1210570 - |location + ""| is now spoofable

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Bobby Holley (:bholley)]

This is a regression from bug 1054756. I noticed some changes going by, and jorendorff confirmed. I'll attach a testcase.

Comment 1

[Bobby Holley (:bholley)]

Attachment: Tests. v1

Comment 2

[Anne (:annevk)]

Are we still keeping notes in https://etherpad-mozilla.org/html5-cross-origin-objects what the specification eventually needs to say? I've been somewhat occupied with other work, but I do mean to get that in due course. And since I haven't been super involved it would be great if we kept that as an up-to-date summary.

Comment 3

[Boris Zbarsky [:bzbarsky]]

> Are we still keeping notes in https://etherpad-mozilla.org/html5-cross-origin-objects
> what the specification eventually needs to say?

Note that this bug is about the _same_ origin case.

Comment 4

[Anne (:annevk)]

I see, so specification-wise, the problem here is that IDL hasn't been updated with the latest ECMAScript lingo. It does seem in the spirit of [Unforgeable] that this should not work. (Although [Unforgeable] at times saying it only applies to members does not make that very clear.)

Comment 5

[Boris Zbarsky [:bzbarsky]]

It's not a matter of lingo either.  It's just that IDL defined [Unforgeable] in such a way that it nerfed all the ways you could mess with the object, then ES added new ways of messing with the object.  We just need to nerf those too, and audit any future such additions to the language before implementing them.  And perhaps write more forward-looking tests for possible future ways objects could be messed with, but that's hard...

Comment 6

[Andrew McCreight [:mccr8]]

I'm going to mark this high. Feel free to adjust as needed.

Comment 7

[Jason Orendorff [:jorendorff]]

Attachment: Ensure that ToPrimitive(location) is not spoofable

Comment 8

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8670918 [details] [diff] [review]
Ensure that ToPrimitive(location) is not spoofable

r=me, but please make sure there's a webidl issue on file.

Comment 9

[Jason Orendorff [:jorendorff]]

Filed <https://www.w3.org/Bugs/Public/show_bug.cgi?id=29183>.

Comment 10

[Boris Zbarsky [:bzbarsky]]

Allen raises a good question in that w3.org issue: can't we just have @@toPrimitive be a value property with the value undefined?

Comment 11

[Jason Orendorff [:jorendorff]]

(In reply to Boris Zbarsky [:bz] from comment #10)
> Allen raises a good question in that w3.org issue: can't we just have
> @@toPrimitive be a value property with the value undefined?

Implementing.

Comment 12

[Jason Orendorff [:jorendorff]]

Bah, defining a data property isn't something this API really supports. I wonder if I should add support for it or route around...

Comment 13

[Boris Zbarsky [:bzbarsky]]

We can handle this the same way we handle toJSON on Location for now, via the explicit bit in InitUnforgeablePropertiesOnHolder in Codegen.py.

Comment 14

[Jason Orendorff [:jorendorff]]

Attachment: Ensure that ToPrimitive(location) is not spoofable

Comment 15

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8672703 [details] [diff] [review]
Ensure that ToPrimitive(location) is not spoofable

r=me, but this pattern:

  SYMBOL_TO_JSID(JS::GetWellKnownSymbol(aCx, JS::SymbolCode::toPrimitive))

is pretty annoying, though used in various places now.  It sure would be nice if we had a way to do WELL_KNOWN_SYMBOL_ID(aCx, toPrimitive) and have it work (all caps because it'd have to be a macro).

Comment 16

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/48d1f07e8d39a3ed252ab9eda43a9208ac78a639
Bug 1210570 - Ensure that ToPrimitive(location) is not spoofable. r=bz.

Comment 17

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/48d1f07e8d39