Bug 33182 – [V8] Move security checks for setting src to javascript url out of V8Custom

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Nate Chapin]

Ideally, these security checks would be in some common part of the custom bindings that all descendants of V8Element had access to.  Unfortunately, there doesn't seem to be such a place, and V8AttrCustom.cpp needs to have access to these checks as well.  Therefore, these should probably go in V8BindingSecurity (which will need to be expanded to something more than a typedef).

[Nate Chapin]

Created attachment 45842 [details]
patch

[WebKit Review Bot]

Attachment 45842 [details] did not pass style-queue:

Failed to run "WebKitTools/Scripts/check-webkit-style" exit_code: 1
WebCore/ChangeLog:7:  Line contains tab character.  [whitespace/tab] [5]
WebCore/bindings/v8/V8BindingSecurity.h:68:  Could not find a newline character at the end of the file.  [whitespace/ending_newline] [5]
Total errors found: 2

[Nate Chapin]

Created attachment 45843 [details]
patch minus style errors

[WebKit Review Bot]

style-queue ran check-webkit-style on attachment 45843 [details] without any errors.

[Adam Barth]

Comment on attachment 45843 [details]
patch minus style errors

Sorry, I think i steered you slightly wrong here.  This code can go in the generic BindingSecurity object since it's not dependent on V8:

http://trac.webkit.org/browser/trunk/WebCore/bindings/BindingSecurity.h

That way the code will be shared with JSC eventually.

[Nate Chapin]

(In reply to comment #5)
> (From update of attachment 45843 [details])
> Sorry, I think i steered you slightly wrong here.  This code can go in the
> generic BindingSecurity object since it's not dependent on V8:
> 
> http://trac.webkit.org/browser/trunk/WebCore/bindings/BindingSecurity.h
> 
> That way the code will be shared with JSC eventually.

That'll require a State<Binding> parameter then, right?  Is that ok?  I don't have a great idea of how the State is used.

[Nate Chapin]

Created attachment 45902 [details]
Functions are now in BindingSecurity.h.

I'm not sure whether these functions belong in BindingSecurity.h or whether we should add BindingSecurity.cpp, so I defaulted to not adding a new file.

[WebKit Review Bot]

style-queue ran check-webkit-style on attachment 45902 [details] without any errors.

[Adam Barth]

Comment on attachment 45902 [details]
Functions are now in BindingSecurity.h.

This looks great.  Unfortunately, these functions need to be in the header because of the template parameter.

I'm about to land a change that moves this file, so we're going to conflict.  I can land this if you'd rather not deal with the merge conflict.

[Adam Barth]

Committed r52812: <http://trac.webkit.org/changeset/52812>