Commit 1032246d authored by Yifan Luo's avatar Yifan Luo Committed by Commit Bot

[Trusted Types] Change sample string for Function Constructor.

Changed the CSP violation report sample string for Trusted
Types from `eval|(function anonymous(xxxx` to `Function|xxxx`.

Bug: 1048604
Change-Id: I6484ef73f78ea245d39efe219e30f5a0ed5d4f74
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2235621
Commit-Queue: Yifan Luo <lyf@chromium.org>
Reviewed-by: default avatarDaniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#776905}
parent c33b623e
...@@ -152,11 +152,19 @@ bool TrustedTypeFail(TrustedTypeViolationKind kind, ...@@ -152,11 +152,19 @@ bool TrustedTypeFail(TrustedTypeViolationKind kind,
if (execution_context->GetTrustedTypes()) if (execution_context->GetTrustedTypes())
execution_context->GetTrustedTypes()->CountTrustedTypeAssignmentError(); execution_context->GetTrustedTypes()->CountTrustedTypeAssignmentError();
const char* kAnonymousPrefix = "(function anonymous";
String prefix = GetSamplePrefix(exception_state);
if (prefix == "eval" && value.StartsWith(kAnonymousPrefix)) {
prefix = "Function";
}
bool allow = bool allow =
execution_context->GetSecurityContext() execution_context->GetSecurityContext()
.GetContentSecurityPolicy() .GetContentSecurityPolicy()
->AllowTrustedTypeAssignmentFailure(GetMessage(kind), value, ->AllowTrustedTypeAssignmentFailure(
GetSamplePrefix(exception_state)); GetMessage(kind),
prefix == "Function" ? value.Substring(strlen(kAnonymousPrefix))
: value,
prefix);
if (!allow) { if (!allow) {
exception_state.ThrowTypeError(GetMessage(kind)); exception_state.ThrowTypeError(GetMessage(kind));
} }
......
...@@ -26,7 +26,7 @@ ...@@ -26,7 +26,7 @@
}); });
return waitUntilCSPEventForTrustedTypes(t).then(t.step_func_done(e => { return waitUntilCSPEventForTrustedTypes(t).then(t.step_func_done(e => {
assert_equals(e.sample.replace(/\n/g, ""), assert_equals(e.sample.replace(/\n/g, ""),
"eval|(function anonymous(a,b) {return '1234"); "Function|(a,b) {return '12345678901234567890123");
})); }));
}, "Function constructor - the other kind of eval - is clipped."); }, "Function constructor - the other kind of eval - is clipped.");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment