|
| 1 | +--TEST-- |
| 2 | +V8\Context::SetSecurityToken() |
| 3 | +--SKIPIF-- |
| 4 | +<?php if (!extension_loaded("v8")) print "skip"; ?> |
| 5 | +--FILE-- |
| 6 | +<?php |
| 7 | + |
| 8 | +/** @var \Phpv8Testsuite $helper */ |
| 9 | +$helper = require '.testsuite.php'; |
| 10 | +require '.v8-helpers.php'; |
| 11 | +$v8_helper = new PhpV8Helpers($helper); |
| 12 | + |
| 13 | + |
| 14 | +$isolate1 = new \V8\Isolate(); |
| 15 | + |
| 16 | +$context = new \V8\Context($isolate1); |
| 17 | +$v8_helper->injectConsoleLog($context); |
| 18 | + |
| 19 | +$other = new \V8\Context($isolate1); |
| 20 | +$v8_helper->injectConsoleLog($other); |
| 21 | + |
| 22 | +$obj_own = new \V8\ObjectValue($context); |
| 23 | +$obj_own->Set($context, new \V8\StringValue($isolate1, 'test'), new \V8\StringValue($isolate1, 'own')); |
| 24 | + |
| 25 | +$obj_other = new \V8\ObjectValue($context); |
| 26 | +$obj_other->Set($context, new \V8\StringValue($isolate1, 'test'), new \V8\StringValue($isolate1, 'other')); |
| 27 | + |
| 28 | + |
| 29 | +try { |
| 30 | + $context->GlobalObject()->Set($context, new \V8\StringValue($isolate1, 'own'), $obj_own); |
| 31 | + $context->GlobalObject()->Set($other, new \V8\StringValue($isolate1, 'other'), $obj_other); |
| 32 | + $helper->assert('There is no cross-context access by default', false); |
| 33 | +} catch (\V8\Exceptions\TryCatchException $e) { |
| 34 | + $helper->exception_export($e); |
| 35 | +} |
| 36 | + |
| 37 | +$context->SetSecurityToken(new \V8\StringValue($isolate1, 'secret 1')); |
| 38 | +$other->SetSecurityToken(new \V8\StringValue($isolate1, 'secret 2')); |
| 39 | + |
| 40 | +try { |
| 41 | + $context->GlobalObject()->Set($context, new \V8\StringValue($isolate1, 'own'), $obj_own); |
| 42 | + $context->GlobalObject()->Set($other, new \V8\StringValue($isolate1, 'other'), $obj_other); |
| 43 | + $helper->assert('Different security tokens should not grant cross-context access', false); |
| 44 | +} catch (\V8\Exceptions\TryCatchException $e) { |
| 45 | + $helper->exception_export($e); |
| 46 | +} |
| 47 | + |
| 48 | + |
| 49 | +$context->SetSecurityToken(new \V8\StringValue($isolate1, 'secret')); |
| 50 | +$other->SetSecurityToken(new \V8\StringValue($isolate1, 'secret')); |
| 51 | + |
| 52 | +try { |
| 53 | + $context->GlobalObject()->Set($context, new \V8\StringValue($isolate1, 'own'), $obj_own); |
| 54 | + $context->GlobalObject()->Set($other, new \V8\StringValue($isolate1, 'other'), $obj_other); |
| 55 | + $helper->assert('Different security tokens with the same value should not grant cross-context access', false); |
| 56 | +} catch (\V8\Exceptions\TryCatchException $e) { |
| 57 | + $helper->exception_export($e); |
| 58 | +} |
| 59 | + |
| 60 | + |
| 61 | +$secret = new \V8\StringValue($isolate1, 'secret'); |
| 62 | + |
| 63 | +$context->SetSecurityToken($secret); |
| 64 | +$other->SetSecurityToken($secret); |
| 65 | + |
| 66 | +$context->GlobalObject()->Set($context, new \V8\StringValue($isolate1, 'own'), $obj_own); |
| 67 | +$context->GlobalObject()->Set($other, new \V8\StringValue($isolate1, 'other'), $obj_other); |
| 68 | + |
| 69 | +$helper->line(); |
| 70 | + |
| 71 | + |
| 72 | +$v8_helper->CompileRun($context, <<<'SCRIPT' |
| 73 | +console.log('own.test: ', own.test); |
| 74 | +console.log('other.test: ', other.test); |
| 75 | +SCRIPT |
| 76 | +); |
| 77 | + |
| 78 | +echo 'We are done for now', PHP_EOL; |
| 79 | +?> |
| 80 | +EOF |
| 81 | +--EXPECT-- |
| 82 | +V8\Exceptions\TryCatchException: TypeError: no access |
| 83 | +V8\Exceptions\TryCatchException: TypeError: no access |
| 84 | +V8\Exceptions\TryCatchException: TypeError: no access |
| 85 | + |
| 86 | +own.test: own |
| 87 | +other.test: other |
| 88 | +We are done for now |
| 89 | +EOF |
0 commit comments