History

Merge pull request #9065 from huffman/fix/script-engine-abuse

Fix deleteLater() vulnerability in scripts

Ryan Huffman committed 9 years ago

Commit 39070fe2 parents 30d5f70 601aa512 files · +10 −6Browse files

Showing the changes to libraries/script-engine/src/ScriptEngine.cpp (1 of 2 files). Show all

Unified · Split

libraries/script-engine/src/ScriptEngine.cpp+9−5
@@ -66,6 +66,8 @@ · 65 unmodified lines
66#include "MIDIEvent.h"66#include "MIDIEvent.h"
67 67
68static const QString SCRIPT_EXCEPTION_FORMAT = "[UncaughtException] %1 in %2:%3";68static const QString SCRIPT_EXCEPTION_FORMAT = "[UncaughtException] %1 in %2:%3";
69static const QScriptEngine::QObjectWrapOptions DEFAULT_QOBJECT_WRAP_OPTIONS =
70 QScriptEngine::ExcludeDeleteLater | QScriptEngine::ExcludeChildObjects;
69 71
70Q_DECLARE_METATYPE(QScriptEngine::FunctionSignature)72Q_DECLARE_METATYPE(QScriptEngine::FunctionSignature)
71int functionSignatureMetaID = qRegisterMetaType<QScriptEngine::FunctionSignature>();73int functionSignatureMetaID = qRegisterMetaType<QScriptEngine::FunctionSignature>();
@@ -94,7 +96,7 @@ static QScriptValue debugPrint(QScriptContext* context, QScriptEngine* engine){ · 22 unmodified lines
94}96}
95 97
96QScriptValue avatarDataToScriptValue(QScriptEngine* engine, AvatarData* const &in) {98QScriptValue avatarDataToScriptValue(QScriptEngine* engine, AvatarData* const &in) {
97 return engine->newQObject(in);99 return engine->newQObject(in, QScriptEngine::QtOwnership, DEFAULT_QOBJECT_WRAP_OPTIONS);
98}100}
99 101
100void avatarDataFromScriptValue(const QScriptValue &object, AvatarData* &out) {102void avatarDataFromScriptValue(const QScriptValue &object, AvatarData* &out) {
@@ -105,7 +107,7 @@ Q_DECLARE_METATYPE(controller::InputController*) · 4 unmodified lines
105//static int inputControllerPointerId = qRegisterMetaType<controller::InputController*>();107//static int inputControllerPointerId = qRegisterMetaType<controller::InputController*>();
106 108
107QScriptValue inputControllerToScriptValue(QScriptEngine *engine, controller::InputController* const &in) {109QScriptValue inputControllerToScriptValue(QScriptEngine *engine, controller::InputController* const &in) {
108 return engine->newQObject(in);110 return engine->newQObject(in, QScriptEngine::QtOwnership, DEFAULT_QOBJECT_WRAP_OPTIONS);
109}111}
110 112
111void inputControllerFromScriptValue(const QScriptValue &object, controller::InputController* &out) {113void inputControllerFromScriptValue(const QScriptValue &object, controller::InputController* &out) {
@@ -459,7 +461,8 @@ static QScriptValue scriptableResourceToScriptValue(QScriptEngine* engine, const · 347 unmodified lines
459 461
460 auto object = engine->newQObject(462 auto object = engine->newQObject(
461 const_cast<ScriptableResourceRawPtr>(resource),463 const_cast<ScriptableResourceRawPtr>(resource),
462 QScriptEngine::ScriptOwnership);464 QScriptEngine::ScriptOwnership,
465 DEFAULT_QOBJECT_WRAP_OPTIONS);
463 return object;466 return object;
464}467}
465 468
@@ -478,7 +481,8 @@ static QScriptValue createScriptableResourcePrototype(QScriptEngine* engine) { · 12 unmodified lines
478 state->setProperty(metaEnum.key(i), metaEnum.value(i));481 state->setProperty(metaEnum.key(i), metaEnum.value(i));
479 }482 }
480 483
481 auto prototypeState = engine->newQObject(state, QScriptEngine::QtOwnership, QScriptEngine::ExcludeSlots | QScriptEngine::ExcludeSuperClassMethods);484 auto prototypeState = engine->newQObject(state, QScriptEngine::QtOwnership,
485 QScriptEngine::ExcludeDeleteLater | QScriptEngine::ExcludeSlots | QScriptEngine::ExcludeSuperClassMethods);
482 prototype.setProperty("State", prototypeState);486 prototype.setProperty("State", prototypeState);
483 487
484 return prototype;488 return prototype;
@@ -611,7 +615,7 @@ void ScriptEngine::registerGlobalObject(const QString& name, QObject* object) { · 126 unmodified lines
611 615
612 if (!globalObject().property(name).isValid()) {616 if (!globalObject().property(name).isValid()) {
613 if (object) {617 if (object) {
614 QScriptValue value = newQObject(object);618 QScriptValue value = newQObject(object, QScriptEngine::QtOwnership, DEFAULT_QOBJECT_WRAP_OPTIONS);
615 globalObject().setProperty(name, value);619 globalObject().setProperty(name, value);
616 } else {620 } else {
617 globalObject().setProperty(name, QScriptValue());621 globalObject().setProperty(name, QScriptValue());