Changeset 129712 in webkit


Ignore:
Timestamp:
Sep 26, 2012 4:25:21 PM (12 years ago)
Author:
barraclough@apple.com
Message:

REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms
​https://bugs.webkit.org/show_bug.cgi?id=97529

Reviewed by Filip Pizlo.

A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers.

Source/JavaScriptCore:

JSC currently throws an EvalError if you try to call eval with a this object that doesn't
match the given eval function. This does not match other browsers, which generally just
ignore the this value that was passed, and eval the string in the eval function's environment.

  • runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncEval):

  • Remove EvalError, ignore passed this value.

LayoutTests:

  • fast/js/eval-cross-window-expected.txt:
  • fast/js/eval-cross-window.html:
    • Changed not to expect EvalErrors (this matches other browsers), and modified testThis to check that the this object is always set to the global object.
  • http/tests/security/resources/xss-eval2.html:
  • http/tests/security/resources/xss-eval3.html:
  • http/tests/security/xss-eval-expected.txt:
  • http/tests/security/xss-eval.html:
    • Updated. Access via the global environment is not a security risk, since the eval is accessing it's own document's informantion. Access via the shell attempts to access the navigated pages document, tripping an access check & throwing a TypeError.
Location:
trunk
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r129710 r129712  
     12012-09-26  Gavin Barraclough  <barraclough@apple.com>
     2
     3        REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms
     4        https://bugs.webkit.org/show_bug.cgi?id=97529
     5
     6        Reviewed by Filip Pizlo.
     7
     8        A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers.
     9
     10        * fast/js/eval-cross-window-expected.txt:
     11        * fast/js/eval-cross-window.html:
     12            - Changed not to expect EvalErrors (this matches other browsers), and modified testThis
     13              to check that the this object is always set to the global object.
     14        * http/tests/security/resources/xss-eval2.html:
     15        * http/tests/security/resources/xss-eval3.html:
     16        * http/tests/security/xss-eval-expected.txt:
     17        * http/tests/security/xss-eval.html:
     18            - Updated. Access via the global environment is not a security risk, since the eval is
     19              accessing it's own document's informantion. Access via the shell attempts to access
     20              the navigated pages document, tripping an access check & throwing a TypeError.
     21
    1222012-09-26  Emil A Eklund  <eae@chromium.org>
    223

  • trunk/LayoutTests/fast/js/eval-cross-window-expected.txt

    r129629 r129712  
    88PASS: window.eval("x") should be 0 and is.
    99PASS: frames[0].eval("x") should be 1 and is.
    10 PASS: window.eval("x") should be EvalError and is.
    11 PASS: frames[0].eval("x") should be EvalError and is.
     10PASS: window.eval("x") should be 1 and is.
     11PASS: frames[0].eval("x") should be undefined and is.
    1212
    1313----- Scope Chain for Getters: -----
    … …  
    1515PASS: window.eval("xx") should be ReferenceError and is.
    1616PASS: frames[0].eval("xx") should be ReferenceError and is.
    17 PASS: window.eval("xx") should be EvalError and is.
    18 PASS: frames[0].eval("xx") should be EvalError and is.
     17PASS: window.eval("xx") should be ReferenceError and is.
     18PASS: frames[0].eval("xx") should be ReferenceError and is.
    1919
    2020----- Variable Object: -----
    … …  
    2222PASS: window.eval("var y; "y" in top") should be true and is.
    2323PASS: frames[0].eval("var y; "y" in top.frames[0]") should be true and is.
    24 PASS: window.eval("var y; "y" in top.frames[0]") should be EvalError and is.
    25 PASS: frames[0].eval("var y; "y" in top") should be EvalError and is.
     24PASS: window.eval("var y; "y" in top.frames[0]") should be undefined and is.
     25PASS: frames[0].eval("var y; "y" in top") should be undefined and is.
    2626
    2727----- Scope Chain for Setters: -----
    … …  
    2929PASS: window.eval("z = 1; top.z") should be 1 and is.
    3030PASS: frames[0].eval("z = 2; top.frames[0].z") should be 2 and is.
    31 PASS: window.eval("z = 3; top.frames[0].z") should be EvalError and is.
    32 PASS: frames[0].eval("z = 4; top.z") should be EvalError and is.
     31PASS: window.eval("z = 3; top.frames[0].z") should be undefined and is.
     32PASS: frames[0].eval("z = 4; top.z") should be undefined and is.
    3333
    3434----- This Object: -----
    … …  
    3636PASS: window.eval("this") should be [object Window] and is.
    3737PASS: frames[0].eval("this") should be [object Window] and is.
    38 PASS: window.eval("this") should be EvalError and is.
    39 PASS: frames[0].eval("this") should be EvalError and is.
     38PASS: window.eval("this") should be undefined and is.
     39PASS: frames[0].eval("this") should be undefined and is.
    4040

  • trunk/LayoutTests/fast/js/eval-cross-window.html

    r129629 r129712  
    4343
    4444    window.eval = frameEval;
    45     shouldBe('window.eval("x")', (function() { try { return window.eval("x") } catch(e) { return e.name; } })(), "EvalError");
     45    shouldBe('window.eval("x")', (function() { try { return window.eval("x") } catch(e) { return e.name; } })(), 1);
    4646    window.eval = topEval;
    4747
    4848    frames[0].eval = topEval;
    49     shouldBe('frames[0].eval("x")', (function() { try { frames[0].eval("x") } catch(e) { return e.name; } })(), "EvalError");
     49    shouldBe('frames[0].eval("x")', (function() { try { frames[0].eval("x") } catch(e) { return e.name; } })(), undefined);
    5050    frames[0].eval = frameEval;
    5151}
    … …  
    5959
    6060    window.eval = frameEval;
    61     shouldBe('window.eval("xx")', (function() { try { return window.eval("xx") } catch(e) { return e.name; } })(), "EvalError");
     61    shouldBe('window.eval("xx")', (function() { try { return window.eval("xx") } catch(e) { return e.name; } })(), "ReferenceError");
    6262    window.eval = topEval;
    6363
    6464    frames[0].eval = topEval;
    65     shouldBe('frames[0].eval("xx")', (function() { try { return frames[0].eval("xx") } catch(e) { return e.name; } })(), "EvalError");
     65    shouldBe('frames[0].eval("xx")', (function() { try { return frames[0].eval("xx") } catch(e) { return e.name; } })(), "ReferenceError");
    6666    frames[0].eval = frameEval;
    6767}
    … …  
    7878
    7979    window.eval = frameEval;
    80     shouldBe('window.eval("var y; \"y\" in top.frames[0]")', (function() { try { window.eval("var y; \"y\" in top.frames[0]") } catch(e) { return e.name; } })(), "EvalError");
     80    shouldBe('window.eval("var y; \"y\" in top.frames[0]")', (function() { try { window.eval("var y; \"y\" in top.frames[0]") } catch(e) { return e.name; } })(), undefined);
    8181    delete window.y;
    8282    delete frames[0].y;
    … …  
    8484
    8585    frames[0].eval = topEval;
    86     shouldBe('frames[0].eval("var y; \"y\" in top")', (function() { try { frames[0].eval("var y; \"y\" in top") } catch(e) { return e.name; } })(), "EvalError");
     86    shouldBe('frames[0].eval("var y; \"y\" in top")', (function() { try { frames[0].eval("var y; \"y\" in top") } catch(e) { return e.name; } })(), undefined);
    8787    delete window.y;
    8888    delete frames[0].y;
    … …  
    100100
    101101    window.eval = frameEval;
    102     shouldBe('window.eval("z = 3; top.frames[0].z")', (function() { try { window.eval("z = 3; top.frames[0].z") } catch(e) { return e.name; } })(), "EvalError");
     102    shouldBe('window.eval("z = 3; top.frames[0].z")', (function() { try { window.eval("z = 3; top.frames[0].z") } catch(e) { return e.name; } })(), undefined);
    103103    window.eval = topEval;
    104104
    105105    frames[0].eval = topEval;
    106     shouldBe('frames[0].eval("z = 4; top.z")', (function() { try { frames[0].eval("z = 4; top.z") } catch(e) { return e.name; } })(), "EvalError");
     106    shouldBe('frames[0].eval("z = 4; top.z")', (function() { try { frames[0].eval("z = 4; top.z") } catch(e) { return e.name; } })(), undefined);
    107107    frames[0].eval = frameEval;
    108108}
    … …  
    110110function testThis()
    111111{
    112     shouldBe('window.eval("this")', window.eval("this"), window);
    113     shouldBe('frames[0].eval("this")', frames[0].eval("this"), frames[0]);
     112    shouldBe('window.eval("this")', window.eval.call("wrong", "this"), window);
     113    shouldBe('frames[0].eval("this")', frames[0].eval.call("wrong", "this"), frames[0]);
    114114
    115115    window.eval = frameEval;
    116     shouldBe('window.eval("this")', (function() { try { window.eval("this"), frames[0] } catch(e) { return e.name; } })(), "EvalError");
     116    shouldBe('window.eval("this")', (function() { try { window.eval.call("wrong", "this"), frames[0] } catch(e) { return e.name; } })(), undefined);
    117117    window.eval = topEval;
    118118
    119119    frames[0].eval = topEval;
    120     shouldBe('frames[0].eval("this")', (function() { try { frames[0].eval("this"), window } catch(e) { return e.name; } })(), "EvalError");
     120    shouldBe('frames[0].eval("this")', (function() { try { frames[0].eval.call("wrong", "this"), window } catch(e) { return e.name; } })(), undefined);
    121121    frames[0].eval = frameEval;
    122122}

  • trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt

    r129629 r129712  
    8686PASS: window.resizeTo.call(targetWindow, 0, 0); should be 'undefined' and is.
    8787PASS: window.showModalDialog.call(targetWindow); should be 'undefined' and is.
    88 PASS: window.eval.call(targetWindow, '1+2'); should be 'EvalError: The "this" value passed to eval must be the global object from which eval originated' and is.
     88PASS: window.eval.call(targetWindow, '1+2'); should be '3' and is.
    8989PASS: window.location.toString.call(targetWindow.location) should be 'undefined' and is.
    9090

  • trunk/LayoutTests/http/tests/security/cross-frame-access-call.html

    r129629 r129712  
    5858
    5959    // Throws an EvalError and logs to the error console
    60     shouldBe("window.eval.call(targetWindow, '1+2');", '"EvalError: The \\"this\\" value passed to eval must be the global object from which eval originated"');
     60    shouldBe("window.eval.call(targetWindow, '1+2');", '3');
    6161
    6262    // - Tests for the Location object -

  • trunk/LayoutTests/http/tests/security/resources/xss-eval2.html

    r129629 r129712  
    11<script>
     2document.testExpando = "It's me too!";
     3
    24parent.childEval = eval;
    35

  • trunk/LayoutTests/http/tests/security/resources/xss-eval3.html

    r129629 r129712  
    11<script>
     2document.testExpando = "It's me three!";
     3
    24parent.postMessage("done", "*");
    35</script>

  • trunk/LayoutTests/http/tests/security/xss-eval-expected.txt

    r129629 r129712  
    55If the test passes, you'll see a pass message below.
    66
    7 PASS: eval.call(frames[0], 'document') should be EvalError and is.
    8 PASS: childEval.call(frames[0], 'document') should be EvalError and is.
    9 PASS: childEvalCaller('document') should be TypeError and is.
    10 PASS: childLocalEvalCaller('document') should be EvalError and is.
     7PASS: eval.call(frames[0], 'document').testExpando should be It's me! and is.
     8PASS: childEval.call(frames[0], 'document').testExpando should be It's me too! and is.
     9PASS: childEvalCaller('document').testExpando should be TypeError and is.
     10PASS: childLocalEvalCaller('document').testExpando should be It's me too! and is.
    1111

  • trunk/LayoutTests/http/tests/security/xss-eval.html

    r129629 r129712  
    3030addEventListener("message", function()
    3131{
    32     (function() {
    33         try {
    34             var doc = eval.call(frames[0], 'document');
    35             // V8 execute the eval our scope, which is safe.
    36             shouldBe("documentFromEval", doc.testExpando, "It's me!")
    37         } catch(e) {
    38             // JSC throws an exception, which is also safe.
    39             shouldBe("eval.call(frames[0], 'document')", e.name, "EvalError");
    40         }
    41     })();
     32    shouldBe("eval.call(frames[0], 'document').testExpando",
     33        (function() { try {
     34            return eval.call(frames[0], 'document').testExpando;
     35        } catch(e) { return e.name; } })(), "It's me!")
    4236
    43     shouldBe("childEval.call(frames[0], 'document')", (function() { try { return childEval.call(frames[0], 'document'); } catch(e) { return e.name; } })(), "EvalError");
     37    shouldBe("childEval.call(frames[0], 'document').testExpando",
     38        (function() { try {
     39            return childEval.call(frames[0], 'document').testExpando;
     40        } catch(e) { return e.name; } })(), "It's me too!");
    4441
    45     shouldBe("childEvalCaller('document')", (function() { try { return childEvalCaller('document'); } catch(e) { return e.name; } })(), "TypeError");
     42    shouldBe("childEvalCaller('document').testExpando",
     43        (function() { try {
     44            return childEvalCaller('document').testExpando;
     45        } catch(e) { return e.name; } })(), "TypeError");
    4646
    47     shouldBe("childLocalEvalCaller('document')", (function() { try { return childLocalEvalCaller('document'); } catch(e) { return e.name; } })(), "EvalError");
     47    shouldBe("childLocalEvalCaller('document').testExpando",
     48        (function() { try { return childLocalEvalCaller('document').testExpando; } catch(e) { return e.name; } })(), "It's me too!");
    4849
    4950    if (window.testRunner)

  • trunk/Source/JavaScriptCore/ChangeLog

    r129711 r129712  
     12012-09-26  Gavin Barraclough  <barraclough@apple.com>
     2
     3        REGRESSION (r129456): http/tests/security/xss-eval.html is failing on JSC platforms
     4        https://bugs.webkit.org/show_bug.cgi?id=97529
     5
     6        Reviewed by Filip Pizlo.
     7
     8        A recent patch changed JSC's EvalError behaviour; bring this more into line with other browsers.
     9
     10        JSC currently throws an EvalError if you try to call eval with a this object that doesn't
     11        match the given eval function. This does not match other browsers, which generally just
     12        ignore the this value that was passed, and eval the string in the eval function's environment.
     13
     14        * runtime/JSGlobalObjectFunctions.cpp:
     15        (JSC::globalFuncEval):
     16            - Remove EvalError, ignore passed this value.
     17
    1182012-09-26  Gavin Barraclough  <barraclough@apple.com>
    219

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

    r129629 r129712  
    498498EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
    499499{
    500     JSObject* thisObject = exec->hostThisValue().toThisObject(exec);
    501     JSGlobalObject* calleeGlobalObject = exec->callee()->globalObject();
    502     if (thisObject != exec->callee()->globalObject()->globalThis())
    503         return throwVMError(exec, createEvalError(exec, ASCIILiteral("The \"this\" value passed to eval must be the global object from which eval originated")));
    504 
    505500    JSValue x = exec->argument(0);
    506501    if (!x.isString())
    … …  
    519514    }
    520515
     516    JSGlobalObject* calleeGlobalObject = exec->callee()->globalObject();
    521517    EvalExecutable* eval = EvalExecutable::create(exec, makeSource(s), false);
    522518    JSObject* error = eval->compile(exec, calleeGlobalObject);
    … …  
    524520        return throwVMError(exec, error);
    525521
    526     return JSValue::encode(exec->interpreter()->execute(eval, exec, thisObject, calleeGlobalObject));
     522    return JSValue::encode(exec->interpreter()->execute(eval, exec, calleeGlobalObject->globalThis(), calleeGlobalObject));
    527523}
    528524
Note: See TracChangeset for help on using the changeset viewer.