[ChromeDriver] Avoid cache interference

Use an object with a null prototype for the internal mapping of names to cached values. This reduces the likelihood of unintended interaction with the environment (e.g. when new enumerable prototypes are defined on the Object prototype). Update the testing code so that this change is verifiable. Bug: 1014780 Change-Id: Ifbdc8d09c1049d0ec07f7a0099d774579423cdb8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1894707Reviewed-by: John Chen <johnchen@chromium.org> Commit-Queue: Christian Biesinger <cbiesinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#713496}

[ChromeDriver] Avoid cache interference
Use an object with a null prototype for the internal mapping of names to cached values. This reduces the likelihood of unintended interaction with the environment (e.g. when new enumerable prototypes are defined on the Object prototype). Update the testing code so that this change is verifiable. Bug: 1014780 Change-Id: Ifbdc8d09c1049d0ec07f7a0099d774579423cdb8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1894707Reviewed-by: John Chen <johnchen@chromium.org> Commit-Queue: Christian Biesinger <cbiesinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#713496}
1578228c · Mike Pennisi · Commit Bot · 0a0395f5 · 1578228c · 1578228c
Commit 1578228c authored Nov 07, 2019 by Mike Pennisi Committed by Commit Bot Nov 07, 2019
Showing with 24 additions and 3 deletions

chrome/test/chromedriver/js/call_function.js chrome/test/chromedriver/js/call_function.js +2 -2

chrome/test/chromedriver/js/call_function_test.html chrome/test/chromedriver/js/call_function_test.html +22 -1

No files found.
--- a/chrome/test/chromedriver/js/call_function.js
+++ b/chrome/test/chromedriver/js/call_function.js
@@ -82,7 +82,7 @@ function newError(message, code) {
 * @constructor
 */
 function CacheWithUUID() {
-  this.cache_ = {};
+  this.cache_ = Object.create(null);
 }

 CacheWithUUID.prototype = {
@@ -146,7 +146,7 @@ CacheWithUUID.prototype = {
 * @constructor
 */
 function Cache() {
-  this.cache_ = {};
+  this.cache_ = Object.create(null);
  this.nextId_ = 1;
  this.idPrefix_ = Math.random().toString();
 }

--- a/chrome/test/chromedriver/js/call_function_test.html
+++ b/chrome/test/chromedriver/js/call_function_test.html
@@ -11,8 +11,9 @@ function unwrap(value, opt_cache) {
  return jsonDeserialize(value, [], opt_cache);
 }

+var initialCache = getPageCache().cache_;
 function clearCache() {
-  getPageCache().cache_ = {};
+  getPageCache().cache_ = Object.create(initialCache);
 }

 function isValidUUID(uuid) {
@@ -349,6 +350,26 @@ function testCallWithArrayToJSON(runner) {
  runner.waitForAsync();
 }

+function testCallWithModifiedObjectProto(runner) {
+  var callCount = 0;
+  Object.defineProperty(Object.prototype, 'f', {
+    enumerable: true,
+    configurable: true,
+    get: function() {
+      callCount += 1;
+    }
+  });
+
+  callFunction(function() {}, []).then(() => {
+    try {
+      assertEquals(callCount, 0);
+      runner.continueTesting();
+    } finally {
+      delete Object.prototype.f;
+    }
+  });
+  runner.waitForAsync();
+}
 </script>
 <body>
 <div><span></span></div>