Commit 1032246d authored by Yifan Luo's avatar Yifan Luo Committed by Commit Bot

[Trusted Types] Change sample string for Function Constructor.

Changed the CSP violation report sample string for Trusted
Types from `eval|(function anonymous(xxxx` to `Function|xxxx`.

Bug: 1048604
Change-Id: I6484ef73f78ea245d39efe219e30f5a0ed5d4f74
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2235621
Commit-Queue: Yifan Luo <lyf@chromium.org>
Reviewed-by: default avatarDaniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#776905}
parent c33b623e
......@@ -152,11 +152,19 @@ bool TrustedTypeFail(TrustedTypeViolationKind kind,
if (execution_context->GetTrustedTypes())
execution_context->GetTrustedTypes()->CountTrustedTypeAssignmentError();
const char* kAnonymousPrefix = "(function anonymous";
String prefix = GetSamplePrefix(exception_state);
if (prefix == "eval" && value.StartsWith(kAnonymousPrefix)) {
prefix = "Function";
}
bool allow =
execution_context->GetSecurityContext()
.GetContentSecurityPolicy()
->AllowTrustedTypeAssignmentFailure(GetMessage(kind), value,
GetSamplePrefix(exception_state));
->AllowTrustedTypeAssignmentFailure(
GetMessage(kind),
prefix == "Function" ? value.Substring(strlen(kAnonymousPrefix))
: value,
prefix);
if (!allow) {
exception_state.ThrowTypeError(GetMessage(kind));
}
......
......@@ -26,7 +26,7 @@
});
return waitUntilCSPEventForTrustedTypes(t).then(t.step_func_done(e => {
assert_equals(e.sample.replace(/\n/g, ""),
"eval|(function anonymous(a,b) {return '1234");
"Function|(a,b) {return '12345678901234567890123");
}));
}, "Function constructor - the other kind of eval - is clipped.");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment