Validate types of arguments passed to V8InjectedScriptHost custom methods.

Source/bindings/v8/custom/V8InjectedScriptHostCustom.cpp

 /*
  * Copyright (C) 2007-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 259 matching lines @@
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
     ScriptValue object(args[0]);
     ScriptValue hints(args[1]);
     host->inspectImpl(object.toInspectorValue(ScriptState::current()), hints.toInspectorValue(ScriptState::current()));
 
     return v8::Undefined();
 }
 
 v8::Handle<v8::Value> V8InjectedScriptHost::databaseIdMethodCustom(const v8::Arguments& args)
 {
-    if (args.Length() < 1)
-        return v8::Undefined();
-    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-    Database* database = V8Database::toNative(v8::Handle<v8::Object>::Cast(args[0]));
-    if (database)
-        return v8StringOrUndefined(host->databaseIdImpl(database), args.GetIsolate());
+    if (args.Length() > 0 && V8Database::HasInstance(args[0], args.GetIsolate(), worldType(args.GetIsolate()))) {
+        Database* database = V8Database::toNative(v8::Handle<v8::Object>::Cast(args[0]));
+        if (database) {
+            InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
+            return v8StringOrUndefined(host->databaseIdImpl(database), args.GetIsolate());
+        }
+    }
     return v8::Undefined();
 }
 
 v8::Handle<v8::Value> V8InjectedScriptHost::storageIdMethodCustom(const v8::Arguments& args)
 {
-    if (args.Length() < 1)
-        return v8::Undefined();
-    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-    Storage* storage = V8Storage::toNative(v8::Handle<v8::Object>::Cast(args[0]));
-    if (storage)
-        return v8StringOrUndefined(host->storageIdImpl(storage), args.GetIsolate());
+    if (args.Length() > 0 && V8Storage::HasInstance(args[0], args.GetIsolate(), worldType(args.GetIsolate()))) {
+        Storage* storage = V8Storage::toNative(v8::Handle<v8::Object>::Cast(args[0]));
+        if (storage) {
+            InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
+            return v8StringOrUndefined(host->storageIdImpl(storage), args.GetIsolate());
+        }
+    }
     return v8::Undefined();
 }
 
 v8::Handle<v8::Value> V8InjectedScriptHost::evaluateMethodCustom(const v8::Arguments& args)
 {
     if (args.Length() < 1)
         return v8::ThrowException(v8::Exception::Error(v8::String::New("One argument expected.")));
 
     v8::Handle<v8::String> expression = args[0]->ToString();
     if (expression.IsEmpty())
@@ skipping 13 matching lines @@
     v8::Handle<v8::Value> newValue = args[3];
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
     ScriptDebugServer& debugServer = host->scriptDebugServer();
     return debugServer.setFunctionVariableValue(functionValue, scopeIndex, variableName, newValue);
 }
 
 
 } // namespace WebCore