The default bug view has changed. See this FAQ.

Do CSP checks fast and early in Function function

RESOLVED FIXED in mozilla6

Status

()

Core
JavaScript Engine
--
minor
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Waldo, Assigned: Waldo)

Tracking

(Depends on: 1 bug)

Trunk
mozilla6
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: fixed-in-tracemonkey)

Attachments

(1 attachment)

Created attachment 531225 [details] [diff] [review]
Patch

Right now Function creates the function it'll return (minus its script), then it does CSP checks to see whether to reject the attempt to create dynamic code.  And it does this by unconditionally calling the security callback, when it really should use GlobalObject::isEvalAllowed to take advantage of its cache of the eval-prohibited setting.  It should check for prohibition first, then proceed to creating an object to return, and it should do so using the is-prohibited fast path.

This builds atop bug 655192 and bug 655907 for no particular reason beyond adding a new explicit-global NewFunction overload, which is the direction we need to start heading for all APIs that can create an object, in order to eventually fully fix bug 631135.  I trust the minimal reliance on those patches (for the obviously-named GlobalObject::getOrCreateFunctionPrototype) won't present a difficulty.
Attachment #531225 - Flags: review?(mrbkap)
It was tempting to rename isEvalAllowed, but that made the overlap with the other two bugs a bit more than I wanted, before those bugs land.  That can be a followup or something, probably touches enough code to deserve it.
Comment on attachment 531225 [details] [diff] [review]
Patch

I was just going to suggest changing the function name when I saw comment 1!
Attachment #531225 - Flags: review?(mrbkap) → review+
http://hg.mozilla.org/tracemonkey/rev/6408576c8e08

Comment 1 is now bug 658069; I'll try to get to it shortly.
Whiteboard: fixed-in-tracemonkey
Target Milestone: --- → mozilla6
cdleary-bot mozilla-central merge info:
http://hg.mozilla.org/mozilla-central/rev/6408576c8e08
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.