[Webkit-unassigned] [Bug 93392] CSP doesn't turn off eval, etc. in Web Workers

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=93392





--- Comment #17 from Thomas Sepez <tsepez at chromium.org>  2012-08-20 13:13:36 PST ---
(In reply to comment #16)
> (From update of attachment 159495 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=159495&action=review
> 
> > Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp:249
> > +    m_disableEvalPending = !enable;
> 
> What if m_context already exists?  Should we call AllowCodeGenerationFromStrings on it?
> 

Nah.  You don't do any work until you call evaluate(), so we just use that one path always.


> > Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h:72
> > +        void allowEval(bool enable);
> 
> setEvalAllowed ?
> 
Will Do.

> > Source/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp:69
> > +        if (ContentSecurityPolicy *policy = workerContext->contentSecurityPolicy()) {
> 
> ContentSecurityPolicy * -> ContentSecurityPolicy*
Will Do.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.