|
| 1 | +/* This Source Code Form is subject to the terms of the Mozilla Public |
| 2 | + * License, v. 2.0. If a copy of the MPL was not distributed with this |
| 3 | + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| 4 | + |
| 5 | +use std::ptr::{self, NonNull}; |
| 6 | +use std::sync::{LazyLock, Mutex}; |
| 7 | + |
| 8 | +use mozjs::conversions::jsstr_to_string; |
| 9 | +use mozjs::gc::StackGCVector; |
| 10 | +use mozjs::jsapi::{ |
| 11 | + CompilationType, Handle, HandleString, HandleValue, JSContext, JSSecurityCallbacks, JSString, |
| 12 | + JS_NewGlobalObject, JS_SetSecurityCallbacks, OnNewGlobalHookOption, RuntimeCode, |
| 13 | +}; |
| 14 | +use mozjs::jsval::{JSVal, UndefinedValue}; |
| 15 | +use mozjs::rooted; |
| 16 | +use mozjs::rust::{Handle as SafeHandle, JSEngine, RealmOptions, Runtime, SIMPLE_GLOBAL_CLASS}; |
| 17 | + |
| 18 | +static SECURITY_CALLBACKS: JSSecurityCallbacks = JSSecurityCallbacks { |
| 19 | + contentSecurityPolicyAllows: Some(content_security_policy_allows), |
| 20 | + codeForEvalGets: None, |
| 21 | + subsumes: None, |
| 22 | +}; |
| 23 | + |
| 24 | +unsafe extern "C" fn content_security_policy_allows( |
| 25 | + cx: *mut JSContext, |
| 26 | + _runtime_code: RuntimeCode, |
| 27 | + _code_string: HandleString, |
| 28 | + _compilation_type: CompilationType, |
| 29 | + parameter_strings: Handle<StackGCVector<*mut JSString>>, |
| 30 | + _body_string: HandleString, |
| 31 | + parameter_args: Handle<StackGCVector<JSVal>>, |
| 32 | + _body_arg: HandleValue, |
| 33 | + can_compile_strings: *mut bool, |
| 34 | +) -> bool { |
| 35 | + let parameter_strings = SafeHandle::from_raw(parameter_strings); |
| 36 | + assert_eq!(parameter_strings.len(), 2); |
| 37 | + |
| 38 | + let string0 = parameter_strings.at(0).expect("should have a value"); |
| 39 | + let string0 = NonNull::new(*string0).expect("should be non-null"); |
| 40 | + assert_eq!(jsstr_to_string(cx, string0), "a".to_string()); |
| 41 | + |
| 42 | + let string1 = parameter_strings.at(1).expect("should have a value"); |
| 43 | + let string1 = NonNull::new(*string1).expect("should be non-null"); |
| 44 | + assert_eq!(jsstr_to_string(cx, string1), "b".to_string()); |
| 45 | + |
| 46 | + let parameter_args = SafeHandle::from_raw(parameter_args); |
| 47 | + assert_eq!(parameter_args.len(), 2); |
| 48 | + |
| 49 | + let arg0 = parameter_args.at(0).expect("should have a value"); |
| 50 | + let string0 = arg0.to_string(); |
| 51 | + let string0 = NonNull::new(string0).expect("should be non-null"); |
| 52 | + assert_eq!(jsstr_to_string(cx, string0), "a".to_string()); |
| 53 | + |
| 54 | + let arg1 = parameter_args.at(1).expect("should have a value"); |
| 55 | + let string1 = arg1.to_string(); |
| 56 | + let string1 = NonNull::new(string1).expect("should be non-null"); |
| 57 | + assert_eq!(jsstr_to_string(cx, string1), "b".to_string()); |
| 58 | + |
| 59 | + *RAN_CSP_CALLBACK.lock().unwrap() = true; |
| 60 | + *can_compile_strings = true; |
| 61 | + true |
| 62 | +} |
| 63 | + |
| 64 | +static RAN_CSP_CALLBACK: LazyLock<Mutex<bool>> = LazyLock::new(|| Mutex::new(false)); |
| 65 | + |
| 66 | +#[test] |
| 67 | +fn csp_allow_arguments() { |
| 68 | + let engine = JSEngine::init().unwrap(); |
| 69 | + let runtime = Runtime::new(engine.handle()); |
| 70 | + let context = runtime.cx(); |
| 71 | + #[cfg(feature = "debugmozjs")] |
| 72 | + unsafe { |
| 73 | + mozjs::jsapi::SetGCZeal(context, 2, 1); |
| 74 | + } |
| 75 | + let h_option = OnNewGlobalHookOption::FireOnNewGlobalHook; |
| 76 | + let c_option = RealmOptions::default(); |
| 77 | + |
| 78 | + unsafe { |
| 79 | + JS_SetSecurityCallbacks(context, &SECURITY_CALLBACKS); |
| 80 | + |
| 81 | + rooted!(in(context) let global = JS_NewGlobalObject( |
| 82 | + context, |
| 83 | + &SIMPLE_GLOBAL_CLASS, |
| 84 | + ptr::null_mut(), |
| 85 | + h_option, |
| 86 | + &*c_option, |
| 87 | + )); |
| 88 | + |
| 89 | + rooted!(in(context) let mut rval = UndefinedValue()); |
| 90 | + let options = runtime.new_compile_options("test", 1); |
| 91 | + assert!(runtime |
| 92 | + .evaluate_script( |
| 93 | + global.handle(), |
| 94 | + "Function(\"a\", \"b\", \"return a + b\")", |
| 95 | + rval.handle_mut(), |
| 96 | + options |
| 97 | + ) |
| 98 | + .is_ok()); |
| 99 | + assert!(rval.get().is_object()); |
| 100 | + |
| 101 | + assert!(*RAN_CSP_CALLBACK.lock().unwrap()); |
| 102 | + } |
| 103 | +} |
0 commit comments