1 /*

     2  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.

     3  * Copyright (C) 2009 Apple Inc. All rights reserved.

     4  *

     5  * Redistribution and use in source and binary forms, with or without

     6  * modification, are permitted provided that the following conditions are

     7  * met:

     8  *

     9  *     * Redistributions of source code must retain the above copyright

    10  * notice, this list of conditions and the following disclaimer.

    11  *     * Redistributions in binary form must reproduce the above

    12  * copyright notice, this list of conditions and the following disclaimer

    13  * in the documentation and/or other materials provided with the

    14  * distribution.

    15  *     * Neither the name of Google Inc. nor the names of its

    16  * contributors may be used to endorse or promote products derived from

    17  * this software without specific prior written permission.

    18  *

    19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

    20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

    21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

    22  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

    23  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

    24  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

    25  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

    26  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

    27  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

    28  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

    29  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

    30  */

    31 

    32 #include "config.h"

    33 #include "ScriptController.h"

    34 

    35 #include "PlatformBridge.h"

    36 #include "Document.h"

    37 #include "ScriptCallStack.h"

    38 #include "ScriptableDocumentParser.h"

    39 #include "DOMWindow.h"

    40 #include "Event.h"

    41 #include "EventListener.h"

    42 #include "EventNames.h"

    43 #include "Frame.h"

    44 #include "FrameLoaderClient.h"

    45 #include "Node.h"

    46 #include "NotImplemented.h"

    47 #include "npruntime_impl.h"

    48 #include "npruntime_priv.h"

    49 #include "NPV8Object.h"

    50 #include "ScriptSourceCode.h"

    51 #include "Settings.h"

    52 #include "UserGestureIndicator.h"

    53 #include "V8Binding.h"

    54 #include "V8BindingState.h"

    55 #include "V8DOMWindow.h"

    56 #include "V8Event.h"

    57 #include "V8HiddenPropertyName.h"

    58 #include "V8HTMLEmbedElement.h"

    59 #include "V8IsolatedContext.h"

    60 #include "V8NPObject.h"

    61 #include "V8Proxy.h"

    62 #include "Widget.h"

    63 #include "XSSAuditor.h"

    64 #include <wtf/StdLibExtras.h>

    65 #include <wtf/text/CString.h>

    66 

    67 namespace WebCore {

    68 

    69 void ScriptController::initializeThreading()

    70 {

    71     static bool initializedThreading = false;

    72     if (!initializedThreading) {

    73         WTF::initializeThreading();

    74         WTF::initializeMainThread();

    75         initializedThreading = true;

    76     }

    77 }

    78 

    79 void ScriptController::setFlags(const char* string, int length)

    80 {

    81     v8::V8::SetFlagsFromString(string, length);

    82 }

    83 

    84 Frame* ScriptController::retrieveFrameForEnteredContext()

    85 {

    86     return V8Proxy::retrieveFrameForEnteredContext();

    87 }

    88 

    89 Frame* ScriptController::retrieveFrameForCurrentContext()

    90 {

    91     return V8Proxy::retrieveFrameForCurrentContext();

    92 }

    93 

    94 bool ScriptController::canAccessFromCurrentOrigin(Frame *frame)

    95 {

    96     return !v8::Context::InContext() || V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, true);

    97 }

    98 

    99 bool ScriptController::isSafeScript(Frame* target)

   100 {

   101     return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), target, true);

   102 }

   103 

   104 void ScriptController::gcProtectJSWrapper(void* domObject)

   105 {

   106     V8GCController::gcProtect(domObject);

   107 }

   108 

   109 void ScriptController::gcUnprotectJSWrapper(void* domObject)

   110 {

   111     V8GCController::gcUnprotect(domObject);

   112 }

   113 

   114 ScriptController::ScriptController(Frame* frame)

   115     : m_frame(frame)

   116     , m_sourceURL(0)

   117     , m_inExecuteScript(false)

   118     , m_processingTimerCallback(false)

   119     , m_paused(false)

   120     , m_proxy(new V8Proxy(frame))

   121 #if ENABLE(NETSCAPE_PLUGIN_API)

   122     , m_windowScriptNPObject(0)

   123 #endif

   124     , m_XSSAuditor(new XSSAuditor(frame))

   125 {

   126 }

   127 

   128 ScriptController::~ScriptController()

   129 {

   130     m_proxy->disconnectFrame();

   131 }

   132 

   133 void ScriptController::clearScriptObjects()

   134 {

   135     PluginObjectMap::iterator it = m_pluginObjects.begin();

   136     for (; it != m_pluginObjects.end(); ++it) {

   137         _NPN_UnregisterObject(it->second);

   138         _NPN_ReleaseObject(it->second);

   139     }

   140     m_pluginObjects.clear();

   141 

   142 #if ENABLE(NETSCAPE_PLUGIN_API)

   143     if (m_windowScriptNPObject) {

   144         // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window

   145         // script object properly.

   146         // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.

   147         _NPN_DeallocateObject(m_windowScriptNPObject);

   148         m_windowScriptNPObject = 0;

   149     }

   150 #endif

   151 }

   152 

   153 void ScriptController::updateSecurityOrigin()

   154 {

   155     m_proxy->windowShell()->updateSecurityOrigin();

   156 }

   157 

   158 void ScriptController::updatePlatformScriptObjects()

   159 {

   160     notImplemented();

   161 }

   162 

   163 bool ScriptController::processingUserGesture(DOMWrapperWorld*) const

   164 {

   165     // No script is running, so it is user-initiated unless the gesture stack

   166     // explicitly says it is not.

   167     if (!m_proxy->executingScript())

   168         return UserGestureIndicator::getUserGestureState() != DefinitelyNotProcessingUserGesture;

   169 

   170     v8::HandleScope handleScope;

   171     v8::Handle<v8::Context> v8Context = m_proxy->mainWorldContext();

   172     // FIXME: find all cases context can be empty:

   173     //  1) JS is disabled;

   174     //  2) page is NULL;

   175     if (v8Context.IsEmpty())

   176         return true;

   177 

   178     v8::Context::Scope scope(v8Context);

   179 

   180     v8::Handle<v8::Object> global = v8Context->Global();

   181     v8::Handle<v8::String> eventSymbol = V8HiddenPropertyName::event();

   182     v8::Handle<v8::Value> jsEvent = global->GetHiddenValue(eventSymbol);

   183     Event* event = V8DOMWrapper::isValidDOMObject(jsEvent) ? V8Event::toNative(v8::Handle<v8::Object>::Cast(jsEvent)) : 0;

   184 

   185     // Based on code from JSC's ScriptController::processingUserGesture.

   186     // Note: This is more liberal than Firefox's implementation.

   187     if (event) {

   188         // Event::fromUserGesture will return false when UserGestureIndicator::processingUserGesture() returns false.

   189         return event->fromUserGesture();

   190     }

   191     if (m_sourceURL && m_sourceURL->isNull() && !m_proxy->timerCallback()) {

   192         // This is the <a href="javascript:window.open('...')> case -> we let it through.

   193         return true;

   194     }

   195 

   196     // This is the <script>window.open(...)</script> case or a timer callback -> block it.

   197     // Based on JSC version, use returned value of UserGestureIndicator::processingUserGesture for all other situations. 

   198     return UserGestureIndicator::processingUserGesture();

   199 }

   200 

   201 bool ScriptController::anyPageIsProcessingUserGesture() const

   202 {

   203     // FIXME: is this right?

   204     return processingUserGesture();

   205 }

   206 

   207 void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources)

   208 {

   209     m_proxy->evaluateInIsolatedWorld(worldID, sources, 0);

   210 }

   211 

   212 void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup)

   213 {

   214     m_proxy->evaluateInIsolatedWorld(worldID, sources, extensionGroup);

   215 }

   216 

   217 // Evaluate a script file in the environment of this proxy.

   218 ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS)

   219 {

   220     String sourceURL = sourceCode.url();

   221     const String* savedSourceURL = m_sourceURL;

   222     m_sourceURL = &sourceURL;

   223 

   224     if (shouldAllowXSS == DoNotAllowXSS && !m_XSSAuditor->canEvaluate(sourceCode.source())) {

   225         // This script is not safe to be evaluated.

   226         return ScriptValue();

   227     }

   228 

   229     v8::HandleScope handleScope;

   230     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_proxy->frame());

   231     if (v8Context.IsEmpty())

   232         return ScriptValue();

   233 

   234     v8::Context::Scope scope(v8Context);

   235 

   236     RefPtr<Frame> protect(m_frame);

   237 

   238     v8::Local<v8::Value> object = m_proxy->evaluate(sourceCode, 0);

   239 

   240     // Evaluating the JavaScript could cause the frame to be deallocated

   241     // so we start the keep alive timer here.

   242     m_frame->keepAlive();

   243 

   244     m_sourceURL = savedSourceURL;

   245 

   246     if (object.IsEmpty() || object->IsUndefined())

   247         return ScriptValue();

   248 

   249     return ScriptValue(object);

   250 }

   251 

   252 int ScriptController::eventHandlerLineNumber() const

   253 {

   254     ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();

   255     if (parser)

   256         return parser->lineNumber();

   257     return 0;

   258 }

   259 

   260 int ScriptController::eventHandlerColumnNumber() const

   261 {

   262     ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();

   263     if (parser)

   264         return parser->columnNumber();

   265     return 0;

   266 }

   267 

   268 void ScriptController::finishedWithEvent(Event* event)

   269 {

   270     m_proxy->finishedWithEvent(event);

   271 }

   272 

   273 // Create a V8 object with an interceptor of NPObjectPropertyGetter.

   274 void ScriptController::bindToWindowObject(Frame* frame, const String& key, NPObject* object)

   275 {

   276     v8::HandleScope handleScope;

   277 

   278     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(frame);

   279     if (v8Context.IsEmpty())

   280         return;

   281 

   282     v8::Context::Scope scope(v8Context);

   283 

   284     v8::Handle<v8::Object> value = createV8ObjectForNPObject(object, 0);

   285 

   286     // Attach to the global object.

   287     v8::Handle<v8::Object> global = v8Context->Global();

   288     global->Set(v8String(key), value);

   289 }

   290 

   291 void ScriptController::collectGarbage()

   292 {

   293     v8::HandleScope handleScope;

   294 

   295     v8::Persistent<v8::Context> v8Context = v8::Context::New();

   296     if (v8Context.IsEmpty())

   297         return;

   298     {

   299         v8::Context::Scope scope(v8Context);

   300         v8::Local<v8::String> source = v8::String::New("if (gc) gc();");

   301         v8::Local<v8::String> name = v8::String::New("gc");

   302         v8::Handle<v8::Script> script = v8::Script::Compile(source, name);

   303         if (!script.IsEmpty())

   304             script->Run();

   305     }

   306     v8Context.Dispose();

   307 }

   308 

   309 void ScriptController::lowMemoryNotification()

   310 {

   311     v8::V8::LowMemoryNotification();

   312 }

   313 

   314 bool ScriptController::haveInterpreter() const

   315 {

   316     return m_proxy->windowShell()->isContextInitialized();

   317 }

   318 

   319 PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widget)

   320 {

   321     ASSERT(widget);

   322 

   323     if (widget->isFrameView())

   324         return 0;

   325 

   326     NPObject* npObject = PlatformBridge::pluginScriptableObject(widget);

   327 

   328     if (!npObject)

   329         return 0;

   330 

   331     // Frame Memory Management for NPObjects

   332     // -------------------------------------

   333     // NPObjects are treated differently than other objects wrapped by JS.

   334     // NPObjects can be created either by the browser (e.g. the main

   335     // window object) or by the plugin (the main plugin object

   336     // for a HTMLEmbedElement). Further, unlike most DOM Objects, the frame

   337     // is especially careful to ensure NPObjects terminate at frame teardown because

   338     // if a plugin leaks a reference, it could leak its objects (or the browser's objects).

   339     //

   340     // The Frame maintains a list of plugin objects (m_pluginObjects)

   341     // which it can use to quickly find the wrapped embed object.

   342     //

   343     // Inside the NPRuntime, we've added a few methods for registering

   344     // wrapped NPObjects. The purpose of the registration is because

   345     // javascript garbage collection is non-deterministic, yet we need to

   346     // be able to tear down the plugin objects immediately. When an object

   347     // is registered, javascript can use it. When the object is destroyed,

   348     // or when the object's "owning" object is destroyed, the object will

   349     // be un-registered, and the javascript engine must not use it.

   350     //

   351     // Inside the javascript engine, the engine can keep a reference to the

   352     // NPObject as part of its wrapper. However, before accessing the object

   353     // it must consult the _NPN_Registry.

   354 

   355     v8::Local<v8::Object> wrapper = createV8ObjectForNPObject(npObject, 0);

   356 

   357     // Track the plugin object. We've been given a reference to the object.

   358     m_pluginObjects.set(widget, npObject);

   359 

   360     return V8ScriptInstance::create(wrapper);

   361 }

   362 

   363 void ScriptController::cleanupScriptObjectsForPlugin(Widget* nativeHandle)

   364 {

   365     PluginObjectMap::iterator it = m_pluginObjects.find(nativeHandle);

   366     if (it == m_pluginObjects.end())

   367         return;

   368     _NPN_UnregisterObject(it->second);

   369     _NPN_ReleaseObject(it->second);

   370     m_pluginObjects.remove(it);

   371 }

   372 

   373 void ScriptController::getAllWorlds(Vector<DOMWrapperWorld*>& worlds)

   374 {

   375     worlds.append(mainThreadNormalWorld());

   376 }

   377 

   378 void ScriptController::evaluateInWorld(const ScriptSourceCode& source,

   379                                        DOMWrapperWorld* world)

   380 {

   381     Vector<ScriptSourceCode> sources;

   382     sources.append(source);

   383     // FIXME: Get an ID from the world param.

   384     evaluateInIsolatedWorld(0, sources);

   385 }

   386 

   387 static NPObject* createNoScriptObject()

   388 {

   389     notImplemented();

   390     return 0;

   391 }

   392 

   393 static NPObject* createScriptObject(Frame* frame)

   394 {

   395     v8::HandleScope handleScope;

   396     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(frame);

   397     if (v8Context.IsEmpty())

   398         return createNoScriptObject();

   399 

   400     v8::Context::Scope scope(v8Context);

   401     DOMWindow* window = frame->domWindow();

   402     v8::Handle<v8::Value> global = toV8(window);

   403     ASSERT(global->IsObject());

   404     return npCreateV8ScriptObject(0, v8::Handle<v8::Object>::Cast(global), window);

   405 }

   406 

   407 NPObject* ScriptController::windowScriptNPObject()

   408 {

   409     if (m_windowScriptNPObject)

   410         return m_windowScriptNPObject;

   411 

   412     if (canExecuteScripts(NotAboutToExecuteScript)) {

   413         // JavaScript is enabled, so there is a JavaScript window object.

   414         // Return an NPObject bound to the window object.

   415         m_windowScriptNPObject = createScriptObject(m_frame);

   416         _NPN_RegisterObject(m_windowScriptNPObject, 0);

   417     } else {

   418         // JavaScript is not enabled, so we cannot bind the NPObject to the

   419         // JavaScript window object. Instead, we create an NPObject of a

   420         // different class, one which is not bound to a JavaScript object.

   421         m_windowScriptNPObject = createNoScriptObject();

   422     }

   423     return m_windowScriptNPObject;

   424 }

   425 

   426 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)

   427 {

   428     // Can't create NPObjects when JavaScript is disabled.

   429     if (!canExecuteScripts(NotAboutToExecuteScript))

   430         return createNoScriptObject();

   431 

   432     v8::HandleScope handleScope;

   433     v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_frame);

   434     if (v8Context.IsEmpty())

   435         return createNoScriptObject();

   436     v8::Context::Scope scope(v8Context);

   437 

   438     DOMWindow* window = m_frame->domWindow();

   439     v8::Handle<v8::Value> v8plugin = toV8(static_cast<HTMLEmbedElement*>(plugin));

   440     if (!v8plugin->IsObject())

   441         return createNoScriptObject();

   442 

   443     return npCreateV8ScriptObject(0, v8::Handle<v8::Object>::Cast(v8plugin), window);

   444 }

   445 

   446 

   447 void ScriptController::clearWindowShell(bool)

   448 {

   449     // V8 binding expects ScriptController::clearWindowShell only be called

   450     // when a frame is loading a new page. V8Proxy::clearForNavigation

   451     // creates a new context for the new page.

   452     m_proxy->clearForNavigation();

   453 }

   454 

   455 #if ENABLE(INSPECTOR)

   456 void ScriptController::setCaptureCallStackForUncaughtExceptions(bool)

   457 {

   458     v8::V8::SetCaptureStackTraceForUncaughtExceptions(true, ScriptCallStack::maxCallStackSizeToCapture);

   459 }

   460 #endif

   461 

   462 void ScriptController::attachDebugger(void*)

   463 {

   464     notImplemented();

   465 }

   466 

   467 void ScriptController::updateDocument()

   468 {

   469     m_proxy->windowShell()->updateDocument();

   470 }

   471 

   472 void ScriptController::namedItemAdded(HTMLDocument* doc, const AtomicString& name)

   473 {

   474 }

   475 

   476 void ScriptController::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)

   477 {

   478 }

   479 

   480 } // namespace WebCore