Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

You must be a member of this account.

Restrict methods accessible from javascript on python objects

#19

Currently, if I expose a python object to javascript, all methods and properties of that object can be called from javascript. This will often allow the javascript code to access pretty much any python object (for example, you can often get a long way by starting with the module property).

It would be really nice to have some sort of restriction on the properties which can be accessed from javascript. I discussed this on email a little with Paul Davis, who mentioned that the original python-spidermonkey had simply made it such that any attribute starting with an underscore was off-limits from javascript. This would at least allow custom objects to be constructed which are safe to be exposed to javascript (ie, don't allow untrusted javascript to break out of the sandbox), but is a bit limiting.

I suggested that a nice approach might be to be able to register a callback (presumably, this would be registered on the Context), which would be called whenever javascript tried to access any attribute of a python object, would be passed the object and the name of the attribute, and would return True or False, to indicate whether the javascript should be allowed to access the attribute. Alternatively, the callback could simply raise an exception if the access was not allowed (which the javascript would be able to catch and handle appropriately).

I took a look at the code to attempt making a patch, but got somewhat lost rather quickly. If anyone can point me at the right part of the source code, I'd be happy to have another go at this, though. :)

Reported by Richard Boulton · June 11th, 2009 @ 07:47 AM

State: resolved
Milestone: Version 0.1.0
Assigned to: Paul J. Davis Paul J. Davis

Activity

  1. Paul J. Davis
    Paul J. Davis
    • State changed from new to open
    • Tag set to python, wrapping
    • Milestone set to Version 0.1.0

    Richard,

    Sorry it took me so long to respond to this. I had it on the todo list and then lost the list. :/

    The parts of the code that you'd need to look at are the bits in spidermonkey/context.c where the global handler is registered and consulted for attributes. This would be a good example of how to add the infrastructure for having a access handler. Once you have that registration working, it should only be a matter of adding checks before python objects are consulted which should be semi-localized to spidermonkey/context.c:get_prop and spidermonkey/pyobject.c:js_get_prop

    Let me know if you need anything else.

    June 12th, 2009 @ 11:10 AM

  2. Richard Boulton
    Richard Boulton

    June 13th, 2009 @ 11:14 PM

  3. Richard Boulton
    Richard Boulton

    I've put together an initial implementation of this, thanks to your hints, and it just about works, I think!

    It needs more testing, and a bit of an audit to check if this catches everything, but it feels like a nice approach for this.

    June 13th, 2009 @ 11:14 PM

  4. Paul J. Davis
    Paul J. Davis

    That looks right in line with what I was thinking. I've just read through the diff so I might be missing bits, but it looks like a call to check_key_access is missing in context.c when grabbing data from the global handler.

    I'll go through this more thoroughly tomorrow and get it committed. Thanks for your help.

    Paul

    June 14th, 2009 @ 01:00 AM

  5. Richard Boulton
    Richard Boulton

    I assume you're referring to adding a check somewhere in context.c:get_prop() - around line 95, just before PyObject_GetItem. That's probably a good idea, yes.

    I've tried implementing this, but am currently getting a segfault from my effort. My code's in my fork at http://github.com/rboulton/python-spidermonkey/tree/master , in case it's of any help to you (I'm going out now, so won't be able to look at it any further for a while).

    June 14th, 2009 @ 09:42 AM

  6. Paul J. Davis
    Paul J. Davis
    • State changed from open to resolved

    Forgot to do the state update in the commit. Filtering access should now work:

    http://github.com/davisp/python-spidermonkey/commit/e8e69e9f5644907...

    I uploaded a 0.0.7 version to PyPi in case people prefer that.

    Thanks for the patch Richard.

    June 14th, 2009 @ 07:43 PM

  7. Richard Boulton
    Richard Boulton

    Excellent - your updated patch all looks good here. Thanks for tidying up (lots!) and applying so quickly. :)

    June 15th, 2009 @ 02:57 AM

  8. Paul J. Davis
    Paul J. Davis

    No problem. If you have time, try and think of more tests. I get the feeling I'm missing edge cases but I'm lacking the creativity to figure out what they might be.

    June 15th, 2009 @ 08:22 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.