- Revision
- 131573
- Author
- [email protected]
- Date
- 2012-10-17 03:00:17 -0700 (Wed, 17 Oct 2012)
Log Message
V8 should throw a more descriptive exception when blocking 'eval' via CSP.
https://bugs.webkit.org/show_bug.cgi?id=94332
Reviewed by Adam Barth.
Source/WebCore:
Following up on https://bugs.webkit.org/show_bug.cgi?id=94331, this
patch wires up the new error message mechanism to V8, and updates the
Chromium test expectations accordingly.
* bindings/v8/ScriptController.cpp:
(WebCore::ScriptController::disableEval):
Pass 'errorMessage' through to V8.
* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::V8DOMWindowShell::initializeIfNeeded):
Grab the error message from ContentSecurityPolicy, and pass it
through to V8.
* bindings/v8/WorkerContextExecutionProxy.cpp:
(WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
(WebCore::WorkerContextExecutionProxy::evaluate):
(WebCore::WorkerContextExecutionProxy::setEvalAllowed):
* bindings/v8/WorkerContextExecutionProxy.h:
(WorkerContextExecutionProxy):
Convert 'm_disableEvalPending' to a string to store the current
error message, and use it to set the eval state.
* bindings/v8/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::disableEval):
Pass 'errorMessage' through to V8.
LayoutTests:
* platform/chromium/TestExpectations:
Unskipping these tests, as this patch unbreaks them.
* platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-expected.txt:
* platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe-expected.txt:
* platform/chromium/http/tests/security/contentSecurityPolicy/function-constructor-blocked-expected.txt:
Updating expectations with the new error message.
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (131572 => 131573)
--- trunk/LayoutTests/ChangeLog 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/LayoutTests/ChangeLog 2012-10-17 10:00:17 UTC (rev 131573)
@@ -1,3 +1,17 @@
+2012-10-17 Mike West <[email protected]>
+
+ V8 should throw a more descriptive exception when blocking 'eval' via CSP.
+ https://bugs.webkit.org/show_bug.cgi?id=94332
+
+ Reviewed by Adam Barth.
+
+ * platform/chromium/TestExpectations:
+ Unskipping these tests, as this patch unbreaks them.
+ * platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-expected.txt:
+ * platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe-expected.txt:
+ * platform/chromium/http/tests/security/contentSecurityPolicy/function-constructor-blocked-expected.txt:
+ Updating expectations with the new error message.
+
2012-10-17 MORITA Hajime <[email protected]>
Assertion failed on HTMLFormControlElement.cpp: updateFromElementCallback()
Modified: trunk/LayoutTests/platform/chromium/TestExpectations (131572 => 131573)
--- trunk/LayoutTests/platform/chromium/TestExpectations 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/LayoutTests/platform/chromium/TestExpectations 2012-10-17 10:00:17 UTC (rev 131573)
@@ -97,12 +97,6 @@
# TEMPORARILY SKIPPED TESTS
# -----------------------------------------------------------------
-# Rolling in a V8 change that will break these tests. We'll update with the new
-# test expectations along with the change that this roll will enable.
-webkit.org/b/94332 http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe.html [ Skip ]
-webkit.org/b/94332 http/tests/security/contentSecurityPolicy/eval-blocked.html [ Skip ]
-webkit.org/b/94332 http/tests/security/contentSecurityPolicy/function-constructor-blocked.html [ Skip ]
-
# Fails due to different window.close() rules. We need to decide whether we
# ever expect to pass this.
crbug.com/24189 fast/dom/open-and-close-by-DOM.html [ Skip ]
Modified: trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-expected.txt (131572 => 131573)
--- trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-expected.txt 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-expected.txt 2012-10-17 10:00:17 UTC (rev 131573)
@@ -1,3 +1,5 @@
-CONSOLE MESSAGE: line 12: Uncaught Error: Code generation from strings disallowed for this context
-CONSOLE MESSAGE: line 15: Uncaught Error: Code generation from strings disallowed for this context
+CONSOLE MESSAGE: line 12: Uncaught EvalError: Refused to evaluate a string as _javascript_ because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
+CONSOLE MESSAGE: line 15: Uncaught EvalError: Refused to evaluate a string as _javascript_ because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
+
+
Modified: trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe-expected.txt (131572 => 131573)
--- trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe-expected.txt 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe-expected.txt 2012-10-17 10:00:17 UTC (rev 131573)
@@ -1,3 +1,4 @@
ALERT: /PASS/
-CONSOLE MESSAGE: line 1: Uncaught Error: Code generation from strings disallowed for this context
+CONSOLE MESSAGE: line 1: Uncaught EvalError: Refused to evaluate a string as _javascript_ because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
+
Eval should be blocked in the iframe, but inline script should be allowed.
Modified: trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/function-constructor-blocked-expected.txt (131572 => 131573)
--- trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/function-constructor-blocked-expected.txt 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/LayoutTests/platform/chromium/http/tests/security/contentSecurityPolicy/function-constructor-blocked-expected.txt 2012-10-17 10:00:17 UTC (rev 131573)
@@ -1,2 +1,3 @@
-CONSOLE MESSAGE: line 12: Uncaught Error: Code generation from strings disallowed for this context
+CONSOLE MESSAGE: line 12: Uncaught EvalError: Refused to evaluate a string as _javascript_ because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'unsafe-inline'".
+
Modified: trunk/Source/WebCore/ChangeLog (131572 => 131573)
--- trunk/Source/WebCore/ChangeLog 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/Source/WebCore/ChangeLog 2012-10-17 10:00:17 UTC (rev 131573)
@@ -1,3 +1,33 @@
+2012-10-17 Mike West <[email protected]>
+
+ V8 should throw a more descriptive exception when blocking 'eval' via CSP.
+ https://bugs.webkit.org/show_bug.cgi?id=94332
+
+ Reviewed by Adam Barth.
+
+ Following up on https://bugs.webkit.org/show_bug.cgi?id=94331, this
+ patch wires up the new error message mechanism to V8, and updates the
+ Chromium test expectations accordingly.
+
+ * bindings/v8/ScriptController.cpp:
+ (WebCore::ScriptController::disableEval):
+ Pass 'errorMessage' through to V8.
+ * bindings/v8/V8DOMWindowShell.cpp:
+ (WebCore::V8DOMWindowShell::initializeIfNeeded):
+ Grab the error message from ContentSecurityPolicy, and pass it
+ through to V8.
+ * bindings/v8/WorkerContextExecutionProxy.cpp:
+ (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+ (WebCore::WorkerContextExecutionProxy::evaluate):
+ (WebCore::WorkerContextExecutionProxy::setEvalAllowed):
+ * bindings/v8/WorkerContextExecutionProxy.h:
+ (WorkerContextExecutionProxy):
+ Convert 'm_disableEvalPending' to a string to store the current
+ error message, and use it to set the eval state.
+ * bindings/v8/WorkerScriptController.cpp:
+ (WebCore::WorkerScriptController::disableEval):
+ Pass 'errorMessage' through to V8.
+
2012-10-17 MORITA Hajime <[email protected]>
Assertion failed on HTMLFormControlElement.cpp: updateFromElementCallback()
Modified: trunk/Source/WebCore/bindings/v8/ScriptController.cpp (131572 => 131573)
--- trunk/Source/WebCore/bindings/v8/ScriptController.cpp 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/Source/WebCore/bindings/v8/ScriptController.cpp 2012-10-17 10:00:17 UTC (rev 131573)
@@ -486,7 +486,7 @@
v8Context->AllowCodeGenerationFromStrings(true);
}
-void ScriptController::disableEval(const String& /* errorMessage */)
+void ScriptController::disableEval(const String& errorMessage)
{
v8::HandleScope handleScope;
v8::Handle<v8::Context> v8Context = windowShell()->context();
@@ -494,6 +494,7 @@
return;
v8Context->AllowCodeGenerationFromStrings(false);
+ v8Context->SetErrorMessageForCodeGenerationFromStrings(v8String(errorMessage));
}
PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widget)
Modified: trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp (131572 => 131573)
--- trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-10-17 10:00:17 UTC (rev 131573)
@@ -368,8 +368,11 @@
if (isMainWorld) {
updateDocument();
setSecurityToken();
- if (m_frame->document())
- context->AllowCodeGenerationFromStrings(m_frame->document()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport));
+ if (m_frame->document()) {
+ ContentSecurityPolicy* csp = m_frame->document()->contentSecurityPolicy();
+ context->AllowCodeGenerationFromStrings(csp->allowEval(0, ContentSecurityPolicy::SuppressReport));
+ context->SetErrorMessageForCodeGenerationFromStrings(v8String(csp->evalDisabledErrorMessage()));
+ }
} else {
// Using the default security token means that the canAccess is always
// called, which is slow.
Modified: trunk/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp (131572 => 131573)
--- trunk/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp 2012-10-17 10:00:17 UTC (rev 131573)
@@ -87,7 +87,7 @@
WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
: m_workerContext(workerContext)
- , m_disableEvalPending(false)
+ , m_disableEvalPending(String())
{
initIsolate();
}
@@ -213,9 +213,10 @@
if (!initializeIfNeeded())
return ScriptValue();
- if (m_disableEvalPending) {
+ if (!m_disableEvalPending.isEmpty()) {
m_context->AllowCodeGenerationFromStrings(false);
- m_disableEvalPending = false;
+ m_context->SetErrorMessageForCodeGenerationFromStrings(v8String(m_disableEvalPending));
+ m_disableEvalPending = String();
}
v8::Context::Scope scope(m_context);
@@ -252,9 +253,9 @@
return ScriptValue(result);
}
-void WorkerContextExecutionProxy::setEvalAllowed(bool enable)
+void WorkerContextExecutionProxy::setEvalAllowed(bool enable, const String& errorMessage)
{
- m_disableEvalPending = !enable;
+ m_disableEvalPending = enable ? String() : errorMessage;
}
void WorkerContextExecutionProxy::trackEvent(Event* event)
Modified: trunk/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h (131572 => 131573)
--- trunk/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h 2012-10-17 10:00:17 UTC (rev 131573)
@@ -69,7 +69,7 @@
void trackEvent(Event*);
// Alow use of eval() and is equivalents in scripts.
- void setEvalAllowed(bool enable);
+ void setEvalAllowed(bool enable, const String& errorMessage);
// Evaluate a script file in the current execution environment.
ScriptValue evaluate(const String& script, const String& fileName, const TextPosition& scriptStartPosition, WorkerContextExecutionState*);
@@ -93,7 +93,7 @@
OwnPtr<V8PerContextData> m_perContextData;
- bool m_disableEvalPending;
+ String m_disableEvalPending;
};
} // namespace WebCore
Modified: trunk/Source/WebCore/bindings/v8/WorkerScriptController.cpp (131572 => 131573)
--- trunk/Source/WebCore/bindings/v8/WorkerScriptController.cpp 2012-10-17 09:57:57 UTC (rev 131572)
+++ trunk/Source/WebCore/bindings/v8/WorkerScriptController.cpp 2012-10-17 10:00:17 UTC (rev 131573)
@@ -132,9 +132,9 @@
return m_executionForbidden;
}
-void WorkerScriptController::disableEval(const String& /* errorMessage */)
+void WorkerScriptController::disableEval(const String& errorMessage)
{
- m_proxy->setEvalAllowed(false);
+ m_proxy->setEvalAllowed(false, errorMessage);
}
void WorkerScriptController::setException(const ScriptValue& exception)
