wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-22 23:27:30 +09:00
Code Issues Projects Releases Packages Wiki Activity

Don't allow proxies in the proto chain.

Browse source
This commit is contained in:
wolfbeast 2018-02-08 19:22:33 +01:00 • committed by Roy Tam
commit acf9f2c39c
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
js/xpconnect/wrappers/AccessCheck.cpp
View file

@ -307,6 +307,20 @@ ExposedPropertiesOnly::check(JSContext* cx, HandleObject wrapper, HandleId id, W
// Unfortunately, |cx| can be in either compartment when we call ::check. :-( // Unfortunately, |cx| can be in either compartment when we call ::check. :-(
JSAutoCompartment ac(cx, wrappedObject); JSAutoCompartment ac(cx, wrappedObject);
// Proxies are not allowed in the proto chain.
RootedObject o(cx, wrappedObject);
while (o) {
JSObject* unwrapped = js::IsWrapper(o) ? js::CheckedUnwrap(o, false) : o;
if (!unwrapped || js::IsProxy(unwrapped))
return false;
RootedObject p(cx);
if (!js::GetObjectProto(cx, o, &p))
return false;
o = p;
}
bool found = false; bool found = false;
if (!JS_HasPropertyById(cx, wrappedObject, exposedPropsId, &found)) if (!JS_HasPropertyById(cx, wrappedObject, exposedPropsId, &found))
return false; return false;