Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use Primordials for accessing ".buffer" properties in objects #11355

Closed
ghost opened this issue Jul 10, 2021 · 4 comments
Closed

Use Primordials for accessing ".buffer" properties in objects #11355

ghost opened this issue Jul 10, 2021 · 4 comments
Labels

Comments

@ghost
Copy link

ghost commented Jul 10, 2021

I mentioned that the WebGPU PR left a few dynamic object accesses. Ref #11265 (comment)

While looking through it, the changes are hard to do as they primarily accept WebIDL BufferSource objects, which themselves are very dynamic objects. Comparing the prototype against via the instanceof operator is a very fallible operation in that it doesn't genuinely give the true type of the object, therefore checking the prototype and then using an accessor such as TypedArrayPrototypeGetBuffer or DataViewPrototypeGetBuffer can still throw. In those cases, there's not much more that can be done, besides possibly trying the opposite accessor, but then it may have just thrown due to other reasons anyways. Do you have any suggestions as to how this should be handled?

webidl.js is used across the entire codebase, yet it also suffers from this vulnerability as it doesn't use the prototype primordials for these.

Originally posted by @crimsoncodes0 in #11224 (comment)

I could easily implement a small utility/helper function for accessing the buffer of an object that has been verified to be a WebIDL BufferSource via primordials.

Somewhat related, because I'd have naturally used something like this in the function's implementation, some of the internal code might be best written with assertions that abort the entire process. E.g. HTML spec assertions are use in a way that they are intended to be completely unreachable, and can be entirely eluded by implementers.

For example, the Request class's implementation has an assertion that simply throws a catch-able JavaScript error. Might I suggest that Deno.exit or something of the sort is called to indicate that the internal code should have never been reached (analogous to a Rust unreachable!(...))?

Otherwise usage of the primordials for these situations would be as simple as checking that object is of the correct type (which is already done), and then calling the helper on the object to receive it's internal ArrayBuffer. (I'd be happy to rewrite any code to use primordials for buffer access too :))

@stale
Copy link

stale bot commented Sep 9, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Sep 9, 2021
@ghost
Copy link
Author

ghost commented Sep 16, 2021

Ah, I forgot about this! I'll get around it soon. (Currently blocked on SharedArrayBuffer prototype being in the snapshot)

@stale stale bot removed the stale label Sep 16, 2021
@stale
Copy link

stale bot commented Nov 15, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Nov 15, 2021
@bartlomieju bartlomieju removed the stale label Nov 15, 2021
@stale
Copy link

stale bot commented Jan 14, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Jan 14, 2022
@stale stale bot closed this as completed Jan 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant