[google-caja] r4886 committed - Adds special cases to the taming membrane for builtins....

[googl...@googlecode.com]

Revision: 4886
Author: metaweta
Date: Wed May 23 15:45:23 2012
Log: Adds special cases to the taming membrane for builtins.
http://codereview.appspot.com/6241043

Adds special cases for Boolean, Date, Number, RegExp, and String to
the taming membrane. Also whitelists toString and valueOf on
Boolean.prototype. (No one ever noticed they were missing.)

R=felix8a, ihab.awad

http://code.google.com/p/google-caja/source/detail?r=4886

Modified:
/trunk/src/com/google/caja/es53.js
/trunk/src/com/google/caja/plugin/taming-membrane.js
/trunk/tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html

=======================================
--- /trunk/src/com/google/caja/es53.js Wed May 9 18:49:21 2012
+++ /trunk/src/com/google/caja/es53.js Wed May 23 15:45:23 2012
@@ -3791,6 +3791,12 @@
configurable: false
});

+ // 15.6.4.2
+ markFunc(Boolean.prototype.toString);
+
+ // 15.6.4.3
+ markFunc(Boolean.prototype.valueOf);
+
// 15.7 Number

// 15.7.1--2
=======================================
--- /trunk/src/com/google/caja/plugin/taming-membrane.js Tue May 22
09:14:47 2012
+++ /trunk/src/com/google/caja/plugin/taming-membrane.js Wed May 23
15:45:23 2012
@@ -446,8 +446,19 @@
if (ctor === privilegedAccess.BASE_OBJECT_CONSTRUCTOR) {
f = untameCajaRecord(t);
} else {
- throw new TypeError(
- 'Untaming of guest constructed objects unsupported: ' + t);
+ // Check for built-ins
+ var tclass = ({}).toString.call(t);
+ switch (tclass) {
+ case '[object Boolean]':
+ case '[object Date]':
+ case '[object Number]':
+ case '[object RegExp]':
+ case '[object String]':
+ f = new ctor(t.valueOf()); break;
+ default:
+ throw new TypeError(
+ 'Untaming of guest constructed objects unsupported: ' + t);
+ }
}
} else if (ttype === 'function') {
f = Object.freeze(untameCajaFunction(t));
=======================================
--- /trunk/tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html
Fri Apr 13 14:13:17 2012
+++ /trunk/tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html
Wed May 23 15:45:23 2012
@@ -328,10 +328,17 @@
expectFailure(function() {
tameEval('1', new SubCtor());
});
- // Constructed instances of builtins are not exempt
- expectFailure(function() {
- tameEval('1', new Date());
- });
+ // Constructed instances of builtins are exempt
+ tameEval('assertEquals(false, a.valueOf());', new Boolean(false));
+ tameEval('assertEquals(false, a);', false);
+ // TODO(metaweta): figure out why jsunit falls over on dates in FF
+ // var d = new Date();
+ // tameEval('assertEquals(' + (+d) + ', +a);', d);
+ tameEval('assertEquals(31337, a.valueOf());', new Number(31337));
+ tameEval('assertEquals(31337, a);', 31337);
+ tameEval('assertEquals("/31337/g", a.toString());', /31337/g);
+ tameEval('assertEquals("31337", a.valueOf());', new String("31337"));
+ tameEval('assertEquals("31337", a);', "31337");
pass('testConstructedObjects');
});
</script>

[Liu Lei]

has fixed?

I encounter the same problem now!

在 2012年5月24日星期四UTC+8上午6时45分39秒，googl...@googlecode.com写道：