Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3a1c346c2fdeb2cfa85ea094208e38b3cf786149
https://github.com/WebKit/WebKit/commit/3a1c346c2fdeb2cfa85ea094208e38b3cf786149
Author: Keith Miller <keith_mil...@apple.com>
Date: 2023-09-07 (Thu, 07 Sep 2023)
Changed paths:
A JSTests/stress/taintedness-tracking-inlining.js
A JSTests/stress/taintedness-tracking.js
A LayoutTests/js/taintedness-innerhtml-expected.txt
A LayoutTests/js/taintedness-innerhtml.html
A LayoutTests/js/taintedness-settimeout-expected.txt
A LayoutTests/js/taintedness-settimeout.html
M Source/JavaScriptCore/API/JSBase.cpp
M Source/JavaScriptCore/API/JSObjectRef.cpp
M Source/JavaScriptCore/API/JSScript.mm
M Source/JavaScriptCore/API/JSScriptRef.cpp
M Source/JavaScriptCore/API/glib/JSCContext.cpp
M Source/JavaScriptCore/CMakeLists.txt
M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
M Source/JavaScriptCore/Scripts/wkbuiltins/builtins_templates.py
M Source/JavaScriptCore/Sources.txt
M Source/JavaScriptCore/builtins/BuiltinExecutables.cpp
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
M Source/JavaScriptCore/bytecode/CodeBlock.h
M Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/inspector/InjectedScriptManager.cpp
M Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp
M Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp
M Source/JavaScriptCore/interpreter/Interpreter.cpp
M Source/JavaScriptCore/interpreter/Interpreter.h
M Source/JavaScriptCore/jit/JITOpcodes.cpp
M Source/JavaScriptCore/jsc.cpp
M Source/JavaScriptCore/parser/SourceCode.h
M Source/JavaScriptCore/parser/SourceProvider.cpp
M Source/JavaScriptCore/parser/SourceProvider.h
A Source/JavaScriptCore/parser/SourceTaintedOrigin.cpp
A Source/JavaScriptCore/parser/SourceTaintedOrigin.h
M Source/JavaScriptCore/runtime/CachedTypes.cpp
M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
M Source/JavaScriptCore/runtime/Forward.h
M Source/JavaScriptCore/runtime/FunctionConstructor.cpp
M Source/JavaScriptCore/runtime/FunctionConstructor.h
M Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
M Source/JavaScriptCore/runtime/ShadowRealmPrototype.cpp
M Source/JavaScriptCore/runtime/VM.h
M Source/JavaScriptCore/tools/FunctionOverrides.cpp
M Source/JavaScriptCore/tools/JSDollarVM.cpp
M Source/WebCore/bindings/js/CachedScriptSourceProvider.h
M Source/WebCore/bindings/js/JSLazyEventListener.cpp
M Source/WebCore/bindings/js/JSLazyEventListener.h
M Source/WebCore/bindings/js/RunJavaScriptParameters.h
M Source/WebCore/bindings/js/ScheduledAction.cpp
M Source/WebCore/bindings/js/ScheduledAction.h
M Source/WebCore/bindings/js/ScriptBufferSourceProvider.h
M Source/WebCore/bindings/js/ScriptController.cpp
M Source/WebCore/bindings/js/ScriptController.h
M Source/WebCore/bindings/js/ScriptSourceCode.h
M Source/WebCore/bridge/objc/WebScriptObject.mm
M Source/WebCore/contentextensions/ContentExtensionsBackend.cpp
M Source/WebCore/css/DOMCSSPaintWorklet.cpp
M Source/WebCore/dom/Document.cpp
M Source/WebCore/dom/ScriptElement.cpp
M Source/WebCore/dom/ScriptElement.h
M Source/WebCore/html/HTMLMediaElement.cpp
M Source/WebCore/html/parser/HTMLScriptRunner.cpp
M Source/WebCore/inspector/InspectorFrontendAPIDispatcher.cpp
M Source/WebCore/inspector/InspectorFrontendHost.cpp
M Source/WebCore/inspector/agents/InspectorPageAgent.cpp
M Source/WebCore/loader/DocumentLoader.cpp
M Source/WebCore/page/LocalFrame.cpp
M Source/WebCore/testing/Internals.cpp
M Source/WebCore/xml/XMLTreeViewer.cpp
M Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp
M Source/WebKit/DerivedSources-output.xcfilelist
M Source/WebKit/UIProcess/API/C/WKPage.cpp
M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
M
Source/WebKit/UIProcess/Inspector/socket/RemoteInspectorProtocolHandler.cpp
M Source/WebKitLegacy/mac/WebView/WebFrame.mm
M Source/WebKitLegacy/mac/WebView/WebView.mm
Log Message:
-----------
Add taintedness tracking to JSC
https://bugs.webkit.org/show_bug.cgi?id=242537
rdar://83222586
Reviewed by Yusuke Suzuki.
This patch adds the core structure of what's needed to do taintedness tracking
in JSC.
This allows us to track tainted code even through eval assuming there isn't
support
from untainted code. In order to maintain performance of untainted code we add
a bit
to the VM which tells us if tainted code has run this event loop turn. This
allows
checkers of taintedness to skip a stack walk in the common case where there's
no tainted
code running.
* JSTests/stress/taintedness-tracking-inlining.js: Added.
(foo):
(setTimeout):
* JSTests/stress/taintedness-tracking.js: Added.
(check):
(callArg):
(Promise.resolve.then):
(setTimeout):
(let.evalFunc.vm.runTaintedString):
(setTimeout.globalThis.foo.set bar):
* LayoutTests/js/taintedness-innerhtml-expected.txt: Added.
* LayoutTests/js/taintedness-innerhtml.html: Added.
* LayoutTests/js/taintedness-settimeout-expected.txt: Added.
* LayoutTests/js/taintedness-settimeout.html: Added.
* Source/JavaScriptCore/API/JSBase.cpp:
(JSEvaluateScript):
(JSCheckScriptSyntax):
* Source/JavaScriptCore/API/JSObjectRef.cpp:
(JSObjectMakeFunction):
* Source/JavaScriptCore/API/JSScript.mm:
(-[JSScript sourceCode]):
* Source/JavaScriptCore/API/JSScriptRef.cpp:
* Source/JavaScriptCore/API/glib/JSCContext.cpp:
(jsc_context_check_syntax):
* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:
* Source/JavaScriptCore/Scripts/wkbuiltins/builtins_templates.py:
(BuiltinsGeneratorTemplates):
* Source/JavaScriptCore/Sources.txt:
* Source/JavaScriptCore/builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::BuiltinExecutables):
(JSC::BuiltinExecutables::defaultConstructorSourceCode):
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::CodeBlock):
* Source/JavaScriptCore/bytecode/CodeBlock.h:
(JSC::CodeBlock::couldBeTainted const):
* Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp:
(JSC::DebuggerCallFrame::evaluateWithScopeExtension):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::inliningCost):
* Source/JavaScriptCore/dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compileEntry):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::lower):
* Source/JavaScriptCore/inspector/InjectedScriptManager.cpp:
* Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp:
(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
* Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::parse):
* Source/JavaScriptCore/interpreter/Interpreter.cpp:
(JSC::eval):
(JSC::Interpreter::executeProgram):
* Source/JavaScriptCore/interpreter/Interpreter.h:
* Source/JavaScriptCore/jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_enter):
* Source/JavaScriptCore/jsc.cpp:
(GlobalObject::moduleLoaderFetch):
(JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/parser/SourceCode.h:
(JSC::makeSource):
* Source/JavaScriptCore/parser/SourceProvider.cpp:
(JSC::SourceProvider::SourceProvider):
(JSC::BaseWebAssemblySourceProvider::BaseWebAssemblySourceProvider):
* Source/JavaScriptCore/parser/SourceProvider.h:
(JSC::SourceProvider::setSourceTaintedOrigin):
(JSC::SourceProvider::sourceTaintedOrigin const):
(JSC::SourceProvider::couldBeTainted const):
(JSC::StringSourceProvider::create):
(JSC::StringSourceProvider::StringSourceProvider):
* Source/JavaScriptCore/parser/SourceTaintedOrigin.cpp: Added.
(JSC::sourceTaintedOriginToString):
(JSC::sourceTaintedOriginFromStack):
(JSC::computeNewSourceTaintedOriginFromStack):
* Source/JavaScriptCore/parser/SourceTaintedOrigin.h: Added.
(JSC::taintednessToTriState):
* Source/JavaScriptCore/runtime/CachedTypes.cpp:
(JSC::CachedSourceProviderShape::encode):
(JSC::CachedSourceProviderShape::decode const):
(JSC::CachedStringSourceProvider::decode const):
* Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
* Source/JavaScriptCore/runtime/Forward.h:
* Source/JavaScriptCore/runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
(JSC::constructFunctionSkippingEvalEnabledCheck):
* Source/JavaScriptCore/runtime/FunctionConstructor.h:
* Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/ShadowRealmPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
* Source/JavaScriptCore/runtime/VM.h:
(JSC::VM::mightBeExecutingTaintedCode const):
(JSC::VM::addressOfMightBeExecutingTaintedCode):
(JSC::VM::setMightBeExecutingTaintedCode):
(JSC::VM::finalizeSynchronousJSExecution):
* Source/JavaScriptCore/tools/FunctionOverrides.cpp:
(JSC::initializeOverrideInfo):
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::JSDollarVM::finishCreation):
* Source/WebCore/bindings/js/CachedScriptSourceProvider.h:
(WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
* Source/WebCore/bindings/js/JSLazyEventListener.cpp:
(WebCore::JSLazyEventListener::JSLazyEventListener):
(WebCore::JSLazyEventListener::initializeJSFunction const):
* Source/WebCore/bindings/js/JSLazyEventListener.h:
* Source/WebCore/bindings/js/RunJavaScriptParameters.h:
(WebCore::RunJavaScriptParameters::RunJavaScriptParameters):
(WebCore::RunJavaScriptParameters::encode const):
(WebCore::RunJavaScriptParameters::decode):
* Source/WebCore/bindings/js/ScheduledAction.cpp:
(WebCore::ScheduledAction::ScheduledAction):
(WebCore::ScheduledAction::execute):
* Source/WebCore/bindings/js/ScheduledAction.h:
* Source/WebCore/bindings/js/ScriptBufferSourceProvider.h:
* Source/WebCore/bindings/js/ScriptController.cpp:
(WebCore::ScriptController::executeScriptIgnoringException):
(WebCore::ScriptController::executeScriptInWorldIgnoringException):
(WebCore::ScriptController::executeScriptInWorld):
(WebCore::ScriptController::callInWorld):
(WebCore::ScriptController::executeUserAgentScriptInWorld):
(WebCore::ScriptController::executeJavaScriptURL):
* Source/WebCore/bindings/js/ScriptController.h:
* Source/WebCore/bindings/js/ScriptSourceCode.h:
(WebCore::ScriptSourceCode::ScriptSourceCode):
* Source/WebCore/bridge/objc/WebScriptObject.mm:
(-[WebScriptObject evaluateWebScript:]):
* Source/WebCore/contentextensions/ContentExtensionsBackend.cpp:
(WebCore::ContentExtensions::ContentExtensionsBackend::processContentRuleListsForLoad):
* Source/WebCore/css/DOMCSSPaintWorklet.cpp:
(WebCore::PaintWorklet::addModule):
* Source/WebCore/dom/Document.cpp:
(WebCore::Document::ensurePlugInsInjectedScript):
* Source/WebCore/dom/ScriptElement.cpp:
(WebCore::ScriptElement::ScriptElement):
(WebCore::ScriptElement::prepareScript):
(WebCore::ScriptElement::requestModuleScript):
(WebCore::ScriptElement::executePendingScript):
* Source/WebCore/dom/ScriptElement.h:
(WebCore::ScriptElement::sourceTaintedOrigin const):
* Source/WebCore/html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::ensureMediaControls):
* Source/WebCore/html/parser/HTMLScriptRunner.cpp:
(WebCore::HTMLScriptRunner::runScript):
* Source/WebCore/inspector/InspectorFrontendAPIDispatcher.cpp:
(WebCore::InspectorFrontendAPIDispatcher::evaluateExpression):
* Source/WebCore/inspector/InspectorFrontendHost.cpp:
(WebCore::InspectorFrontendHost::evaluateScriptInExtensionTab):
* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
* Source/WebCore/loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::handleContentFilterDidBlock):
* Source/WebCore/page/LocalFrame.cpp:
(WebCore::LocalFrame::injectUserScriptImmediately):
* Source/WebCore/testing/Internals.cpp:
(WebCore::Internals::evaluateInWorldIgnoringException):
* Source/WebCore/xml/XMLTreeViewer.cpp:
(WebCore::XMLTreeViewer::transformDocumentToTreeView):
* Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::endElementNs):
* Source/WebKit/DerivedSources-output.xcfilelist:
* Source/WebKit/UIProcess/API/C/WKPage.cpp:
(WKPageRunJavaScriptInMainFrame):
* Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView
_evaluateJavaScript:asAsyncFunction:withSourceURL:withArguments:forceUserGesture:inFrame:inWorld:completionHandler:]):
* Source/WebKitLegacy/mac/WebView/WebFrame.mm:
(-[WebFrame _stringByEvaluatingJavaScriptFromString:forceUserGesture:]):
* Source/WebKitLegacy/mac/WebView/WebView.mm:
(-[WebView aeDescByEvaluatingJavaScriptFromString:]):
Canonical link: https://commits.webkit.org/267765@main
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
