Changeset 129629 in webkit


Ignore:
Timestamp:
Sep 26, 2012 6:21:07 AM (12 years ago)
Author:
commit-queue@webkit.org
Message:

Unreviewed, rolling out r129592.
​http://trac.webkit.org/changeset/129592
​https://bugs.webkit.org/show_bug.cgi?id=97670

Failures in Chromium security tests (Requested by schenney on
#webkit).

Patch by Sheriff Bot <​webkit.review.bot@gmail.com> on 2012-09-26

Source/JavaScriptCore:

  • runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncEval):

LayoutTests:

  • fast/js/eval-cross-window-expected.txt:
  • fast/js/eval-cross-window.html:
  • http/tests/security/cross-frame-access-call-expected.txt:
  • http/tests/security/cross-frame-access-call.html:
  • http/tests/security/resources/xss-eval2.html:
  • http/tests/security/resources/xss-eval3.html:
  • http/tests/security/xss-eval-expected.txt:
  • http/tests/security/xss-eval.html:
Location:
trunk
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r129626 r129629  
     12012-09-26  Sheriff Bot  <webkit.review.bot@gmail.com>
     2
     3        Unreviewed, rolling out r129592.
     4        http://trac.webkit.org/changeset/129592
     5        https://bugs.webkit.org/show_bug.cgi?id=97670
     6
     7        Failures in Chromium security tests (Requested by schenney on
     8        #webkit).
     9
     10        * fast/js/eval-cross-window-expected.txt:
     11        * fast/js/eval-cross-window.html:
     12        * http/tests/security/cross-frame-access-call-expected.txt:
     13        * http/tests/security/cross-frame-access-call.html:
     14        * http/tests/security/resources/xss-eval2.html:
     15        * http/tests/security/resources/xss-eval3.html:
     16        * http/tests/security/xss-eval-expected.txt:
     17        * http/tests/security/xss-eval.html:
     18
    1192012-09-25  Vsevolod Vlasov  <vsevik@chromium.org>
    220

  • trunk/LayoutTests/fast/js/eval-cross-window-expected.txt

    r129592 r129629  
    88PASS: window.eval("x") should be 0 and is.
    99PASS: frames[0].eval("x") should be 1 and is.
    10 PASS: window.eval("x") should be 1 and is.
    11 PASS: frames[0].eval("x") should be undefined and is.
     10PASS: window.eval("x") should be EvalError and is.
     11PASS: frames[0].eval("x") should be EvalError and is.
    1212
    1313----- Scope Chain for Getters: -----
    … …  
    1515PASS: window.eval("xx") should be ReferenceError and is.
    1616PASS: frames[0].eval("xx") should be ReferenceError and is.
    17 PASS: window.eval("xx") should be ReferenceError and is.
    18 PASS: frames[0].eval("xx") should be ReferenceError and is.
     17PASS: window.eval("xx") should be EvalError and is.
     18PASS: frames[0].eval("xx") should be EvalError and is.
    1919
    2020----- Variable Object: -----
    … …  
    2222PASS: window.eval("var y; "y" in top") should be true and is.
    2323PASS: frames[0].eval("var y; "y" in top.frames[0]") should be true and is.
    24 PASS: window.eval("var y; "y" in top.frames[0]") should be undefined and is.
    25 PASS: frames[0].eval("var y; "y" in top") should be undefined and is.
     24PASS: window.eval("var y; "y" in top.frames[0]") should be EvalError and is.
     25PASS: frames[0].eval("var y; "y" in top") should be EvalError and is.
    2626
    2727----- Scope Chain for Setters: -----
    … …  
    2929PASS: window.eval("z = 1; top.z") should be 1 and is.
    3030PASS: frames[0].eval("z = 2; top.frames[0].z") should be 2 and is.
    31 PASS: window.eval("z = 3; top.frames[0].z") should be undefined and is.
    32 PASS: frames[0].eval("z = 4; top.z") should be undefined and is.
     31PASS: window.eval("z = 3; top.frames[0].z") should be EvalError and is.
     32PASS: frames[0].eval("z = 4; top.z") should be EvalError and is.
    3333
    3434----- This Object: -----
    … …  
    3636PASS: window.eval("this") should be [object Window] and is.
    3737PASS: frames[0].eval("this") should be [object Window] and is.
    38 PASS: window.eval("this") should be undefined and is.
    39 PASS: frames[0].eval("this") should be undefined and is.
     38PASS: window.eval("this") should be EvalError and is.
     39PASS: frames[0].eval("this") should be EvalError and is.
    4040

  • trunk/LayoutTests/fast/js/eval-cross-window.html

    r129592 r129629  
    4343
    4444    window.eval = frameEval;
    45     shouldBe('window.eval("x")', (function() { try { return window.eval("x") } catch(e) { return e.name; } })(), 1);
     45    shouldBe('window.eval("x")', (function() { try { return window.eval("x") } catch(e) { return e.name; } })(), "EvalError");
    4646    window.eval = topEval;
    4747
    4848    frames[0].eval = topEval;
    49     shouldBe('frames[0].eval("x")', (function() { try { frames[0].eval("x") } catch(e) { return e.name; } })(), undefined);
     49    shouldBe('frames[0].eval("x")', (function() { try { frames[0].eval("x") } catch(e) { return e.name; } })(), "EvalError");
    5050    frames[0].eval = frameEval;
    5151}
    … …  
    5959
    6060    window.eval = frameEval;
    61     shouldBe('window.eval("xx")', (function() { try { return window.eval("xx") } catch(e) { return e.name; } })(), "ReferenceError");
     61    shouldBe('window.eval("xx")', (function() { try { return window.eval("xx") } catch(e) { return e.name; } })(), "EvalError");
    6262    window.eval = topEval;
    6363
    6464    frames[0].eval = topEval;
    65     shouldBe('frames[0].eval("xx")', (function() { try { return frames[0].eval("xx") } catch(e) { return e.name; } })(), "ReferenceError");
     65    shouldBe('frames[0].eval("xx")', (function() { try { return frames[0].eval("xx") } catch(e) { return e.name; } })(), "EvalError");
    6666    frames[0].eval = frameEval;
    6767}
    … …  
    7878
    7979    window.eval = frameEval;
    80     shouldBe('window.eval("var y; \"y\" in top.frames[0]")', (function() { try { window.eval("var y; \"y\" in top.frames[0]") } catch(e) { return e.name; } })(), undefined);
     80    shouldBe('window.eval("var y; \"y\" in top.frames[0]")', (function() { try { window.eval("var y; \"y\" in top.frames[0]") } catch(e) { return e.name; } })(), "EvalError");
    8181    delete window.y;
    8282    delete frames[0].y;
    … …  
    8484
    8585    frames[0].eval = topEval;
    86     shouldBe('frames[0].eval("var y; \"y\" in top")', (function() { try { frames[0].eval("var y; \"y\" in top") } catch(e) { return e.name; } })(), undefined);
     86    shouldBe('frames[0].eval("var y; \"y\" in top")', (function() { try { frames[0].eval("var y; \"y\" in top") } catch(e) { return e.name; } })(), "EvalError");
    8787    delete window.y;
    8888    delete frames[0].y;
    … …  
    100100
    101101    window.eval = frameEval;
    102     shouldBe('window.eval("z = 3; top.frames[0].z")', (function() { try { window.eval("z = 3; top.frames[0].z") } catch(e) { return e.name; } })(), undefined);
     102    shouldBe('window.eval("z = 3; top.frames[0].z")', (function() { try { window.eval("z = 3; top.frames[0].z") } catch(e) { return e.name; } })(), "EvalError");
    103103    window.eval = topEval;
    104104
    105105    frames[0].eval = topEval;
    106     shouldBe('frames[0].eval("z = 4; top.z")', (function() { try { frames[0].eval("z = 4; top.z") } catch(e) { return e.name; } })(), undefined);
     106    shouldBe('frames[0].eval("z = 4; top.z")', (function() { try { frames[0].eval("z = 4; top.z") } catch(e) { return e.name; } })(), "EvalError");
    107107    frames[0].eval = frameEval;
    108108}
    … …  
    110110function testThis()
    111111{
    112     shouldBe('window.eval("this")', window.eval.call("wrong", "this"), window);
    113     shouldBe('frames[0].eval("this")', frames[0].eval.call("wrong", "this"), frames[0]);
     112    shouldBe('window.eval("this")', window.eval("this"), window);
     113    shouldBe('frames[0].eval("this")', frames[0].eval("this"), frames[0]);
    114114
    115115    window.eval = frameEval;
    116     shouldBe('window.eval("this")', (function() { try { window.eval.call("wrong", "this"), frames[0] } catch(e) { return e.name; } })(), undefined);
     116    shouldBe('window.eval("this")', (function() { try { window.eval("this"), frames[0] } catch(e) { return e.name; } })(), "EvalError");
    117117    window.eval = topEval;
    118118
    119119    frames[0].eval = topEval;
    120     shouldBe('frames[0].eval("this")', (function() { try { frames[0].eval.call("wrong", "this"), window } catch(e) { return e.name; } })(), undefined);
     120    shouldBe('frames[0].eval("this")', (function() { try { frames[0].eval("this"), window } catch(e) { return e.name; } })(), "EvalError");
    121121    frames[0].eval = frameEval;
    122122}

  • trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt

    r129592 r129629  
    8686PASS: window.resizeTo.call(targetWindow, 0, 0); should be 'undefined' and is.
    8787PASS: window.showModalDialog.call(targetWindow); should be 'undefined' and is.
    88 PASS: window.eval.call(targetWindow, '1+2'); should be '3' and is.
     88PASS: window.eval.call(targetWindow, '1+2'); should be 'EvalError: The "this" value passed to eval must be the global object from which eval originated' and is.
    8989PASS: window.location.toString.call(targetWindow.location) should be 'undefined' and is.
    9090

  • trunk/LayoutTests/http/tests/security/cross-frame-access-call.html

    r129592 r129629  
    5858
    5959    // Throws an EvalError and logs to the error console
    60     shouldBe("window.eval.call(targetWindow, '1+2');", '3');
     60    shouldBe("window.eval.call(targetWindow, '1+2');", '"EvalError: The \\"this\\" value passed to eval must be the global object from which eval originated"');
    6161
    6262    // - Tests for the Location object -

  • trunk/LayoutTests/http/tests/security/resources/xss-eval2.html

    r129592 r129629  
    11<script>
    2 document.testExpando = "It's me too!";
    3 
    42parent.childEval = eval;
    53

  • trunk/LayoutTests/http/tests/security/resources/xss-eval3.html

    r129592 r129629  
    11<script>
    2 document.testExpando = "It's me three!";
    3 
    42parent.postMessage("done", "*");
    53</script>

  • trunk/LayoutTests/http/tests/security/xss-eval-expected.txt

    r129592 r129629  
    55If the test passes, you'll see a pass message below.
    66
    7 PASS: eval.call(frames[0], 'document').testExpando should be It's me! and is.
    8 PASS: childEval.call(frames[0], 'document').testExpando should be It's me too! and is.
    9 PASS: childEvalCaller('document').testExpando should be TypeError and is.
    10 PASS: childLocalEvalCaller('document').testExpando should be It's me too! and is.
     7PASS: eval.call(frames[0], 'document') should be EvalError and is.
     8PASS: childEval.call(frames[0], 'document') should be EvalError and is.
     9PASS: childEvalCaller('document') should be TypeError and is.
     10PASS: childLocalEvalCaller('document') should be EvalError and is.
    1111

  • trunk/LayoutTests/http/tests/security/xss-eval.html

    r129592 r129629  
    3030addEventListener("message", function()
    3131{
    32     shouldBe("eval.call(frames[0], 'document').testExpando",
    33         (function() { try {
    34             return eval.call(frames[0], 'document').testExpando;
    35         } catch(e) { return e.name; } })(), "It's me!")
     32    (function() {
     33        try {
     34            var doc = eval.call(frames[0], 'document');
     35            // V8 execute the eval our scope, which is safe.
     36            shouldBe("documentFromEval", doc.testExpando, "It's me!")
     37        } catch(e) {
     38            // JSC throws an exception, which is also safe.
     39            shouldBe("eval.call(frames[0], 'document')", e.name, "EvalError");
     40        }
     41    })();
    3642
    37     shouldBe("childEval.call(frames[0], 'document').testExpando",
    38         (function() { try {
    39             return childEval.call(frames[0], 'document').testExpando;
    40         } catch(e) { return e.name; } })(), "It's me too!");
     43    shouldBe("childEval.call(frames[0], 'document')", (function() { try { return childEval.call(frames[0], 'document'); } catch(e) { return e.name; } })(), "EvalError");
    4144
    42     shouldBe("childEvalCaller('document').testExpando",
    43         (function() { try {
    44             return childEvalCaller('document').testExpando;
    45         } catch(e) { return e.name; } })(), "TypeError");
     45    shouldBe("childEvalCaller('document')", (function() { try { return childEvalCaller('document'); } catch(e) { return e.name; } })(), "TypeError");
    4646
    47     shouldBe("childLocalEvalCaller('document').testExpando",
    48         (function() { try {
    49             return childLocalEvalCaller('document').testExpando;
    50         } catch(e) { return e.name; } })(), "It's me too!");
     47    shouldBe("childLocalEvalCaller('document')", (function() { try { return childLocalEvalCaller('document'); } catch(e) { return e.name; } })(), "EvalError");
    5148
    5249    if (window.testRunner)

  • trunk/Source/JavaScriptCore/ChangeLog

    r129592 r129629  
     12012-09-26  Sheriff Bot  <webkit.review.bot@gmail.com>
     2
     3        Unreviewed, rolling out r129592.
     4        http://trac.webkit.org/changeset/129592
     5        https://bugs.webkit.org/show_bug.cgi?id=97670
     6
     7        Failures in Chromium security tests (Requested by schenney on
     8        #webkit).
     9
     10        * runtime/JSGlobalObjectFunctions.cpp:
     11        (JSC::globalFuncEval):
     12
    1132012-09-25  Gavin Barraclough  <barraclough@apple.com>
    214

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

    r129592 r129629  
    498498EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
    499499{
     500    JSObject* thisObject = exec->hostThisValue().toThisObject(exec);
     501    JSGlobalObject* calleeGlobalObject = exec->callee()->globalObject();
     502    if (thisObject != exec->callee()->globalObject()->globalThis())
     503        return throwVMError(exec, createEvalError(exec, ASCIILiteral("The \"this\" value passed to eval must be the global object from which eval originated")));
     504
    500505    JSValue x = exec->argument(0);
    501506    if (!x.isString())
    … …  
    514519    }
    515520
    516     JSGlobalObject* calleeGlobalObject = exec->callee()->globalObject();
    517521    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false);
    518522    JSObject* error = eval->compile(exec, calleeGlobalObject);
    … …  
    520524        return throwVMError(exec, error);
    521525
    522     return JSValue::encode(exec->interpreter()->execute(eval, exec, calleeGlobalObject->globalThis(), calleeGlobalObject));
     526    return JSValue::encode(exec->interpreter()->execute(eval, exec, thisObject, calleeGlobalObject));
    523527}
    524528
Note: See TracChangeset for help on using the changeset viewer.