Skip to content

Commit 50faacd

Browse files
t2ymt2ym
committed
0.1.13-stack.6 with Issue #266 Block access to non-native global properties
1 parent 6658e4a commit 50faacd

13 files changed

+73
-28
lines changed

‎bower.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "thin-hook",
3-
"version": "0.1.13-stack.5",
3+
"version": "0.1.13-stack.6",
44
"description": "Thin Hook Preprocessor",
55
"main": "hook.min.js",
66
"authors": [

‎demo/cache-bundle.json

+7-7
Large diffs are not rendered by default.

‎demo/cacheBundleGeneration.js

+26
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,32 @@ default:
137137
console.log('test: checkLocation:', result);
138138
chai.assert.equal(result, 'about:blank', 'location is about:blank');
139139

140+
await page.goto(targetURL);
141+
console.log('goto', targetURL);
142+
await page.waitFor(15000);
143+
console.log('waitFor(15000)');
144+
result = await page.evaluate(function getPolymer() {
145+
try {
146+
return Polymer.name;
147+
}
148+
catch (error) {
149+
return error.message;
150+
}
151+
});
152+
console.log('test: getPolymer:', result);
153+
chai.assert.equal(result, 'Cannot read property \'name\' of undefined', 'cannot access non-native global property Polymer');
154+
await page.waitFor(1000);
155+
result = await page.evaluate(function checkLocation() {
156+
try {
157+
return location.href;
158+
}
159+
catch (error) {
160+
return error.message;
161+
}
162+
});
163+
console.log('test: checkLocation:', result);
164+
chai.assert.equal(result, 'about:blank', 'location is about:blank');
165+
140166
// end of tests
141167

142168
// start generation of cache-bundle.json

‎demo/empty-document.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<html>
77
<head>
88
<meta charset="utf-8">
9-
<script src="../../thin-hook/hook.min.js?no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&no-hook-authorization=4aa0b68a6232155166756cd26df3a813d93ec6a6814f6a5db2c2cb00ad5ee037,log-no-hook-authorization"></script>
9+
<script src="../../thin-hook/hook.min.js?no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&no-hook-authorization=b4b2643ab3d6fb31e43e00678f4162bc387c56276c425ffd1b212c54bb68cb0a,log-no-hook-authorization"></script>
1010
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
1111
<script context-generator src="context-generator.js?no-hook=true"></script>
1212
<script context-generator src="bootstrap.js?no-hook=true"></script>

‎demo/hook-callback.js

+29-10
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
3434
const Symbol = self.Symbol;
3535
const JSON = self.JSON;
3636
const URL = self.URL;
37+
let wrapGlobalProperty; // = function (object, property, objectName); assigned at the bottom of this script
3738
class Stack {
3839
constructor(stack) {
3940
// Note: O(1)
@@ -4395,6 +4396,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
43954396

43964397
let result;
43974398
try {
4399+
let globalAssignments;
43984400
if (otherWindowObjectsStatus.set) {
43994401
let _Object;
44004402
switch (typeof f) {
@@ -4593,7 +4595,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
45934595
let op = operatorNormalizer[_f];
45944596
let target = targetNormalizer[op];
45954597
let opType;
4596-
let globalAssignments = {};
4598+
globalAssignments = {};
45974599
if (typeof target === 'object') {
45984600
do {
45994601
if (normalizedThisArg instanceof Object) {
@@ -5775,6 +5777,14 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
57755777
break;
57765778
}
57775779
}
5780+
if (globalAssignments) {
5781+
if (_global.constructor.name === 'Window') {
5782+
for (let name in globalAssignments) {
5783+
wrapGlobalProperty([_global, name, 'window']);
5784+
}
5785+
}
5786+
}
5787+
57785788
lastContext = _lastContext;
57795789
// if (contextStack[contextStack.length - 1] !== context) { debugger; }
57805790
contextStack.pop();
@@ -5802,6 +5812,8 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
58025812

58035813
let result;
58045814
try {
5815+
let hasGlobalAssignments = false;
5816+
let globalAssignments;
58055817
if (otherWindowObjectsStatus.set) {
58065818
let _Object;
58075819
switch (typeof f) {
@@ -5999,8 +6011,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
59996011
let property = _escapePlatformProperties.get(rawProperty) || rawProperty;
60006012
let target = targetNormalizerMapObject.get(_f);
60016013
let opType;
6002-
let hasGlobalAssignments = false;
6003-
let globalAssignments = {};
6014+
globalAssignments = {};
60046015
if (typeof target === 'object') {
60056016
do {
60066017
if (normalizedThisArg instanceof Object) {
@@ -6994,6 +7005,14 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
69947005
break;
69957006
}
69967007
}
7008+
if (hasGlobalAssignments) {
7009+
if (_global.constructor.name === 'Window') {
7010+
for (let name in globalAssignments) {
7011+
wrapGlobalProperty([_global, name, 'window']);
7012+
}
7013+
}
7014+
}
7015+
69977016
lastContext = _lastContext;
69987017
// if (contextStack[contextStack.length - 1] !== context) { debugger; }
69997018
contextStack.pop();
@@ -7587,10 +7606,9 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
75877606
[
75887607
].forEach(url => whitelist.add(url));
75897608
const wildcardWhitelist = [
7609+
new RegExp('^at ([^(]* [(])?' + origin + '/components/'), // trust the site contents including other components
75907610
new RegExp('^at ([^(]* [(])?' + 'https://cdnjs.cloudflare.com/ajax/libs/vis/4[.]18[.]1/vis[.]min[.]js'),
75917611
new RegExp('^at ([^(]* [(])?' + 'https://www.gstatic.com/charts/loader[.]js'),
7592-
new RegExp('^at ([^(]* [(])?' + origin + '/components/thin-hook/demo/'), // trust the site contents
7593-
new RegExp('^at ([^(]* [(])?' + origin + '/components/thin-hook/hook[.]min[.]js'), // trust thin-hook
75947612
];
75957613
const excludes = new Set();
75967614
[
@@ -7619,10 +7637,7 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
76197637
}
76207638
return false;
76217639
};
7622-
[
7623-
[ _window, '*', 'window' ],
7624-
[ _Object.prototype, 'constructor', 'Object.prototype' ],
7625-
].forEach(([object, properties, objectName]) => {
7640+
wrapGlobalProperty = function ([object, properties, objectName]) {
76267641
let names;
76277642
if (properties === '*') {
76287643
names = _Object.getOwnPropertyNames(object);
@@ -7798,6 +7813,10 @@ Copyright (c) 2017, 2018, Tetsuya Mori <[email protected]>. All rights reserv
77987813
// window.name is not configurable
77997814
}
78007815
});
7801-
});
7816+
};
7817+
[
7818+
[ _window, '*', 'window' ],
7819+
[ _Object.prototype, 'constructor', 'Object.prototype' ],
7820+
].forEach(wrapGlobalProperty);
78027821
}
78037822
}

‎demo/index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
<html lang="en">
1616
<head>
1717
<meta charset="utf-8">
18-
<script src="../../thin-hook/hook.min.js?version=496&no-hook-authorization=4aa0b68a6232155166756cd26df3a813d93ec6a6814f6a5db2c2cb00ad5ee037,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
18+
<script src="../../thin-hook/hook.min.js?version=496&no-hook-authorization=b4b2643ab3d6fb31e43e00678f4162bc387c56276c425ffd1b212c54bb68cb0a,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
1919
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
2020
<script context-generator src="disable-devtools.js?no-hook=true"></script>
2121
<script context-generator src="context-generator.js?no-hook=true"></script>

‎demo/no-hook-authorization.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@
99
// hook.parameters.noHookAuthorizationFailed
1010
// JSONs are output to console in the learning mode
1111
//'*': true,
12-
"86918c80ba22c6ddcb334179fe2a3b6819f6d176709f899bfa8434bb94b1ac2e": true, // hook.min.js
12+
"6499a340728cc1bb3974ff2785b5de5a0031a0a4a829763aa3c9a70b2b97bf09": true, // hook.min.js
1313
"ba451c60ef71c0df971d17a7f84b0d35327042e8284b4372eb38ce73c6aa16e7": true, // demo/disable-devtools.js
1414
"7e0fcbf73f8a30d98082c497e4bec73f2b49e5bee70605bb8838aed035763868": true, // demo/context-generator.js
1515
"a66830bdcb5410a9b17ccc01ecda4e79fe9c9642085c6e386243930dc81b837a": true, // demo/bootstrap.js
16-
"904267acdce972b1f9ab8481c1acd37e0bf55dc27c35095a7db77a64a56aeb3e": true, // demo/hook-callback.js
16+
"db30a0e050e58454163cf7523ae11823b86c4104b362640d982b9b59a9e93fca": true, // demo/hook-callback.js
1717
"0979646683bec9b9682d974d549effb61b1fc981ad87dac76d44d0440d87b396": true, // demo/hook-native-api.js
1818
"e2e42b1f8c6c518b5878b5bd95d34c0f15e139a1afb6ab6a6642b6e81219d2c5": true, // demo/hook-worker.js
1919
"163ba1450660d02306936ad39a0b5977e042ba3270eca749fc30d98170e9be03": true, // demo/cache-bundle.js

‎demo/original-index.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
<html lang="en">
1616
<head>
1717
<meta charset="utf-8">
18-
<script src="../../thin-hook/hook.min.js?version=496&no-hook-authorization=4aa0b68a6232155166756cd26df3a813d93ec6a6814f6a5db2c2cb00ad5ee037,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=true"></script>
18+
<script src="../../thin-hook/hook.min.js?version=496&no-hook-authorization=b4b2643ab3d6fb31e43e00678f4162bc387c56276c425ffd1b212c54bb68cb0a,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=true"></script>
1919
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
2020
<script context-generator src="disable-devtools.js?no-hook=true"></script>
2121
<script context-generator src="context-generator.js?no-hook=true"></script>

‎demo/sub-document.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<html lang="en">
77
<head>
88
<meta charset="utf-8">
9-
<script src="../../thin-hook/hook.min.js?no-hook=true&no-hook-authorization=4aa0b68a6232155166756cd26df3a813d93ec6a6814f6a5db2c2cb00ad5ee037,log-no-hook-authorization"></script>
9+
<script src="../../thin-hook/hook.min.js?no-hook=true&no-hook-authorization=b4b2643ab3d6fb31e43e00678f4162bc387c56276c425ffd1b212c54bb68cb0a,log-no-hook-authorization"></script>
1010
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
1111
<script context-generator src="context-generator.js?no-hook=true"></script>
1212
<script context-generator src='bootstrap.js?no-hook=true'></script>

‎demo/sub-sub-document.html

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<html lang="en">
77
<head>
88
<meta charset="utf-8">
9-
<script src="../../thin-hook/hook.min.js?no-hook=true&no-hook-authorization=4aa0b68a6232155166756cd26df3a813d93ec6a6814f6a5db2c2cb00ad5ee037,log-no-hook-authorization"></script>
9+
<script src="../../thin-hook/hook.min.js?no-hook=true&no-hook-authorization=b4b2643ab3d6fb31e43e00678f4162bc387c56276c425ffd1b212c54bb68cb0a,log-no-hook-authorization"></script>
1010
<script context-generator src="no-hook-authorization.js?no-hook=true"></script>
1111
<script context-generator src="context-generator.js?no-hook=true"></script>
1212
<script context-generator src='bootstrap.js?no-hook=true'></script>

‎hook.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "thin-hook",
3-
"version": "0.1.13-stack.5",
3+
"version": "0.1.13-stack.6",
44
"description": "Thin Hook Preprocessor",
55
"main": "hook.js",
66
"scripts": {

‎test/hook.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)