binding: Creates a reject promise always in the current realm.

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

 {% from 'utilities.cpp.tmpl' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 {##############################################################################}
 {% macro generate_method(method, world_suffix) %}
 static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const v8::FunctionCallbackInfo<v8::Value>& info)
 {% filter format_remove_duplicates([
     'ExceptionState exceptionState',
     'ScriptState* scriptState = ']) %}
 {
     {% set define_exception_state -%}
     ExceptionState exceptionState(info.GetIsolate(), ExceptionState::ExecutionContext, "{{interface_name}}", "{{method.name}}");
     {%- endset %}
 
     {% set function_call = func_call_with_prep_of_args(method, world_suffix) %}
 
     {% if 'exceptionState' in function_call %}
     {{define_exception_state}}
     {% if method.returns_promise %}
-    {% if method.is_static %}
-    ScriptState* scriptState = ScriptState::forFunctionObject(info);
-    {% else %}
-    ScriptState* scriptState = ScriptState::forReceiverObject(info);
-    {% endif %}
-    ExceptionToRejectPromiseScope rejectPromiseScope(info, scriptState, exceptionState);
+    ExceptionToRejectPromiseScope rejectPromiseScope(info, exceptionState);
     {% endif %}
     {% endif %}
 
     {% if not method.is_static %}
     {{cpp_class}}* impl = {{v8_class}}::toImpl(info.Holder());
     {% endif %}
 
     {# Security checks #}

[Yuki, 2016/10/19 11:23:37]

This block is checking the origin.
We're throwing a SecurityError in shouldAllowAccessTo() if it's a cross origin.

[haraken, 2016/10/19 12:38:48]

However, this security check is generated only when the DOM attribute/operation
has [CheckSecurity], right?

How are ScriptPromise::reject()'s and any V8 APIs that can invoke arbitrary
scripts in other DOM attributes/operations cared?

My worry is that this security issue is not a specific problem of
ExceptionToRejectPromiseScope but a general problem of places that use a
relevant realm.

     {% if method.is_check_security_for_receiver %}
     {{define_exception_state}}
     {% if interface_name == 'EventTarget' %}
     // Performance hack for EventTarget.  Checking whether it's a Window or not
     // prior to the call to BindingSecurity::shouldAllowAccessTo increases 30%
     // of speed performance on Android Nexus 7 as of Dec 2015.  ALWAYS_INLINE
     // didn't work in this case.
     if (const DOMWindow* window = impl->toDOMWindow()) {
         if (!BindingSecurity::shouldAllowAccessTo(currentDOMWindow(info.GetIsolate()), window, exceptionState)) {
             return;
@@ skipping 18 matching lines @@
     ScriptState* scriptState = ScriptState::forFunctionObject(info);
     {% else %}
     ScriptState* scriptState = ScriptState::forReceiverObject(info);
     {% endif %}
     {% endif %}
 
     {% if method.is_custom_element_callbacks %}
     V0CustomElementProcessingStack::CallbackDeliveryScope deliveryScope;
     {% endif %}
 
     {{function_call | indent}}

[Yuki, 2016/10/19 11:23:37]

All the other hand-written ScriptPromise::reject() or whatever are executed
here, so it's already guaranteed that it's the same origin.

 }
 {% endfilter %}
 {% endmacro %}
 
 
 {######################################}
 {% macro func_call_with_prep_of_args(method, world_suffix) %}
 {{generate_arguments(method, world_suffix)}}
 {% if world_suffix %}
 {{cpp_method_call(method, method.v8_set_return_value_for_main_world, method.cpp_value)}}
@@ skipping 318 matching lines @@
 
     {% if fall_through_to_partial_overloads %}
 
     DCHECK({{overloads.name}}MethodForPartialInterface);
     ({{overloads.name}}MethodForPartialInterface)(info);
 
     {% else %}{# fall_through_to_partial_overloads #}
 
     ExceptionState exceptionState(info.GetIsolate(), ExceptionState::ExecutionContext, "{{interface_name}}", "{{overloads.name}}");
     {% if overloads.returns_promise_all %}
-    {% if overloads.is_static %}
-    ScriptState* scriptState = ScriptState::forFunctionObject(info);
-    {% else %}
-    ScriptState* scriptState = ScriptState::forReceiverObject(info);
-    {% endif %}
-    ExceptionToRejectPromiseScope rejectPromiseScope(info, scriptState, exceptionState);
+    ExceptionToRejectPromiseScope rejectPromiseScope(info, exceptionState);
     {% endif %}
 
     if (isArityError) {
         {% if overloads.length != 0 %}
         if (info.Length() < {{overloads.length}}) {
             exceptionState.throwTypeError(ExceptionMessages::notEnoughArguments({{overloads.length}}, info.Length()));
             return;
         }
         {% endif %}
         {% if overloads.valid_arities %}
@@ skipping 236 matching lines @@
                           if method.overloads else
                           method.runtime_enabled_function) %}
 const V8DOMConfiguration::MethodConfiguration {{method.name}}MethodConfiguration = {{method_configuration(method)}};
 V8DOMConfiguration::installMethod(isolate, world, v8::Local<v8::Object>(), prototypeObject, interfaceObject, signature, {{method.name}}MethodConfiguration);
 {% endfilter %}{# runtime_enabled() #}
 {% endfilter %}{# exposed() #}
 {% endfilter %}{# secure_context() #}
 {% endfor %}
 {% endif %}
 {%- endmacro %}