Changeset 29174 in webkit

Timestamp:

Jan 4, 2008, 1:02:16 PM (17 years ago)

Author:

timothy@apple.com

Message:

Reviewed by Darin Adler.

<rdar://problem/5604409> JavaScript privilege escalation when Web Inspector accesses page unsafely (16011)

Check if the property is a getter before asking for the value.
If the property is a getter, we no longer show the value.

• page/inspector/PropertiesSidebarPane.js:
• page/inspector/inspector.css:

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• page/inspector/PropertiesSidebarPane.js (modified) (3 diffs)
• page/inspector/inspector.css (modified) (6 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-01-04  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5604409> JavaScript privilege escalation when Web Inspector accesses page unsafely (16011)
+
+        Check if the property is a getter before asking for the value.
+        If the property is a getter, we no longer show the value.
+
+        * page/inspector/PropertiesSidebarPane.js:
+        * page/inspector/inspector.css:
+
 2008-01-04  Dan Bernstein  <mitz@apple.com>
 

trunk/WebCore/page/inspector/PropertiesSidebarPane.js

@@ -83 +83 @@
 WebInspector.ObjectPropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
-WebInspector.ObjectPropertyTreeElement = function(object, propertyName)
+WebInspector.ObjectPropertyTreeElement = function(parentObject, propertyName)
 {
+    this.parentObject = parentObject;
+    this.propertyName = propertyName;
+
+    var childObject = this.safePropertyValue(parentObject, propertyName);
+    var isGetter = parentObject.__lookupGetter__(propertyName);
+
     var title = "<span class=\"name\">" + propertyName.escapeHTML() + "</span>: ";
-    title += "<span class=\"value\">" + Object.describe(object[propertyName], true).escapeHTML() + "</span>";
+    if (!isGetter)
+        title += "<span class=\"value\">" + Object.describe(childObject, true).escapeHTML() + "</span>";
+    else
+        // FIXME: this should show something like "getter" once we can change localization (bug 16734).
+        title += "<span class=\"value dimmed\">&mdash;</span>";
 
     var hasSubProperties = false;
-    var type = typeof object[propertyName];
-    if (object[propertyName] && (type === "object" || type === "function")) {
-        for (subPropertyName in object[propertyName]) {
+    var type = typeof childObject;
+    if (childObject && (type === "object" || type === "function")) {
+        for (subPropertyName in childObject) {
             if (subPropertyName === "__treeElementIdentifier")
                 continue;
@@ -99 +109 @@
     }
 
-    this.object = object;
-    this.propertyName = propertyName;
-
     TreeElement.call(this, title, null, hasSubProperties);
 }
 
 WebInspector.ObjectPropertyTreeElement.prototype = {
+    safePropertyValue: function(object, propertyName)
+    {
+        var getter = object.__lookupGetter__(propertyName);
+        if (getter)
+            return;
+        return object[propertyName];
+    },
+
     onpopulate: function()
     {
@@ -111 +126 @@
             return;
 
-        var object = this.object[this.propertyName];
-        var properties = Object.sortedProperties(object);
+        var childObject = this.safePropertyValue(this.parentObject, this.propertyName);
+        var properties = Object.sortedProperties(childObject);
         for (var i = 0; i < properties.length; ++i) {
             var propertyName = properties[i];
             if (propertyName === "__treeElementIdentifier")
                 continue;
-            this.appendChild(new WebInspector.ObjectPropertyTreeElement(object, propertyName));
+            this.appendChild(new WebInspector.ObjectPropertyTreeElement(childObject, propertyName));
         }
     }

trunk/WebCore/page/inspector/inspector.css

@@ -1190 +1190 @@
     margin-top: 0;
     padding-right: 2px;
+    -webkit-user-select: none;
 }
 
@@ -1235 +1236 @@
 }
 
+.section .properties .value.dimmed {
+    color: rgb(100, 100, 100);
+}
+
 .section .properties .number {
     color: blue;
@@ -1455 +1460 @@
     vertical-align: middle;
     opacity: 0.75;
+    -webkit-user-select: none;
 }
 
@@ -1470 +1476 @@
     left: 5px;
     top: 2px;
+    -webkit-user-select: none;
 }
 
@@ -1477 +1484 @@
     left: 4px;
     top: 2px;
+    -webkit-user-select: none;
 }
 
@@ -1492 +1500 @@
     left: 8px;
     top: 1px;
+    -webkit-user-select: none;
 }