Stage 0 Draft / June 5, 2019

HostEnsureCanCompileStrings Passthru

See also the explainer.

Background

The Trusted Types proposal seeks to double-check risky operations like code loading by requiring that code portions have a runtime type that indicates that they have been explicitly trusted. The Function builtin, whether invoked via [[Construct]] or [[Apply]], interprets its last argument as a JS FunctionBody. Step 16 of Runtime Semantics: CreateDynamicFunction says
  1. Set bodyText to ? ToString(bodyText).
 which loses information about whether the body is a TrustedScript preventing Trusted Types guards from allowing TrustedScripts from loading as code while preventing strings that might be attacker controlled from loading as code. Currently, the information available to the check is per-realm:
  1. Perform ? HostEnsureCanCompileStrings(callerRealm, calleeRealm).

This proposal aims to provide additional context to HostEnsureCanCompileStrings, and reorder the steps in CreateDynamicFunction so that HostEnsureCanCompilerStrings has runtime-type-information.

The production to use to parse bodyText. The value of bodyText before coercion to a string.

Additionally, the default policy's createScript callback return a value that is used in place of their input. For example, if the default policy's createScript callback returns "output" given "input" then eval("input") would load and run a ScriptBody parsed from the source text output. 

<meta http-equiv="Content-Security-Policy" content="trusted-types default" />
<script>
// Define a default policy that maps the source text `input` to `output`.
TrustedTypes.createPolicy(
  'default',
  {
    createScript(code) {
      if (code === 'input') { return 'output'; }
      throw new Error('blocked script execution');
    },
  });

globalThis.input = 1;
globalThis.output = 2;
// The source text loaded is `output`
eval('input') === globalThis.output;  // true
</script>

This proposal adjusts callers of the callback to expect a result and to use it in place of the inputs.

Changes to HostEnsureCanCompileStrings

1HostEnsureCanCompileStrings HostBeforeCompileValue ( callerRealm, calleeRealm, goal, args)

HostEnsureCanCompileStrings HostBeforeCompileValue is an implementation-defined abstract operation that allows host environments to block certain ECMAScript functions which allow developers to compile strings into ECMAScript code.

An implementation of HostEnsureCanCompileStrings HostBeforeCompileValue may complete normally or abruptly. Any abrupt completions will be propagated to its callers. The default implementation of HostEnsureCanCompileStrings HostBeforeCompileValue is to unconditionally return an empty a normal completion with a value of args.

args must be a list of values.

Any normal completion value from HostBeforeCompileValue must be a list of values.

Any normal completion value from HostBeforeCompileValue should be used by callers in place of the input args.

Note 1
For eval args will have a single element, the source to evaluate. For MakeDynamicFunction it may have any number of elements that are joined on comma to form source text for FormalParameters followed by a body.
 Note 2
goal is the production which will be used to parse the last element of args. For example, if called via %Function% it might be the grammar symbol FunctionBody[~Yield, ~Await] and from %eval% it might be the grammar symbol Script.

Implementations that stringify any element i of args where i ≠ 0 must stringify args[i-1] before stringifying args[i].

Implementations that stringify any element of args should return the stringified result in place of that element where that element informs part of the output.

Note 3
This avoids visible side-effects due to multiple stringification of user-defined objects as in: 
new Function(
  {
    toString() {
      console.log('parameter stringified');
      return 'x, y';
    }
  },
  {
    toString() {
      console.log('body stringified');
      return 'x + y';
    }
  });

Implementations must return a single element list when args has a single element and goal is ScriptBody.

Note 4
This avoids complicating PerformEval.

Changes to CreateDynamicFunction

CreateDynamicFunction waits until after it figures out what kind of function it is creating and uses the result of the adjusted host callout.

2Runtime Semantics: CreateDynamicFunction ( constructor, newTarget, kind, args )

The abstract operation CreateDynamicFunction is called with arguments constructor, newTarget, kind, and args. constructor is the constructor function that is performing this action, newTarget is the constructor that new was initially applied to, kind is either "normal", "generator", "async", or "async generator", and args is a List containing the actual argument values that were passed to constructor. The following steps are taken:

  1. Assert: The execution context stack has at least two elements.
  2. Let callerContext be the second to top element of the execution context stack.
  3. Let callerRealm be callerContext's Realm.
  4. Let calleeRealm be the current Realm Record.
  5. Perform ? HostEnsureCanCompileStrings(callerRealm, calleeRealm).
  6. If newTarget is undefined, set newTarget to constructor.
  7. If kind is "normal", then
    1. Let goal be the grammar symbol FunctionBody[~Yield, ~Await].
    2. Let parameterGoal be the grammar symbol FormalParameters[~Yield, ~Await].
    3. Let fallbackProto be "%FunctionPrototype%".
  8. Else if kind is "generator", then
    1. Let goal be the grammar symbol GeneratorBody.
    2. Let parameterGoal be the grammar symbol FormalParameters[+Yield, ~Await].
    3. Let fallbackProto be "%Generator%".
  9. Else if kind is "async", then
    1. Let goal be the grammar symbol AsyncFunctionBody.
    2. Let parameterGoal be the grammar symbol FormalParameters[~Yield, +Await].
    3. Let fallbackProto be "%AsyncFunctionPrototype%".
  10. Else,
    1. Assert: kind is "async generator".
    2. Let goal be the grammar symbol AsyncGeneratorBody.
    3. Let parameterGoal be the grammar symbol FormalParameters[+Yield, +Await].
    4. Let fallbackProto be "%AsyncGenerator%".
  11. Set args to ! HostBeforeCompileValue(callerRealm, calleeRealm, goal, args).
  12. Let argCount be the number of elements in args.
  13. Let P be the empty String.
  14. If argCount = 0, let bodyText be the empty String.
  15. Else if argCount = 1, let bodyText be args[0].
  16. Else argCount > 1,
    1. Let firstArg be args[0].
    2. Set P to ? ToString(firstArg).
    3. Let k be 1.
    4. Repeat, while k < argCount - 1
      1. Let nextArg be args[k].
      2. Let nextArgString be ? ToString(nextArg).
      3. Set P to the string-concatenation of the previous value of P, "," (a comma), and nextArgString.
      4. Increase k by 1.
    5. Let bodyText be args[k].
  17. Set bodyText to ? ToString(bodyText).
  18. Let parameters be the result of parsing P, interpreted as UTF-16 encoded Unicode text as described in 6.1.4, using parameterGoal as the goal symbol. Throw a SyntaxError exception if the parse fails.
  19. Let body be the result of parsing bodyText, interpreted as UTF-16 encoded Unicode text as described in 6.1.4, using goal as the goal symbol. Throw a SyntaxError exception if the parse fails.
  20. Let strict be ContainsUseStrict of body.
  21. If any static semantics errors are detected for parameters or body, throw a SyntaxError or a ReferenceError exception, depending on the type of the error. If strict is true, the Early Error rules for UniqueFormalParameters:FormalParameters are applied. Parsing and early error detection may be interweaved in an implementation-dependent manner.
  22. If strict is true and IsSimpleParameterList of parameters is false, throw a SyntaxError exception.
  23. If any element of the BoundNames of parameters also occurs in the LexicallyDeclaredNames of body, throw a SyntaxError exception.
  24. If body Contains SuperCall is true, throw a SyntaxError exception.
  25. If parameters Contains SuperCall is true, throw a SyntaxError exception.
  26. If body Contains SuperProperty is true, throw a SyntaxError exception.
  27. If parameters Contains SuperProperty is true, throw a SyntaxError exception.
  28. If kind is "generator" or "async generator", then
    1. If parameters Contains YieldExpression is true, throw a SyntaxError exception.
  29. If kind is "async" or "async generator", then
    1. If parameters Contains AwaitExpression is true, throw a SyntaxError exception.
  30. If strict is true, then
    1. If BoundNames of parameters contains any duplicate elements, throw a SyntaxError exception.
  31. Let proto be ? GetPrototypeFromConstructor(newTarget, fallbackProto).
  32. Let F be FunctionAllocate(proto, strict, kind).
  33. Let realmF be F.[[Realm]].
  34. Let scope be realmF.[[GlobalEnv]].
  35. Perform FunctionInitialize(F, Normal, parameters, body, scope).
  36. If kind is "generator", then
    1. Let prototype be ObjectCreate(%GeneratorPrototype%).
    2. Perform DefinePropertyOrThrow(F, "prototype", PropertyDescriptor { [[Value]]: prototype, [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: false }).
  37. Else if kind is "async generator", then
    1. Let prototype be ObjectCreate(%AsyncGeneratorPrototype%).
    2. Perform DefinePropertyOrThrow(F, "prototype", PropertyDescriptor { [[Value]]: prototype, [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: false }).
  38. Else if kind is "normal", perform MakeConstructor(F).
  39. NOTE: Async functions are not constructable and do not have a [[Construct]] internal method or a "prototype" property.
  40. Perform SetFunctionName(F, "anonymous").
  41. Let prefix be the prefix associated with kind in .
  42. Let sourceText be the string-concatenation of prefix, " anonymous(", P, 0x000A (LINE FEED), ") {", 0x000A (LINE FEED), bodyText, 0x000A (LINE FEED), and "}".
  43. Set F.[[SourceText]] to sourceText.
  44. Return F.

Changes to eval

%eval% uses the adjusted host callout and finds the source text in its result.

3eval ( x )

The eval function is the %eval% intrinsic object. When the eval function is called with one argument x, the following steps are taken:

  1. Assert: The execution context stack has at least two elements.
  2. Let callerContext be the second to top element of the execution context stack.
  3. Let callerRealm be callerContext's Realm.
  4. Let calleeRealm be the current Realm Record.
  5. Let args be a list containing only x.
  6. Perform ? HostEnsureCanCompileStrings(callerRealm, calleeRealm).
    Set args to ! HostBeforeCompileValue(callerRealm, calleeRealm, Script, args).
  7. Set x to ? Get(args, 0).
  8. Return ? PerformEval(x, calleeRealm, false, false).

Changes to direct eval

Direct eval uses the adjusted host callout and finds the source text in its result.

4Runtime Semantics: Evaluation

CallExpression:CoverCallExpressionAndAsyncArrowHead
  1. Let expr be CoveredCallExpression of CoverCallExpressionAndAsyncArrowHead.
  2. Let memberExpr be the MemberExpression of expr.
  3. Let arguments be the Arguments of expr.
  4. Let ref be the result of evaluating memberExpr.
  5. Let func be ? GetValue(ref).
  6. If Type(ref) is Reference and IsPropertyReference(ref) is false and GetReferencedName(ref) is "eval", then
    1. If SameValue(func, %eval%) is true, then
      1. Let argList be ? ArgumentListEvaluation of arguments.
      2. If argList has no elements, return undefined.
      3. Let evalText be the first element of argList.
      4. If the source code matching this CallExpression is strict mode code, let strictCaller be true. Otherwise let strictCaller be false.
      5. Let evalRealm be the current Realm Record.
      6. Let args be a list containing only evalText.
      7. Perform ? HostEnsureCanCompileStrings(evalRealm, evalRealm).
        Set args to ! HostBeforeCompileValue(evalRealm, evalRealm, Script, args).
      8. Set evalText to ? Get(args, 0).
      9. Return ? PerformEval(evalText, evalRealm, strictCaller, true).
  7. Let thisCall be this CallExpression.
  8. Let tailCall be IsInTailPosition(thisCall).
  9. Return ? EvaluateCall(func, ref, arguments, tailCall).

A CallExpression evaluation that executes step 6.a.ixvii is a direct eval.

ACopyright & Software License

Copyright Notice

© 2019 Mike Samuel

Software License

All Software contained in this document ("Software") is protected by copyright and is being made available under the "BSD License", included below. This Software may be subject to third party rights (rights from parties other than Ecma International), including patent rights, and no licenses under such third party rights are granted under this license even if the third party concerned is a member of Ecma International. SEE THE ECMA CODE OF CONDUCT IN PATENT MATTERS AVAILABLE AT https://ecma-international.org/memento/codeofconduct.htm FOR INFORMATION REGARDING THE LICENSING OF PATENT CLAIMS THAT ARE REQUIRED TO IMPLEMENT ECMA INTERNATIONAL STANDARDS.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  3. Neither the name of the authors nor Ecma International may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE ECMA INTERNATIONAL "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ECMA INTERNATIONAL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.