Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-09-27 07:10:19 +01:00
Code Issues Projects Releases Packages Wiki Activity

Avoid crash when non-trusted-script object is passed into Function constructor (#39451)

Browse source 
It is possible to pass in objects that are not trusted scripts into the
Function constructor. Rather than crashing, we now treat these as
untrusted. `can_compile_string_with_trusted_type` doesn't need to know
the contents of a string, as it always marks it as untrusted.

We can make the same optimization in the string case, where we no longer
need to convert the string.

Testing: This change adds a WPT crash test.
Fixes #39436

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
This commit is contained in:
Tim van der Lippe 2025-09-26 20:33:56 +02:00 • committed by GitHub
parent d29ad5b9c3
commit b38bf3e606
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 34 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
tests/wpt/meta/MANIFEST.json vendored
View file

@ -836283,6 +836283,13 @@
{}
]
],
"eval-with-non-trusted-script-object.html": [
"455e2620afc496b438e3a221451f260097146349",
[
null,
{}
]
],
"eval-with-permissive-csp.html": [
"b3dc352017675a2634aa96ac1fdea01b55ce9243",
[

20
tests/wpt/tests/trusted-types/eval-with-non-trusted-script-object.html vendored Normal file
View file

@ -0,0 +1,20 @@
<!DOCTYPE html>
<html>
<head>
<script nonce="abc" src="/resources/testharness.js"></script>
<script nonce="abc" src="/resources/testharnessreport.js"></script>
<script nonce="abc" src="support/helper.sub.js"></script>
<!-- Note: Trusted Types enforcement, and a CSP that does not blanket-allow eval. -->
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'; require-trusted-types-for 'script'">
</head>
<body>
<script nonce="abc">
const p = createScript_policy(window, 1);
test(t => {
assert_throws_js(EvalError, _ => {
// Without Trusted Types enforcement, this would return 47
new Function({toString() { return "a"; }}, "return a + 42")(5);
});
}, "Function constructor of stringified object and TrustedScript fails.");
</script>