Changeset 224464 in webkit


Ignore:
Timestamp:
Nov 4, 2017 5:54:32 PM (6 years ago)
Author:
Chris Dumez
Message:

Index properties on cross origin Window objects should be enumerable
https://bugs.webkit.org/show_bug.cgi?id=179289

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Re-sync WPT test after:

Rebaseline a couple of WPT tests now that more checks are passing.

  • web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt:
  • web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects.html:
  • web-platform-tests/html/browsers/the-window-object/window-indexed-properties-expected.txt:

Source/WebCore:

Index properties on cross origin Window objects should be enumerable:

All exposed properties used to be enumerable but we had to revert this in
r224287 because it was not Web-compatible. The HTML specification has now
been updated so that only index properties are enumerable cross origin.

No new tests, rebaselined existing tests.

  • bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
(WebCore::JSDOMWindow::getOwnPropertyNames):

LayoutTests:

Update / rebaseline existing test to match new expected behavior.

  • js/dom/getOwnPropertyDescriptor-expected.txt:
  • js/resources/getOwnPropertyDescriptor.js:
Location:
trunk
Files:
9 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r224457 r224464  
     12017-11-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Index properties on cross origin Window objects should be enumerable
     4        https://bugs.webkit.org/show_bug.cgi?id=179289
     5
     6        Reviewed by Darin Adler.
     7
     8        Update / rebaseline existing test to match new expected behavior.
     9
     10        * js/dom/getOwnPropertyDescriptor-expected.txt:
     11        * js/resources/getOwnPropertyDescriptor.js:
     12
    1132017-11-04  Aishwarya Nirmal  <anirmal@apple.com>
    214
  • trunk/LayoutTests/imported/w3c/ChangeLog

    r224453 r224464  
     12017-11-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Index properties on cross origin Window objects should be enumerable
     4        https://bugs.webkit.org/show_bug.cgi?id=179289
     5
     6        Reviewed by Darin Adler.
     7
     8        Re-sync WPT test after:
     9        - https://github.com/w3c/web-platform-tests/pull/8045
     10
     11        Rebaseline a couple of WPT tests now that more checks are passing.
     12
     13        * web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt:
     14        * web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects.html:
     15        * web-platform-tests/html/browsers/the-window-object/window-indexed-properties-expected.txt:
     16
    1172017-11-03  Youenn Fablet  <youenn@apple.com>
    218
  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects-expected.txt

    r224287 r224464  
    77PASS [[PreventExtensions]] should throw for cross-origin objects
    88PASS [[GetOwnProperty]] - Properties on cross-origin objects should be reported |own|
    9 FAIL [[GetOwnProperty]] - Property descriptors for cross-origin properties should be set up correctly assert_equals: property descriptor for 0 should be enumerable expected true but got false
     9PASS [[GetOwnProperty]] - Property descriptors for cross-origin properties should be set up correctly
    1010PASS [[Delete]] Should throw on cross-origin objects
    1111PASS [[DefineOwnProperty]] Should throw for cross-origin objects
    12 FAIL Can only enumerate safelisted properties assert_equals: Enumerate all safelisted cross-origin Window properties expected 15 but got 0
    13 FAIL [[OwnPropertyKeys]] should return all properties from cross-origin objects assert_array_equals: Object.keys() gives the right answer for cross-origin Window lengths differ, expected 15 got 0
     12PASS Can only enumerate safelisted enumerable properties
     13PASS [[OwnPropertyKeys]] should return all properties from cross-origin objects
    1414PASS [[OwnPropertyKeys]] should return the right symbol-named properties for cross-origin objects
    1515PASS [[OwnPropertyKeys]] should place the symbols after the property names after the subframe indices
  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/cross-origin-objects.html

    r219659 r224464  
    185185
    186186function checkPropertyDescriptor(desc, propName, expectWritable) {
    187   var isSymbol = (typeof(propName) == "symbol");
     187  const isSymbol = typeof(propName) === "symbol";
     188  const isArrayIndexPropertyName = !isSymbol && !isNaN(parseInt(propName, 10));
    188189  propName = String(propName);
    189190  assert_true(isObject(desc), "property descriptor for " + propName + " should exist");
    190191  assert_equals(desc.configurable, true, "property descriptor for " + propName + " should be configurable");
    191   if (isSymbol) {
    192     assert_equals(desc.enumerable, false, "symbol-property descriptor for " + propName + " should not be enumerable");
    193     assert_true("value" in desc,
    194                 "property descriptor for " + propName + " should be a value descriptor");
    195     assert_equals(desc.value, undefined,
     192  if (!isArrayIndexPropertyName) {
     193    assert_equals(desc.enumerable, false, "property descriptor for " + propName + " should not be enumerable");
     194    if(isSymbol) {
     195      assert_true("value" in desc,
     196                  "property descriptor for " + propName + " should be a value descriptor");
     197      assert_equals(desc.value, undefined,
    196198                  "symbol-named cross-origin visible prop " + propName +
    197199                  " should come back as undefined");
     200    }
    198201  } else {
    199202    assert_equals(desc.enumerable, true, "property descriptor for " + propName + " should be enumerable");
     
    266269  for (var prop in C) {
    267270    i++;
    268     assert_true(whitelistedWindowPropNames.includes(prop), prop + " is not safelisted for a cross-origin Window");
    269   }
    270   assert_equals(i, whitelistedWindowPropNames.length, "Enumerate all safelisted cross-origin Window properties");
     271    assert_true(whitelistedWindowIndices.includes(prop), prop + " is not safelisted for a cross-origin Window");
     272  }
     273  assert_equals(i, whitelistedWindowIndices.length, "Enumerate all enumerable safelisted cross-origin Window properties");
    271274  i = 0;
    272275  for (var prop in C.location) {
    273276    i++;
    274     assert_true(whitelistedLocationPropNames.includes(prop), prop + " is not safelisted for a cross-origin Location");
    275   }
    276   assert_equals(i, whitelistedLocationPropNames.length, "Enumerate all safelisted cross-origin Location properties");
    277 }, "Can only enumerate safelisted properties");
     277  }
     278  assert_equals(i, 0, "There's nothing to enumerate for cross-origin Location properties");
     279}, "Can only enumerate safelisted enumerable properties");
    278280
    279281/*
     
    286288                      "Object.getOwnPropertyNames() gives the right answer for cross-origin Window");
    287289  assert_array_equals(Object.keys(C).sort(),
    288                       whitelistedWindowPropNames,
     290                      whitelistedWindowIndices,
    289291                      "Object.keys() gives the right answer for cross-origin Window");
    290292  assert_array_equals(Object.getOwnPropertyNames(C.location).sort(),
    291293                      whitelistedLocationPropNames,
    292294                      "Object.getOwnPropertyNames() gives the right answer for cross-origin Location");
    293   assert_array_equals(Object.keys(C.location).sort(),
    294                       whitelistedLocationPropNames,
     295  assert_equals(Object.keys(C.location).length, 0,
    295296                      "Object.keys() gives the right answer for cross-origin Location");
    296297}, "[[OwnPropertyKeys]] should return all properties from cross-origin objects");
  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/browsers/the-window-object/window-indexed-properties-expected.txt

    r224287 r224464  
    11
    22PASS Indexed properties of the window object (non-strict mode)
    3 FAIL Ensure indexed properties have the correct configuration assert_true: expected true got false
     3PASS Ensure indexed properties have the correct configuration
    44FAIL Indexed properties of the window object (non-strict mode) 1 assert_throws: function "() => Object.defineProperty(window, 0, { value: "bar" })" did not throw
    55FAIL Indexed properties of the window object (non-strict mode) 2 assert_throws: function "() => Object.defineProperty(window, 1, { value: "bar" })" did not throw
  • trunk/LayoutTests/js/dom/getOwnPropertyDescriptor-expected.txt

    r224287 r224464  
    129129PASS Object.getOwnPropertyDescriptor(global, 0).hasOwnProperty('get') is false
    130130PASS Object.getOwnPropertyDescriptor(global, 0).hasOwnProperty('set') is false
    131 PASS Object.getOwnPropertyDescriptor(global, 0).enumerable is false
     131PASS Object.getOwnPropertyDescriptor(global, 0).enumerable is true
    132132PASS Object.getOwnPropertyDescriptor(global, 0).configurable is true
    133133PASS Object.getOwnPropertyDescriptor(document.getElementsByTagName('div'), 0).value is document.getElementsByTagName('div')[0]
  • trunk/LayoutTests/js/resources/getOwnPropertyDescriptor.js

    r224287 r224464  
    4545descriptorShouldBe("global", "'window'", {get: 'globalWindowGetter', set: undefined, enumerable: true, configurable: false});
    4646descriptorShouldBe("global", "'XMLHttpRequest'", {writable: true, enumerable: false, configurable: true, value:"XMLHttpRequest"});
    47 descriptorShouldBe("global", "0", {writable: true, enumerable: false, configurable: true, value:"global[0]"});
     47descriptorShouldBe("global", "0", {writable: true, enumerable: true, configurable: true, value:"global[0]"});
    4848descriptorShouldBe("document.getElementsByTagName('div')", "0", {writable: false, enumerable: true, configurable: true, value:"document.getElementsByTagName('div')[0]"});
    4949descriptorShouldBe("document.getElementsByClassName('pass')", "0", {writable: false, enumerable: true, configurable: true, value:"document.getElementsByClassName('pass')[0]"});
  • trunk/Source/WebCore/ChangeLog

    r224463 r224464  
     12017-11-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Index properties on cross origin Window objects should be enumerable
     4        https://bugs.webkit.org/show_bug.cgi?id=179289
     5
     6        Reviewed by Darin Adler.
     7
     8        Index properties on cross origin Window objects should be enumerable:
     9        - https://github.com/whatwg/html/pull/3186
     10        - https://github.com/w3c/web-platform-tests/pull/8045
     11
     12        All exposed properties used to be enumerable but we had to revert this in
     13        r224287 because it was not Web-compatible. The HTML specification has now
     14        been updated so that only index properties are enumerable cross origin.
     15
     16        No new tests, rebaselined existing tests.
     17
     18        * bindings/js/JSDOMWindowCustom.cpp:
     19        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
     20        (WebCore::JSDOMWindow::getOwnPropertyNames):
     21
    1222017-11-04  Simon Fraser  <simon.fraser@apple.com>
    223
  • trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r224287 r224464  
    234234    // These are also allowed cross-orgin, so come before the access check.
    235235    if (frame && index < frame->tree().scopedChildCount()) {
    236         slot.setValue(thisObject, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::DontEnum), toJS(state, frame->tree().scopedChild(index)->document()->domWindow()));
     236        slot.setValue(thisObject, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly), toJS(state, frame->tree().scopedChild(index)->document()->domWindow()));
    237237        return true;
    238238    }
     
    352352    JSDOMWindow* thisObject = jsCast<JSDOMWindow*>(object);
    353353
    354     if (mode.includeDontEnumProperties())
    355         addScopedChildrenIndexes(*exec, thisObject->wrapped(), propertyNames);
     354    addScopedChildrenIndexes(*exec, thisObject->wrapped(), propertyNames);
    356355
    357356    if (!BindingSecurity::shouldAllowAccessToDOMWindow(exec, thisObject->wrapped(), DoNotReportSecurityError)) {
Note: See TracChangeset for help on using the changeset viewer.