proxybugs.js 6.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156
  1. //-------------------------------------------------------------------------------------------------------
  2. // Copyright (C) Microsoft. All rights reserved.
  3. // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
  4. //-------------------------------------------------------------------------------------------------------
  5. WScript.LoadScriptFile("..\\UnitTestFramework\\UnitTestFramework.js");
  6. var tests = [
  7. {
  8. name: "Setting proxy object on Map and WeakMap",
  9. body() {
  10. [WeakMap, Map].forEach(function(ctor) {
  11. var target = {};
  12. let p = new Proxy(target, {});
  13. let map = new ctor();
  14. map.set(p, 101);
  15. assert.areEqual(map.get(p), 101, ctor.name + " map should be able to set and get the proxy object");
  16. p.x = 20;
  17. assert.areEqual(target.x, 20, "target object should work as expected even after proxy object is added to map");
  18. });
  19. }
  20. },
  21. {
  22. name: "Setting proxy object on Map and WeakMap - multiple sets and delete",
  23. body() {
  24. [WeakMap, Map].forEach(function(ctor) {
  25. var target = {};
  26. let p = new Proxy(target, {});
  27. let map = new ctor();
  28. map.set(p, 101);
  29. assert.areEqual(map.get(p), 101);
  30. map.delete(p);
  31. assert.areEqual(map.get(p), undefined, ctor.name + " map can remove the proxy object properly");
  32. map.set(p, 102);
  33. assert.areEqual(map.get(p), 102, ctor.name + " proxy object can be set again and it returns 102");
  34. p.x = 20;
  35. assert.areEqual(target.x, 20, "target object should work as expected even after proxy object is added to map");
  36. });
  37. }
  38. },
  39. {
  40. name: "Assertion validation : returning descriptor during getOwnPropertyDescriptor should not pollute the descriptor",
  41. body() {
  42. var target = {};
  43. var handler = {};
  44. var getOwnPropertyDescriptorCalled = false;
  45. handler['defineProperty'] = function () {
  46. assert.fail("This function will not be called as 'getOwnPropertyDescriptor' will add accessor");
  47. };
  48. handler['getOwnPropertyDescriptor'] = function (t, property) {
  49. getOwnPropertyDescriptorCalled = true;
  50. Object.defineProperty(t, 'abc', { set: function () { } });
  51. return Reflect.getOwnPropertyDescriptor(t, property);
  52. };
  53. var proxy = new Proxy(target, handler);
  54. proxy.abc = undefined;
  55. assert.isTrue(getOwnPropertyDescriptorCalled);
  56. }
  57. },
  58. {
  59. name: "Assertion validation : returning descriptor with writable false should not defineProperty again.",
  60. body() {
  61. var target = {};
  62. var handler = {};
  63. var getOwnPropertyDescriptorCalled = false;
  64. handler['defineProperty'] = function () {
  65. assert.fail("This function will not be called as 'getOwnPropertyDescriptor' will add property with writable false");
  66. };
  67. handler['getOwnPropertyDescriptor'] = function (t, property) {
  68. getOwnPropertyDescriptorCalled = true;
  69. Object.defineProperty(t, 'abc', { value : 1, writable : false });
  70. return Reflect.getOwnPropertyDescriptor(t, property);
  71. };
  72. var proxy = new Proxy(target, handler);
  73. proxy.abc = undefined;
  74. assert.isTrue(getOwnPropertyDescriptorCalled);
  75. }
  76. },
  77. {
  78. name: "No property found at getOwnPropertyDescriptor will call defineProperty",
  79. body() {
  80. var target = {};
  81. var handler = {};
  82. var definePropertyCalled = false;
  83. var getOwnPropertyDescriptorCalled = false;
  84. handler['defineProperty'] = function () {
  85. definePropertyCalled = true;
  86. };
  87. handler['getOwnPropertyDescriptor'] = function (t, property) {
  88. getOwnPropertyDescriptorCalled = true;
  89. return Reflect.getOwnPropertyDescriptor(t, property);
  90. };
  91. var proxy = new Proxy(target, handler);
  92. proxy.abc = undefined;
  93. assert.isTrue(definePropertyCalled);
  94. assert.isTrue(getOwnPropertyDescriptorCalled);
  95. }
  96. },
  97. {
  98. name: "Cross-site on proxy exercising function trap - no function handler provided",
  99. body() {
  100. var targetCalled = false;
  101. var func4 = function () { targetCalled = true; };
  102. var v0 = new Proxy(func4, {});
  103. var anotherScript = `function foo() {
  104. var a = undefined;
  105. v0(a) > 1;
  106. }`;
  107. var sc0 = WScript.LoadScript(anotherScript, 'samethread');
  108. sc0.v0 = v0;
  109. sc0.foo();
  110. assert.isTrue(targetCalled);
  111. }
  112. },
  113. {
  114. name: "Type confusion in JavascriptProxy::SetPropertyTrap when using a Symbol",
  115. body: function () {
  116. try{ Reflect.set((new Proxy({}, {has: function(){ return true; }})), 'abc', 0x44444444, new Uint32Array); } catch(e){}
  117. try{ Reflect.set((new Proxy({}, {has: function(){ return true; }})), 'abc', 0x44444444, new Uint32Array); } catch(e){}
  118. var obj1 = Object.create(new Proxy({}, {}));
  119. obj1[Symbol.species] = 0;
  120. }
  121. },
  122. {
  123. name: "Cross-site on proxy exercising function trap - with 'apply' function trap",
  124. body() {
  125. var trapCalled = false;
  126. var func4 = function () {};
  127. var handler = {
  128. apply : function(a, b, c) {
  129. trapCalled = true;
  130. }
  131. };
  132. var v0 = new Proxy(func4, handler);
  133. var anotherScript = `function foo() {
  134. var a = undefined;
  135. v0(a) > 1;
  136. }`;
  137. var sc0 = WScript.LoadScript(anotherScript, 'samethread');
  138. sc0.v0 = v0;
  139. sc0.foo();
  140. assert.isTrue(trapCalled);
  141. }
  142. },
  143. ];
  144. testRunner.runTests(tests, { verbose: WScript.Arguments[0] != "summary" });