Revision: 20908
Author: [email protected]
Date: Wed Apr 23 12:28:50 2014 UTC
Log: Harden DefineOrRedefineDataProperty.
[email protected]
Review URL: https://codereview.chromium.org/240973002
http://code.google.com/p/v8/source/detail?r=20908
Modified:
/branches/bleeding_edge/src/runtime.cc
=======================================
--- /branches/bleeding_edge/src/runtime.cc Wed Apr 23 08:58:41 2014 UTC
+++ /branches/bleeding_edge/src/runtime.cc Wed Apr 23 12:28:50 2014 UTC
@@ -5193,6 +5193,7 @@
PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
bool fast = obj->HasFastProperties();
+ // DefineAccessor checks access rights.
JSObject::DefineAccessor(obj, name, getter, setter, attr);
RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
if (fast) JSObject::TransformToFastProperties(obj, 0);
@@ -5215,6 +5216,12 @@
CONVERT_SMI_ARG_CHECKED(unchecked, 3);
RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) ==
0);
PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
+
+ // Check access rights if needed.
+ if (js_object->IsAccessCheckNeeded() &&
+ !isolate->MayNamedAccess(js_object, name, v8::ACCESS_SET)) {
+ return isolate->heap()->undefined_value();
+ }
LookupResult lookup(isolate);
js_object->LocalLookupRealNamedProperty(*name, &lookup);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
