1931288 - Implement Trusted Types support for HostGetCodeForEval() / HostEnsureCanCompileStrings() / eval() / function constructor

Status: ASSIGNED

(Core :: JavaScript Engine, task, P3)

Description

[Frédéric Wang (:fredw)]

The Dynamic Code Brand Checks defines a HostGetCodeForEval() function that defaults to returning NO-CODE: https://tc39.es/proposal-dynamic-code-brand-checks/#sec-hostgetcodeforeval

But the HTML spec overrides it to handle TrustedScript objects: https://html.spec.whatwg.org/multipage/webappapis.html#hostgetcodeforeval(argument)

(I guess situation is similar to https://searchfox.org/mozilla-central/rev/30afd6631333bf83d5c62ca48c313d96a21b4bbd/js/src/proxy/Proxy.cpp#1046)

I'm making this depend on bug 1905239 as I assume we need the JS implementation first. I'm not quite sure either which component this bug should belong to.

I was not able to find any WPT test for HostGetCodeForEval + TrustedType.

Comment 1

[Frédéric Wang (:fredw)]

Reading the spec Dynamic Code Brand Checks more carefully, I understand PerformEval and CreateDynamicFunction calls HostEnsureCanCompileStrings which is modified by the HTML spec to perform EnsureCSPDoesNotBlockStringCompilation, which then has special code for trusted types.

Spec:
https://tc39.es/proposal-dynamic-code-brand-checks/
https://html.spec.whatwg.org/multipage/webappapis.html#hostensurecancompilestrings(realm,-parameterstrings,-bodystring,-codestring,-compilationtype,-parameterargs,-bodyarg)
https://w3c.github.io/webappsec-csp/#can-compile-strings

Tests: https://searchfox.org/mozilla-central/source/testing/web-platform/tests/trusted-types/ contains many tests for eval and function constructors.

Comment 2

[Frédéric Wang (:fredw)]

(In reply to Frédéric Wang (:fredw) from comment #1)

Reading the spec Dynamic Code Brand Checks more carefully, I understand PerformEval and CreateDynamicFunction calls HostEnsureCanCompileStrings which is modified by the HTML spec to perform EnsureCSPDoesNotBlockStringCompilation, which then has special code for trusted types.

I wrote down ECMAScript changes on bug 1905239 comment 1. In addition, the HTML changes at

https://html.spec.whatwg.org/#hostensurecancompilestrings(realm,-parameterstrings,-bodystring,-codestring,-compilationtype,-parameterargs,-bodyarg)
https://w3c.github.io/webappsec-csp/#can-compile-strings

seem to be handled in https://searchfox.org/mozilla-central/rev/b477cd37e845005dac8881427fa06a2771d993db/dom/workers/RuntimeService.cpp#502 and we would need to add trusted type support there.

We would also need to do the tweak suggested in

https://html.spec.whatwg.org/multipage/webappapis.html#hostgetcodeforeval(argument)

when HostGetCodeForEval is introduced in bug 1905239.

Comment 3

[Frédéric Wang (:fredw)]

Attachment: Bug 1931288 - Implement HostGetCodeForEval() hook as per the HTML spec. r=#dom-core,smaug

See https://html.spec.whatwg.org/multipage/webappapis.html#hostgetcodeforeval(argument)

Comment 4

[Frédéric Wang (:fredw)]

Attachment: Bug 1931288 - Implement EnsureCSPDoesNotBlockStringCompilation as per CSP spec. r=#dom-core,smaug

See https://w3c.github.io/webappsec-csp/#can-compile-strings

Comment 5

[Frédéric Wang (:fredw)]

Attachment: WIP: Bug 1931288 - Add test for string mismatch in EnsureCSPDoesNotBlockStringCompilation

See https://github.com/web-platform-tests/wpt/issues/49371

Comment 6

[Frédéric Wang (:fredw)]

Attachment: Bug 1931288 - Add more tests for EnsureCSPDoesNotBlockStringCompilation. r=#dom-core,smaug

See https://github.com/web-platform-tests/wpt/issues/49371
and https://github.com/web-platform-tests/wpt/issues/49367

Comment 7

[Phabricator Automation]

Comment on attachment 9440166 [details]
Bug 1931288 - Add more tests for EnsureCSPDoesNotBlockStringCompilation. r=#dom-core,smaug

Revision D230369 was moved to bug 1934373. Setting attachment 9440166 [details] to obsolete.

Comment 8

[Frédéric Wang (:fredw)]

Attachment: WIP: Bug 1931288 - Strip "function anonymous" prefixes from Function samples. r=smaug

See https://w3c.github.io/trusted-types/dist/spec/#should-block-sink-type-mismatch

TODO: import tests from https://github.com/WebKit/WebKit/pull/31390

Comment 9

[Phabricator Automation]

Comment on attachment 9441002 [details]
WIP: Bug 1931288 - Strip "function anonymous" prefixes from Function samples. r=smaug

Revision D230756 was moved to bug 1919729. Setting attachment 9441002 [details] to obsolete.