templates defining decorators skip changing function global scope

RESOLVED FIXED in Firefox 48

Status

RESOLVED FIXED
3 years ago
11 months ago

People

(Reporter: glandium, Unassigned)

Tracking

(Blocks: 1 bug)

unspecified
mozilla48
Dependency tree / graph

Firefox Tracking Flags

(firefox48 fixed)

Details

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
Templates such as checking or deprecated_option implement decorators. With the way things currently work, this skips running _prepare_function on the decorated function, so the decorated function isn't set up with a restricted global scope. And since functions are not using __setitem__ when setting global variables, it means such functions could theoretically overwrite globals in the sandbox.

While not critical, because it's not likely to cause actual problems at the moment, it's possible it causes problems after bug 1256571, which would change the execution order, and might lead to templates and function declared later available to those functions, while it's not supposed to be the case.
(Reporter)

Updated

3 years ago
Blocks: 1256573
(Reporter)

Comment 1

3 years ago
Created attachment 8735314 [details]
MozReview Request: Bug 1259351 - Properly sandbox functions that are decorated with templates. r?nalexander

Review commit: https://reviewboard.mozilla.org/r/42681/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/42681/
Attachment #8735314 - Flags: review?(nalexander)
Comment on attachment 8735314 [details]
MozReview Request: Bug 1259351 - Properly sandbox functions that are decorated with templates. r?nalexander

https://reviewboard.mozilla.org/r/42681/#review39315

Someday I hope to read decorator definitions and not need to work forward from first principles.
Attachment #8735314 - Flags: review?(nalexander) → review+

Comment 4

3 years ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/178b2c7228b6
Status: NEW → RESOLVED
Last Resolved: 3 years ago
status-firefox48: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla48

Updated

11 months ago
Product: Core → Firefox Build System
You need to log in before you can comment on or make changes to this bug.