AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

Perform access checks on the prototype chain when setting an element through a setter

Browse Source 
BUG=

Review URL: https://codereview.chromium.org/861773002

Cr-Commit-Position: refs/heads/master@{#26173}
This commit is contained in:
verwaest 2015-01-20 08:50:48 -08:00 committed by Commit bot
parent bc3b2960e3
commit 65c01bdc64
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/objects.cc
View File

@ -2976,7 +2976,7 @@ MaybeHandle<Object> JSObject::SetElementWithCallbackSetterInPrototypes(
Handle<Object> value,
bool* found,
StrictMode strict_mode) {
Isolate *isolate = object->GetIsolate();
Isolate* isolate = object->GetIsolate();
for (PrototypeIterator iter(isolate, object); !iter.IsAtEnd();
iter.Advance()) {
if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
@ -2987,9 +2987,20 @@ MaybeHandle<Object> JSObject::SetElementWithCallbackSetterInPrototypes(
}
Handle<JSObject> js_proto =
Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
if (js_proto->IsAccessCheckNeeded()) {
if (!isolate->MayIndexedAccess(js_proto, index, v8::ACCESS_SET)) {
*found = true;
isolate->ReportFailedAccessCheck(js_proto, v8::ACCESS_SET);
RETURN_EXCEPTION_IF_SCHEDULED_EXCEPTION(isolate, Object);
return MaybeHandle<Object>();
}
}
if (!js_proto->HasDictionaryElements()) {
continue;
}
Handle<SeededNumberDictionary> dictionary(js_proto->element_dictionary());
int entry = dictionary->FindEntry(index);
if (entry != SeededNumberDictionary::kNotFound) {