1977364 - Remove support for ducktyped errors

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P1)

Description

[Tom Schuster (OoO)]

SpiderMonkey has special code to treat objects like {message: "<message>", fileName: "foo", lineNumber: 1} as actual instances of an Error object. This can actually be abused to execute code in some cases: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#no-parentheses-using-exception-handling-and-object-eval-on-firefox

I think this used to exist primarily to handle tricky wrapper cases where it might not be possible to obtain an actual error object. Nowadays, we just don't have that many wrappers anymore.

One thing we might want to think about are DOMException objects, these are almost Error objects but not really. If we just remove the duck typing, the following code will change behavior:

onerror = (message, source, lineno, colno, error) => {
  console.log(lineno, colno);
}
/* line 5 */ let exception = new DOMException("<DOMException message>", "<DOMException name>")
/* line 6 */ throw exception;

Currently this will log 5 0 (where the DOMException is constructed, but apparently we are missing the column?). This will change to 6 14 (the location of throw). Chrome matches with the new behavior.

I did a try push with the duck typing code disabled, there are some test failures related to changed error messages, but it looks manageable.

Comment 1

[Tom Schuster (OoO)]

Attachment: Bug 1977364 - Disable support for ducktyped errors. r?#spidermonkey-reviewers

Comment 2

[Tom Schuster (OoO)]

Attachment: Bug 1977364 - Support creating a JSErrorReport from DOMException objects to maintain the same error messages. r?#spidermonkey-reviewers,#dom-core

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/e0490b79399c
https://hg.mozilla.org/integration/autoland/rev/c0c6f170e490
Disable support for ducktyped errors. r=spidermonkey-reviewers,jandem
https://github.com/mozilla-firefox/firefox/commit/652c1798fb62
https://hg.mozilla.org/integration/autoland/rev/831879a358fc
Support creating a JSErrorReport from DOMException objects to maintain the same error messages. r=spidermonkey-reviewers,dom-core,mccr8,jandem
https://github.com/mozilla-firefox/firefox/commit/954b7a4e4403
https://hg.mozilla.org/integration/autoland/rev/429249e44884
apply code formatting via Lando

Comment 4

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/c0c6f170e490
https://hg.mozilla.org/mozilla-central/rev/831879a358fc
https://hg.mozilla.org/mozilla-central/rev/429249e44884