b123ee3411
There was a security issue from allowing WindowProxy to have its prototype mutated in https://bugs.chromium.org/p/chromium/issues/detail?id=399951 . This has since been resolved by making `window`, `location`, and `Object.prototype.__proto__` immutable. This change was fixed in https://bugs.chromium.org/p/v8/issues/detail?id=5149 . Reverts https://codereview.chromium.org/1529303003 R=littledan@chromium.org R=verwaest@chromium.org Review-Url: https://codereview.chromium.org/2671553006 Cr-Commit-Position: refs/heads/master@{#44078}
42 lines
1.2 KiB
JavaScript
42 lines
1.2 KiB
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var global = this;
|
|
;(function () {
|
|
var calledDelete = false;
|
|
var calledGet = false;
|
|
var calledHas = false;
|
|
var calledSet = false;
|
|
var target = {};
|
|
var assertEquals = global.assertEquals;
|
|
var proxy = new Proxy(target, {
|
|
has(target, property) {
|
|
calledHas = true;
|
|
return Reflect.has(target, property);
|
|
},
|
|
get(target, property, receiver) {
|
|
calledGet = true;
|
|
return Reflect.get(target, property, receiver);
|
|
},
|
|
set(targer, property, value, receiver) {
|
|
calledSet = true;
|
|
return Reflect.set(target, property, value, receiver);
|
|
},
|
|
delete(target, property, receiver) {
|
|
calledDelete = true;
|
|
return Reflect.delete(target, property, receiver);
|
|
}
|
|
});
|
|
Object.setPrototypeOf(global, proxy);
|
|
getGlobal;
|
|
assertTrue(calledGet);
|
|
makeGlobal = 2;
|
|
assertTrue(calledSet);
|
|
"findGlobal" in global;
|
|
assertTrue(calledHas);
|
|
var deletedOwn = delete makeGlobal;
|
|
assertTrue(deletedOwn);
|
|
assertEquals(void 0, makeGlobal);
|
|
})();
|