsEmpty())
-        return false;
-
-    DOMWindow* targetWindow = V8Window::toImpl(window);
-    ASSERT(targetWindow);
-    if (!targetWindow->isLocalDOMWindow())
-        return false;
-
-    LocalFrame* target = toLocalDOMWindow(targetWindow)->frame();
-    if (!target)
-        return false;
-
-    // Notify the loader's client if the initial document has been accessed.
-    if (target->loader().stateMachine()->isDisplayingInitialEmptyDocument())
-        target->loader().didAccessInitialDocument();
-
-    Frame* childFrame = target->tree().scopedChild(index);
-
-    // Notice that we can't call HasRealNamedProperty for ACCESS_HAS
-    // because that would generate infinite recursion.
-    if (type == v8::ACCESS_HAS && childFrame)
-        return true;
-    if (type == v8::ACCESS_GET
-        && childFrame
-        && !host->HasRealIndexedProperty(index)
-        && !window->HasRealIndexedProperty(index))
-        return true;
-
-    return BindingSecurity::shouldAllowAccessToFrame(isolate, target, DoNotReportSecurityError);
+    return SecurityCheck(host);
 }
 
 v8::Handle<v8::Value> toV8(DOMWindow* window, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     // Notice that we explicitly ignore creationContext because the LocalDOMWindow is its own creationContext.
 
     if (!window)
         return v8::Null(isolate);
     // Initializes environment of a frame, and return the global object
     // of the frame.
     Frame * frame = window->frame();
     if (!frame)
         return v8Undefined();
 
     v8::Handle<v8::Context> context = toV8Context(frame, DOMWrapperWorld::current(isolate));
     if (context.IsEmpty())
         return v8Undefined();
 
     v8::Handle<v8::Object> global = context->Global();
     ASSERT(!global.IsEmpty());
     return global;
 }
 
 } // namespace blink