Commit ddc8598e authored by Hiroki Nakagawa's avatar Hiroki Nakagawa Committed by Commit Bot

Worklet: Make "unsafe-eval" CSP directive available for worklets

"unsafe-eval" CSP directive is enabled in
WorkerOrWorkletScriptController::Evaluate(). This function is called for classic
script evaluation, not for module script evaluation that worklets depend on.
This means the current implementation doesn't work for worklets.

To enable the directive for worklets, this CL moves the part from Evaluate() to
InitializeContextIfNeeded() that is supposed to be called for both classic and
module script evaluation.

This CL also fixes ExecutionContext handling in
CodeGenerationCheckCallbackInMainThread(). This path is called not only from
Document but also from PaintWorklet.

This change is tested for workers by existing CSP tests, and will be tested for
worklets by tests to be added by a following change:
https://chromium-review.googlesource.com/c/chromium/src/+/771051

Bug: 773786
Change-Id: I29232a4297b2f4819f1fe28f3230fc7ea4f769f6
Reviewed-on: https://chromium-review.googlesource.com/799654Reviewed-by: default avatarKentaro Hara <haraken@chromium.org>
Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org>
Cr-Commit-Position: refs/heads/master@{#520806}
parent e4ddfe60
...@@ -353,8 +353,10 @@ static bool CodeGenerationCheckCallbackInMainThread( ...@@ -353,8 +353,10 @@ static bool CodeGenerationCheckCallbackInMainThread(
v8::Local<v8::Context> context, v8::Local<v8::Context> context,
v8::Local<v8::String> source) { v8::Local<v8::String> source) {
if (ExecutionContext* execution_context = ToExecutionContext(context)) { if (ExecutionContext* execution_context = ToExecutionContext(context)) {
DCHECK(execution_context->IsDocument() ||
execution_context->IsPaintWorkletGlobalScope());
if (ContentSecurityPolicy* policy = if (ContentSecurityPolicy* policy =
ToDocument(execution_context)->GetContentSecurityPolicy()) { execution_context->GetContentSecurityPolicy()) {
v8::String::Value source_str(source); v8::String::Value source_str(source);
UChar snippet[ContentSecurityPolicy::kMaxSampleLength + 1]; UChar snippet[ContentSecurityPolicy::kMaxSampleLength + 1];
size_t len = std::min((sizeof(snippet) / sizeof(UChar)) - 1, size_t len = std::min((sizeof(snippet) / sizeof(UChar)) - 1,
......
...@@ -242,6 +242,13 @@ bool WorkerOrWorkletScriptController::InitializeContextIfNeeded( ...@@ -242,6 +242,13 @@ bool WorkerOrWorkletScriptController::InitializeContextIfNeeded(
context, *world_, global_object, v8::Local<v8::Object>(), context, *world_, global_object, v8::Local<v8::Object>(),
v8::Local<v8::Function>(), global_interface_template); v8::Local<v8::Function>(), global_interface_template);
if (!disable_eval_pending_.IsEmpty()) {
script_state_->GetContext()->AllowCodeGenerationFromStrings(false);
script_state_->GetContext()->SetErrorMessageForCodeGenerationFromStrings(
V8String(isolate_, disable_eval_pending_));
disable_eval_pending_ = String();
}
return true; return true;
} }
...@@ -260,13 +267,6 @@ ScriptValue WorkerOrWorkletScriptController::Evaluate( ...@@ -260,13 +267,6 @@ ScriptValue WorkerOrWorkletScriptController::Evaluate(
ScriptState::Scope scope(script_state_.get()); ScriptState::Scope scope(script_state_.get());
if (!disable_eval_pending_.IsEmpty()) {
script_state_->GetContext()->AllowCodeGenerationFromStrings(false);
script_state_->GetContext()->SetErrorMessageForCodeGenerationFromStrings(
V8String(isolate_, disable_eval_pending_));
disable_eval_pending_ = String();
}
v8::TryCatch block(isolate_); v8::TryCatch block(isolate_);
v8::Local<v8::Script> compiled_script; v8::Local<v8::Script> compiled_script;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment