Adds special cases to the taming membrane for builtins. (issue 6241043)

[meta...@gmail.com]

Reviewers: felix8a, ihab.awad,

Description:
Adds special cases for Boolean, Date, Number, RegExp, and String to
the taming membrane. Also whitelists toString and valueOf on
Boolean.prototype. (No one ever noticed they were missing.)

Please review this at http://codereview.appspot.com/6241043/

Affected files:
M src/com/google/caja/es53.js
M src/com/google/caja/plugin/taming-membrane.js
M tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html


Index: tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html
===================================================================
--- tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html
(revision 4885)
+++ tests/com/google/caja/plugin/es53-test-taming-untamed-guest.html
(working copy)
@@ -328,10 +328,17 @@
expectFailure(function() {
tameEval('1', new SubCtor());
});
- // Constructed instances of builtins are not exempt
- expectFailure(function() {
- tameEval('1', new Date());
- });
+ // Constructed instances of builtins are exempt
+ tameEval('assertEquals(false, a.valueOf());', new Boolean(false));
+ tameEval('assertEquals(false, a);', false);
+ // TODO(metaweta): figure out why jsunit falls over on dates in FF
+ // var d = new Date();
+ // tameEval('assertEquals(' + (+d) + ', +a);', d);
+ tameEval('assertEquals(31337, a.valueOf());', new Number(31337));
+ tameEval('assertEquals(31337, a);', 31337);
+ tameEval('assertEquals("/31337/g", a.toString());', /31337/g);
+ tameEval('assertEquals("31337", a.valueOf());', new String("31337"));
+ tameEval('assertEquals("31337", a);', "31337");
pass('testConstructedObjects');
});
</script>
Index: src/com/google/caja/es53.js
===================================================================
--- src/com/google/caja/es53.js (revision 4885)
+++ src/com/google/caja/es53.js (working copy)
@@ -3791,6 +3791,12 @@
configurable: false
});

+ // 15.6.4.2
+ markFunc(Boolean.prototype.toString);
+
+ // 15.6.4.3
+ markFunc(Boolean.prototype.valueOf);
+
// 15.7 Number

// 15.7.1--2
Index: src/com/google/caja/plugin/taming-membrane.js
===================================================================
--- src/com/google/caja/plugin/taming-membrane.js (revision 4885)
+++ src/com/google/caja/plugin/taming-membrane.js (working copy)
@@ -446,8 +446,19 @@
if (ctor === privilegedAccess.BASE_OBJECT_CONSTRUCTOR) {
f = untameCajaRecord(t);
} else {
- throw new TypeError(
- 'Untaming of guest constructed objects unsupported: ' + t);
+ // Check for built-ins
+ var tclass = ({}).toString.call(t);
+ switch (tclass) {
+ case '[object Boolean]':
+ case '[object Date]':
+ case '[object Number]':
+ case '[object RegExp]':
+ case '[object String]':
+ f = new ctor(t.valueOf()); break;
+ default:
+ throw new TypeError(
+ 'Untaming of guest constructed objects unsupported: ' + t);
+ }
}
} else if (ttype === 'function') {
f = Object.freeze(untameCajaFunction(t));

[ihab...@gmail.com]

lgtm

http://codereview.appspot.com/6241043/

[Liu Lei]

has fixed?

I encounter the same problem now!

在 2012年5月24日星期四UTC+8上午6时09分28秒，Mike Stay写道：