From 961e9592990b689521b7236767a5776f2c33d771 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Thu, 14 Mar 2024 14:37:47 +0000 Subject: [PATCH 1/5] Update EnsureCSPDoesNotBlockStringCompilation to match updated HostEnsureCanCompileStrings definition. --- index.bs | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/index.bs b/index.bs index 336d453086..321bb8e9b5 100644 --- a/index.bs +++ b/index.bs @@ -1442,13 +1442,32 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ to determine whether such compilation ought to be blocked.

- EnsureCSPDoesNotBlockStringCompilation(|realm|, |source|) + EnsureCSPDoesNotBlockStringCompilation(|realm|, |parameterStrings|, |bodyString|, |compilationType|, |parameterArgs|, |bodyArg|)

- Given a realm |realm| and a string |source|, this algorithm + Given a realm |realm|, a list of strings |parameterStrings|, a string |bodyString|, an enum (|compilationType|), + a list of ECMAScript language values (|parameterArgs|), and an ECMAScript language value (|bodyArg|), this algorithm returns normally if string compilation is allowed, and throws an "`EvalError`" if not: + 1. Let |source| be |bodyString|. + + 1. If |compilationType| is `*FUNCTION*`: + + 1. Set |source| to `"function anonymous("` + + 1. For each |arg| in |parameterStrings|: + + 1. Append |arg| to |source|. + + 1. If |arg| is not the last item of |parameterStrings|, append `","` to |source|. + + 1. Append `"\n) {\n"` to |source|. + + 1. Append |bodyString| to |source|. + + 1. Append `"\n}"` to |source|. + 1. Let |result| be "`Allowed`". 2. Let |global| be |realm|'s [=realm/global object=]. @@ -1483,9 +1502,7 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ 4. If |result| is "`Blocked`", throw an `EvalError` exception. - ISSUE(tc39/ecma262#938): {{HostEnsureCanCompileStrings()}} does not include the string which is - going to be compiled as a parameter. We'll also need to update HTML to pipe that value through - to CSP. + Note: |parameterArgs| and |bodyArg| are currently unused. They are included for future use.

Integration with WebAssembly

From e0e77783d91573a8580355e35e7dc069e8484b97 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Tue, 23 Apr 2024 17:50:55 +0100 Subject: [PATCH 2/5] Re-add |source| --- index.bs | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-) diff --git a/index.bs b/index.bs index 321bb8e9b5..5d37d5c491 100644 --- a/index.bs +++ b/index.bs @@ -1442,32 +1442,14 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ to determine whether such compilation ought to be blocked.

- EnsureCSPDoesNotBlockStringCompilation(|realm|, |parameterStrings|, |bodyString|, |compilationType|, |parameterArgs|, |bodyArg|) + EnsureCSPDoesNotBlockStringCompilation(|realm|, |parameterStrings|, |bodyString|, |source|, |compilationType|, |parameterArgs|, |bodyArg|)

- Given a realm |realm|, a list of strings |parameterStrings|, a string |bodyString|, an enum (|compilationType|), + Given a realm |realm|, a list of strings |parameterStrings|, a string |bodyString|, a string |source|, an enum (|compilationType|), a list of ECMAScript language values (|parameterArgs|), and an ECMAScript language value (|bodyArg|), this algorithm returns normally if string compilation is allowed, and throws an "`EvalError`" if not: - 1. Let |source| be |bodyString|. - - 1. If |compilationType| is `*FUNCTION*`: - - 1. Set |source| to `"function anonymous("` - - 1. For each |arg| in |parameterStrings|: - - 1. Append |arg| to |source|. - - 1. If |arg| is not the last item of |parameterStrings|, append `","` to |source|. - - 1. Append `"\n) {\n"` to |source|. - - 1. Append |bodyString| to |source|. - - 1. Append `"\n}"` to |source|. - 1. Let |result| be "`Allowed`". 2. Let |global| be |realm|'s [=realm/global object=]. @@ -1502,7 +1484,7 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ 4. If |result| is "`Blocked`", throw an `EvalError` exception. - Note: |parameterArgs| and |bodyArg| are currently unused. They are included for future use. + Note: |parameterStrings|, |parameterArgs|, |bodyArg| and |bodyString| are currently unused. They are included for future use.

Integration with WebAssembly

From 76997e009a6c375c70c3d19bd49525ef8990066a Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Tue, 11 Jun 2024 18:13:51 +0200 Subject: [PATCH 3/5] Update |source| to |codeString| --- index.bs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/index.bs b/index.bs index 5d37d5c491..00e0fe2576 100644 --- a/index.bs +++ b/index.bs @@ -1442,10 +1442,10 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ to determine whether such compilation ought to be blocked.

- EnsureCSPDoesNotBlockStringCompilation(|realm|, |parameterStrings|, |bodyString|, |source|, |compilationType|, |parameterArgs|, |bodyArg|) + EnsureCSPDoesNotBlockStringCompilation(|realm|, |parameterStrings|, |bodyString|, |codeString|, |compilationType|, |parameterArgs|, |bodyArg|)

- Given a realm |realm|, a list of strings |parameterStrings|, a string |bodyString|, a string |source|, an enum (|compilationType|), + Given a realm |realm|, a list of strings |parameterStrings|, a string |bodyString|, a string |codeString|, an enum (|compilationType|), a list of ECMAScript language values (|parameterArgs|), and an ECMAScript language value (|bodyArg|), this algorithm returns normally if string compilation is allowed, and throws an "`EvalError`" if not: @@ -1475,7 +1475,7 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ 3. If |source-list| [=list/contains=] the expression "`'report-sample'`", then set |violation|'s [=violation/sample=] to - the substring of |source| containing its first 40 characters. + the substring of |codeString| containing its first 40 characters. 4. Execute [[#report-violation]] on |violation|. From bef0e494151226852e1524e7517f1abfb089d7b6 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Thu, 13 Jun 2024 11:54:40 +0200 Subject: [PATCH 4/5] Fix build error --- index.bs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/index.bs b/index.bs index 00e0fe2576..c4e047e80c 100644 --- a/index.bs +++ b/index.bs @@ -35,6 +35,8 @@ spec:html text: style type: element-attr text: ping + type:interface + text:SharedWorker spec:fetch type: dfn text: main fetch From a078c7f81d560d9c75e9898f23f03efc806c5f41 Mon Sep 17 00:00:00 2001 From: Luke Warlow Date: Thu, 13 Jun 2024 12:46:33 +0200 Subject: [PATCH 5/5] Add missing compilationType from unused note --- index.bs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.bs b/index.bs index c4e047e80c..f36dee8f17 100644 --- a/index.bs +++ b/index.bs @@ -1486,7 +1486,7 @@ spec: WebRTC; urlPrefix: https://www.w3.org/TR/webrtc/ 4. If |result| is "`Blocked`", throw an `EvalError` exception. - Note: |parameterStrings|, |parameterArgs|, |bodyArg| and |bodyString| are currently unused. They are included for future use. + Note: |parameterStrings|, |bodyString|, |compilationType|, |parameterArgs|, and |bodyArg| are currently unused. They are included for future use.

Integration with WebAssembly