Changeset 248709 in webkit

Timestamp:

Aug 14, 2019 11:20:11 PM (5 years ago)

Author:

mark.lam@apple.com

Message:

JSTests:
ProxyObject should not be allow to access its target's private properties.
​https://bugs.webkit.org/show_bug.cgi?id=200739
<rdar://problem/53972768>

Reviewed by Yusuke Suzuki.

• stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
• stress/proxy-with-private-symbols.js: Rebased.

Source/JavaScriptCore:
Remove support for macOS < 10.13
​https://bugs.webkit.org/show_bug.cgi?id=200694
<rdar://problem/54278851>

Patch by Keith Rollin <Keith Rollin> on 2019-08-14
Reviewed by Youenn Fablet.

Update conditionals that reference MAC_OS_X_VERSION_MIN_REQUIRED and
MAC_OS_X_VERSION_MAX_ALLOWED, assuming that they both have values >=

101300. This means that expressions like

"MAC_OS_X_VERSION_MIN_REQUIRED < 101300" are always False and
"MAC_OS_X_VERSION_MIN_REQUIRED >= 101300" are always True.

• API/WebKitAvailability.h:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js (added)
• JSTests/stress/proxy-with-private-symbols.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ProxyObject.cpp (modified) (7 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-08-14  Mark Lam  <mark.lam@apple.com>
+
+        ProxyObject should not be allow to access its target's private properties.
+        https://bugs.webkit.org/show_bug.cgi?id=200739
+        <rdar://problem/53972768>
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
+        * stress/proxy-with-private-symbols.js: Rebased.
+
 2019-08-14  Mark Lam  <mark.lam@apple.com>
 

trunk/JSTests/stress/proxy-with-private-symbols.js

@@ -82 +82 @@
             threw = true;
         }
-        assert(!threw);
+        assert(threw);
         assert(!sawPrivateSymbolAsString);
         sawPrivateSymbolAsString = false;

trunk/Source/JavaScriptCore/ChangeLog

@@ -14 +14 @@
 
         * API/WebKitAvailability.h:
+
+2019-08-14  Mark Lam  <mark.lam@apple.com>
+
+        ProxyObject should not be allow to access its target's private properties.
+        https://bugs.webkit.org/show_bug.cgi?id=200739
+        <rdar://problem/53972768>
+
+        Reviewed by Yusuke Suzuki.
+
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::performPut):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performDefineOwnProperty):
 
 2019-08-14  Mark Lam  <mark.lam@apple.com>

trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp

@@ -1 +1 @@
 /*
- * Copyright (C) 2016-2017 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2016-2019 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -144 +144 @@
 
     if (propertyName.isPrivateName())
-        return performDefaultGet();
+        return jsUndefined();
 
     JSValue handlerValue = proxyObject->handler();
@@ -215 +215 @@
 
     if (propertyName.isPrivateName())
-        RELEASE_AND_RETURN(scope, performDefaultGetOwnProperty());
+        return false;
 
     JSValue handlerValue = this->handler();
@@ -324 +324 @@
 
     if (propertyName.isPrivateName())
-        RELEASE_AND_RETURN(scope, performDefaultHasProperty());
+        return false;
 
     JSValue handlerValue = this->handler();
@@ -426 +426 @@
 
     if (propertyName.isPrivateName())
-        RELEASE_AND_RETURN(scope, performDefaultPut());
+        return false;
 
     JSValue handlerValue = this->handler();
@@ -629 +629 @@
 
     if (propertyName.isPrivateName())
-        RELEASE_AND_RETURN(scope, performDefaultDelete());
+        return false;
 
     JSValue handlerValue = this->handler();
@@ -828 +828 @@
 
     if (propertyName.isPrivateName())
-        return performDefaultDefineOwnProperty();
+        return false;
 
     JSValue handlerValue = this->handler();