Issue metadata
Sign in to add a comment
|
Security: Calling from WASM to JS should not pass the global object |
||||||||||||||||||||||
Issue descriptionThis template is ONLY for reporting security bugs. If you are reporting a Download Protection Bypass bug, please use the "Security - Download Protection" template. For all other reports, please use a different template. Please see the following link for instructions on filing security bugs: http://www.chromium.org/Home/chromium-security/reporting-security-bugs VULNERABILITY DETAILS Please provide a brief explanation of the security issue. VERSION Chrome Version: 51+ REPRODUCTION CASE Calls to JavaScript functions from WASM pass the global object as the receiver. Instead such calls should use the CallFunctionStub which should swap out the global object with the global proxy or undefined.
,
Jun 30 2016
The semantics aren't spec'ed yet, but probably likely that we'll want the same effect as if calling "foo()" without a receiver in JS; so that means receiver conversion.
,
Jun 30 2016
The following revision refers to this bug: https://chromium.googlesource.com/v8/v8.git/+/971731f354842236f3643b7f771f8aac89ac2ef3 commit 971731f354842236f3643b7f771f8aac89ac2ef3 Author: titzer <titzer@chromium.org> Date: Thu Jun 30 09:40:32 2016 [wasm] Fix receiver conversion for WASM->JS calls. R=yangguo@chromium.org,ahaas@chromium.org BUG= chromium:624713 LOG=Y Review-Url: https://codereview.chromium.org/2111843002 Cr-Commit-Position: refs/heads/master@{#37428} [modify] https://crrev.com/971731f354842236f3643b7f771f8aac89ac2ef3/src/compiler/wasm-compiler.cc [modify] https://crrev.com/971731f354842236f3643b7f771f8aac89ac2ef3/test/mjsunit/wasm/import-table.js [add] https://crrev.com/971731f354842236f3643b7f771f8aac89ac2ef3/test/mjsunit/wasm/receiver.js
,
Jun 30 2016
,
Jun 30 2016
,
Jul 6 2016
,
Oct 6 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by yangguo@chromium.org
, Jun 30 2016