[demo][acl] Apply multiple ACLs for a single object

[t2ym]

[demo][acl] Apply multiple ACLs for a single object

Example ACLs

• Apply both acl.navigator and acl.clientInformation for navigator object
  • The access must be permitted by ALL the ACLs

const acl = {
  navigator: {
    serviceWorker: '---',
    ...
  },
  clientInformation: { // clientInformation === navigator
    usb: '---',
    ...
  },
};

navigator.serviceWorker; // access denied
clientInformation.serviceWorker; // access denied
navigator.usb; // access denied
clientInformation.usb; // access denied

Implementation

• [BREAKING CHANGE] _globalObjects.get(obj) returns a Set object containing object names
  • The first argument of applyAcl() can be either a Set object or a string

  // _globalObject is a SetMap instance
  class SetMap extends Map {
    set(key, value) {
      let set;
      if (super.has(key)) {
        set = super.get(key);
      }
      else {
        set = new Set();
        super.set(key, set);
      }
      set.add(value);
      return this;
    }
  };

• [BREAKING CHANGE] _blacklistObjects is deprecated
• _globalObjectsGet() function for mitigating [demo][hook-callback][Chrome Canary 63.0.3239.0] Map.get() is very slow #155 is deprecated
• name property of POSTed errorReport.json object is 'name1 name2 ... nameN' delimited by spaces
  • Of course, the errorReport.json object can be freely customized to meet the needs

/errorReport.json { context: '/components/thin-hook/demo/spread.js',
  error: 'Error',
  message: 'Permission Denied: Cannot access clientInformation navigator DummyContainer.navigator',
  name: 'clientInformation navigator DummyContainer.navigator',
  isStatic: false,
  isObject: true,
  property: 'serviceWorker',
  opType: 'r' }

[t2ym]

Ad-hoc method of application of ACLs for properties copied from globals

  const acl = {
    DummyContainer: {
      [S_OBJECT]: {
        [S_DEFAULT]: 'r--',
        '@normalization_checker': 'rwxRW',
      },
      [S_DEFAULT]: '---',
      navigator: {
        [S_DEFAULT]: function _copiedNavigatorAcl(normalizedThisArg,
                                                  normalizedArgs /* ['property', args], ['property', value], etc. */,
                                                  aclArgs /* [name, isStatic, isObject, property, opType, context] */,
                                                  hookArgs /* [f, thisArg, args, context, newTarget] */,
                                                  applyAcl /* for recursive application of ACL */) {
          // TODO: automate and force this process
          let opType = aclArgs[4];
          let target;
          if (opType === 'r') {
            Policy.trackClass('DummyContainer.navigator', normalizedThisArg[normalizedArgs[0]]);
            return true;
          }
          return false;
        },
        language: {
          [S_DEFAULT]: 'r--',
          '@normalization_checker': '---',
        },
      },
    },
    'DummyContainer.navigator': {
      [S_DEFAULT]: 'r--', // avoid redundant calls of Policy.trackClass('DummyContainer.navigator', target)
      [S_CHAIN]: () => acl.DummyContainer.navigator,
    },
  }

  // multipath
  window.DummyContainer = { navigator: navigator };

  DummyContainer.navigator.serviceWorker; // acl.navigator.serviceWorker is applied to DummyContainer.navigator

  DummyContainer.navigator.language; // acl.DummyContainer.navigator.language is applied to DummyContainer.navigator

  navigator.language; // acl.DummyContainer.navigator.language is applied to global navigator