Reviewers: Søren Gjesse,
Description:
Merge bleeding_edge revision 6786 to trunk.
Please review this at http://codereview.chromium.org/6523022/
SVN Base: http://v8.googlecode.com/svn/trunk/
Affected files:
M src/runtime.cc
M src/version.cc
M test/cctest/test-api.cc
Index: src/runtime.cc
===================================================================
--- src/runtime.cc (revision 6789)
+++ src/runtime.cc (working copy)
@@ -4214,6 +4214,14 @@
Handle<JSObject> object(raw_object);
if (object->IsJSGlobalProxy()) {
+ // Do access checks before going to the global object.
+ if (object->IsAccessCheckNeeded() &&
+ !Top::MayNamedAccess(*object, Heap::undefined_value(),
+ v8::ACCESS_KEYS)) {
+ Top::ReportFailedAccessCheck(*object, v8::ACCESS_KEYS);
+ return *Factory::NewJSArray(0);
+ }
+
Handle<Object> proto(object->GetPrototype());
// If proxy is detached we simply return an empty array.
if (proto->IsNull()) return *Factory::NewJSArray(0);
Index: src/version.cc
===================================================================
--- src/version.cc (revision 6789)
+++ src/version.cc (working copy)
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 1
#define BUILD_NUMBER 4
-#define PATCH_LEVEL 0
+#define PATCH_LEVEL 1
#define CANDIDATE_VERSION false
// Define SONAME to have the SCons build the put a specific SONAME into the
Index: test/cctest/test-api.cc
===================================================================
--- test/cctest/test-api.cc (revision 6789)
+++ test/cctest/test-api.cc (working copy)
@@ -5617,6 +5617,35 @@
}
+// This is a regression test for issue 1154.
+TEST(AccessControlObjectKeys) {
+ v8::HandleScope handle_scope;
+ v8::Handle<v8::ObjectTemplate> global_template =
v8::ObjectTemplate::New();
+
+ global_template->SetAccessCheckCallbacks(NamedAccessBlocker,
+ IndexedAccessBlocker);
+
+ // Add an accessor that is not accessible by cross-domain JS code.
+ global_template->SetAccessor(v8_str("blocked_prop"),
+ UnreachableGetter, UnreachableSetter,
+ v8::Handle<Value>(),
+ v8::DEFAULT);
+
+ // Create an environment
+ v8::Persistent<Context> context0 = Context::New(NULL, global_template);
+ context0->Enter();
+
+ v8::Handle<v8::Object> global0 = context0->Global();
+
+ v8::Persistent<Context> context1 = Context::New();
+ context1->Enter();
+ v8::Handle<v8::Object> global1 = context1->Global();
+ global1->Set(v8_str("other"), global0);
+
+ ExpectTrue("Object.keys(other).indexOf('blocked_prop') == -1");
+}
+
+
static bool GetOwnPropertyNamesNamedBlocker(Local<v8::Object> global,
Local<Value> name,
v8::AccessType type,
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
