Reviewers: dcarney,
Message:
PTAL
Description:
Perform access checks on the prototype chain when setting an element
through a
setter
BUG=
Please review this at https://codereview.chromium.org/861773002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+12, -1 lines):
M src/objects.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
72fecad05a24cf6322dbde0c8a50504822d12626..c119e3535afdf2fa36f6bfb3ea2c119e5c2b947f
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2976,7 +2976,7 @@ MaybeHandle<Object>
JSObject::SetElementWithCallbackSetterInPrototypes(
Handle<Object> value,
bool* found,
StrictMode strict_mode) {
- Isolate *isolate = object->GetIsolate();
+ Isolate* isolate = object->GetIsolate();
for (PrototypeIterator iter(isolate, object); !iter.IsAtEnd();
iter.Advance()) {
if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
@@ -2987,9 +2987,20 @@ MaybeHandle<Object>
JSObject::SetElementWithCallbackSetterInPrototypes(
}
Handle<JSObject> js_proto =
Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
+
+ if (js_proto->IsAccessCheckNeeded()) {
+ if (!isolate->MayIndexedAccess(js_proto, index, v8::ACCESS_SET)) {
+ *found = true;
+ isolate->ReportFailedAccessCheck(js_proto, v8::ACCESS_SET);
+ RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
+ return MaybeHandle<Object>();
+ }
+ }
+
if (!js_proto->HasDictionaryElements()) {
continue;
}
+
Handle<SeededNumberDictionary>
dictionary(js_proto->element_dictionary());
int entry = dictionary->FindEntry(index);
if (entry != SeededNumberDictionary::kNotFound) {
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
