├── src ├── util │ ├── EncapsulationAnalysis │ │ ├── NewVersion │ │ │ ├── Tests │ │ │ │ ├── Cajita │ │ │ │ │ ├── cajitamin │ │ │ │ │ ├── test.js │ │ │ │ │ └── a.out │ │ │ │ ├── test20.js │ │ │ │ ├── test15.js │ │ │ │ ├── test13.js │ │ │ │ ├── test14.js │ │ │ │ ├── nativeTest1.js │ │ │ │ ├── test16.js │ │ │ │ ├── test23.js │ │ │ │ ├── globalVarTest2.js │ │ │ │ ├── test3.js │ │ │ │ ├── globalVarTest1.js │ │ │ │ ├── globalVarTest3.js │ │ │ │ ├── test6.js │ │ │ │ ├── test11.js │ │ │ │ ├── test19.js │ │ │ │ ├── test17.js │ │ │ │ ├── test18.js │ │ │ │ ├── test21.js │ │ │ │ ├── test12.js │ │ │ │ ├── AdsafeTests │ │ │ │ │ ├── test3.js │ │ │ │ │ ├── adsafeAnnTest2.js │ │ │ │ │ ├── test18.js │ │ │ │ │ ├── adsafeAnn2.js │ │ │ │ │ ├── adsafeAnnTest2Result │ │ │ │ │ ├── adsafeAnntes2Result │ │ │ │ │ └── adsafeAnntes3Result │ │ │ │ ├── test2.js │ │ │ │ ├── primTest1.js │ │ │ │ ├── provenanceTest1.js │ │ │ │ ├── test10.js │ │ │ │ ├── test4.js │ │ │ │ ├── provenanceTest2.js │ │ │ │ ├── test5.js │ │ │ │ ├── globalVarTest4.js │ │ │ │ ├── throwTest1.js │ │ │ │ ├── test1.js │ │ │ │ ├── test8.js │ │ │ │ ├── protoTest1.js │ │ │ │ ├── arrLengthTest1.js │ │ │ │ ├── test9.js │ │ │ │ ├── test7.js │ │ │ │ ├── table.js │ │ │ │ ├── runTestOld │ │ │ │ ├── CajitaTests │ │ │ │ │ ├── cajita.js │ │ │ │ │ └── cajita41.js │ │ │ │ ├── SealerUnsealer │ │ │ │ │ ├── suBroken.js │ │ │ │ │ └── suFixed.js │ │ │ │ ├── Mint │ │ │ │ │ └── mint.js │ │ │ │ └── PhuPhung │ │ │ │ │ ├── enfPolicyWorks.js │ │ │ │ │ └── enfPolicy.js │ │ │ ├── runTests │ │ │ ├── preciousDatalog.js │ │ │ ├── preciousDatalogAdsafe.js │ │ │ ├── preciousInverseDatalog.js │ │ │ └── datalogFieldNames.js │ │ └── datalogFieldNames.js │ └── sets.js ├── traits │ ├── Traits.png │ ├── README.md │ └── evolution-problem.js ├── ses │ ├── strict-debug-bug.html │ ├── amdTest1.js │ ├── amdTestDir │ │ └── amdTest2.js │ ├── amdTest.js │ ├── ses-usage-eval.js │ ├── amdTest3.js │ ├── ses-usage.js │ ├── contract │ │ ├── makeMint.es7 │ │ ├── makeMint.js │ │ ├── escrowExchange.es7 │ │ └── escrowExchange.js │ ├── hookupSES.js │ ├── hookupSESPlus.js │ ├── StringMap.js │ └── contractTest.js ├── q │ ├── Queue-harmony.js │ └── Queue.js └── proxies │ ├── testDirectProxies.html │ └── testFixedTrappingProxy.html ├── doc ├── esop13 │ ├── common.bib │ ├── llncs.doc │ ├── llncs.dvi │ ├── 5players.pdf │ ├── bw-mint.pdf │ ├── llncsdoc.pdf │ ├── cyclic-circuit.pdf │ ├── sprmindx.sty │ ├── remreset.sty │ ├── readme.txt │ └── llncsdoc.sty ├── proxies │ ├── MetaLevelShifting.png │ ├── bm │ │ ├── Proxies vs No Proxies BM.csv │ │ └── Proxies Benchmark.csv │ └── revocableRefManual.js ├── es5-states │ ├── es5-attr-states.odg │ ├── es5-attr-states.pdf │ └── es5-attr-states.png └── proxies-final │ ├── MetaLevelShifting.png │ ├── bm │ ├── Proxies vs No Proxies BM.csv │ └── Proxies Benchmark.csv │ └── revocableRefManual.js ├── site └── traits │ ├── images │ ├── download.png │ ├── header_bg.png │ ├── content_top.png │ └── content_bottom.png │ ├── sidebar.css │ ├── prettify.css │ └── test.html ├── tests ├── harmony │ ├── gentests │ ├── README │ ├── genhtmltests │ ├── TestCases │ │ ├── trap-arguments │ │ │ ├── util.js │ │ │ ├── fix.js │ │ │ ├── has.js │ │ │ ├── delete.js │ │ │ ├── hasOwn.js │ │ │ ├── enumerateOwn.js │ │ │ ├── get.js │ │ │ ├── set.js │ │ │ ├── enumerate.js │ │ │ ├── getOwnPropertyNames.js │ │ │ ├── defineProperty.js │ │ │ ├── getOwnPropertyDescriptor.js │ │ │ ├── getPropertyDescriptor.js │ │ │ └── invoke.js │ │ ├── doublelifting │ │ │ ├── fix.js │ │ │ ├── has.js │ │ │ ├── delete.js │ │ │ ├── hasOwn.js │ │ │ ├── enumerateOwn.js │ │ │ ├── set.js │ │ │ ├── get.js │ │ │ ├── enumerate.js │ │ │ ├── invoke.js │ │ │ ├── getOwnPropertyNames.js │ │ │ ├── defineProperty.js │ │ │ ├── getOwnPropertyDescriptor.js │ │ │ ├── getPropertyDescriptor.js │ │ │ └── util.js │ │ ├── defaultProto.js │ │ ├── trap-throws │ │ │ ├── get.js │ │ │ ├── fix.js │ │ │ ├── has.js │ │ │ ├── set.js │ │ │ ├── delete.js │ │ │ ├── invoke.js │ │ │ ├── enumerate.js │ │ │ ├── hasOwn.js │ │ │ ├── enumerateOwn.js │ │ │ ├── defineProperty.js │ │ │ ├── getOwnPropertyNames.js │ │ │ ├── util.js │ │ │ ├── getOwnPropertyDescriptor.js │ │ │ └── getPropertyDescriptor.js │ │ ├── invoke.js │ │ ├── denyfix.js │ │ ├── fixidentity.js │ │ ├── invokeDelegator.js │ │ ├── constructor.js │ │ ├── functionproxies.js │ │ └── handlersharing.js │ ├── license.html │ └── example.js ├── parser │ ├── unit.js │ └── parsertests.html └── unit.js ├── run-parser-tests.js ├── ProjectHome.md ├── load-ometa.js ├── SecureableES5.md ├── Makefile ├── SecureEcmaScript.md └── SafeMashups.md /src/util/EncapsulationAnalysis/NewVersion/Tests/Cajita/cajitamin: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/Cajita/test.js: -------------------------------------------------------------------------------- 1 | var a = 10 2 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test20.js: -------------------------------------------------------------------------------- 1 | attacker = this 2 | -------------------------------------------------------------------------------- /doc/esop13/common.bib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/common.bib -------------------------------------------------------------------------------- /doc/esop13/llncs.doc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/llncs.doc -------------------------------------------------------------------------------- /doc/esop13/llncs.dvi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/llncs.dvi -------------------------------------------------------------------------------- /src/traits/Traits.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/src/traits/Traits.png -------------------------------------------------------------------------------- /doc/esop13/5players.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/5players.pdf -------------------------------------------------------------------------------- /doc/esop13/bw-mint.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/bw-mint.pdf -------------------------------------------------------------------------------- /doc/esop13/llncsdoc.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/llncsdoc.pdf -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test15.js: -------------------------------------------------------------------------------- 1 | attacker = Object.prototype.toString 2 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test13.js: -------------------------------------------------------------------------------- 1 | attacker = {a: function reachable(){}} 2 | -------------------------------------------------------------------------------- /src/traits/README.md: -------------------------------------------------------------------------------- 1 | The latest version of traits.js lives [here](https://github.com/traitsjs/traits.js). -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test14.js: -------------------------------------------------------------------------------- 1 | Array.prototype.concat(document); 2 | 3 | 4 | -------------------------------------------------------------------------------- /doc/esop13/cyclic-circuit.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/esop13/cyclic-circuit.pdf -------------------------------------------------------------------------------- /site/traits/images/download.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/site/traits/images/download.png -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/nativeTest1.js: -------------------------------------------------------------------------------- 1 | var a = new Array(); 2 | 3 | //attacker = a 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test16.js: -------------------------------------------------------------------------------- 1 | Object.prototype.hasOwnProperty(document); 2 | 3 | -------------------------------------------------------------------------------- /doc/proxies/MetaLevelShifting.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/proxies/MetaLevelShifting.png -------------------------------------------------------------------------------- /site/traits/images/header_bg.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/site/traits/images/header_bg.png -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test23.js: -------------------------------------------------------------------------------- 1 | window[a] = function(){precious}; 2 | 3 | attacker = 0; 4 | -------------------------------------------------------------------------------- /doc/es5-states/es5-attr-states.odg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/es5-states/es5-attr-states.odg -------------------------------------------------------------------------------- /doc/es5-states/es5-attr-states.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/es5-states/es5-attr-states.pdf -------------------------------------------------------------------------------- /doc/es5-states/es5-attr-states.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/es5-states/es5-attr-states.png -------------------------------------------------------------------------------- /doc/esop13/sprmindx.sty: -------------------------------------------------------------------------------- 1 | delim_0 "\\idxquad " 2 | delim_1 "\\idxquad " 3 | delim_2 "\\idxquad " 4 | delim_n ",\\," 5 | -------------------------------------------------------------------------------- /site/traits/images/content_top.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/site/traits/images/content_top.png -------------------------------------------------------------------------------- /site/traits/sidebar.css: -------------------------------------------------------------------------------- 1 | /* this is the default float for the sidebar */ 2 | #sidebarContainer { 3 | float: right; 4 | } -------------------------------------------------------------------------------- /site/traits/images/content_bottom.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/site/traits/images/content_bottom.png -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/globalVarTest2.js: -------------------------------------------------------------------------------- 1 | a = function NOTreachable(){} 2 | 3 | attacker = window.b 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test3.js: -------------------------------------------------------------------------------- 1 | attacker = function reachable1(){return function reachble2(){}} 2 | -------------------------------------------------------------------------------- /doc/proxies-final/MetaLevelShifting.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/doc/proxies-final/MetaLevelShifting.png -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/globalVarTest1.js: -------------------------------------------------------------------------------- 1 | var a = function reachable(){} 2 | 3 | attacker = window.a 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/globalVarTest3.js: -------------------------------------------------------------------------------- 1 | window.a = function reachable(){} 2 | 3 | attacker = a; 4 | 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test6.js: -------------------------------------------------------------------------------- 1 | function foo(){return function reachable(){}} 2 | 3 | attacker = foo() 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test11.js: -------------------------------------------------------------------------------- 1 | a = {} 2 | a[$A$Num(b)] = function reachable(){} 3 | 4 | attacker = a[n] 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test19.js: -------------------------------------------------------------------------------- 1 | var o = {}; 2 | 3 | o.f(function precious(){}); 4 | 5 | attacker = ""; 6 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test17.js: -------------------------------------------------------------------------------- 1 | Object.prototype.hasOwnProperty(document); 2 | attacker = function (f,x){f(x)} 3 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test18.js: -------------------------------------------------------------------------------- 1 | Array.prototype.concat(document); 2 | 3 | attacker = function (f){return f();} 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test21.js: -------------------------------------------------------------------------------- 1 | var ___; 2 | attacker = (function(){___ = {mark: function NOTreachable(){} }})() 3 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test12.js: -------------------------------------------------------------------------------- 1 | a = {} 2 | a[$A$Num(b)] = function reachable(){} 3 | 4 | attacker = a[$A$NativeNot(n)] 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/test3.js: -------------------------------------------------------------------------------- 1 | Object.prototype.h__ = document; 2 | 3 | 4 | // document should NOT be reachable 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test2.js: -------------------------------------------------------------------------------- 1 | Object.prototype.toString = function reachable(){}; 2 | 3 | attacker = Object.prototype.toString 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/primTest1.js: -------------------------------------------------------------------------------- 1 | attacker = Array; 2 | 3 | // Comment out the isNative flag for the primNum entry of astNumberMap 4 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/provenanceTest1.js: -------------------------------------------------------------------------------- 1 | function foo(){return 10;} 2 | function bar(){return document;} 3 | 4 | attacker = [foo,bar] 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/Cajita/a.out: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/tvcutsem/es-lab/HEAD/src/util/EncapsulationAnalysis/NewVersion/Tests/Cajita/a.out -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test10.js: -------------------------------------------------------------------------------- 1 | a = {} 2 | a[0] = function reachable(){} 3 | 4 | a[1] = function reachable(){} 5 | 6 | attacker = a[$A$NativeNot(1)] 7 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test4.js: -------------------------------------------------------------------------------- 1 | a = {} 2 | 3 | a[$A$Num(b)] = function reachable(){}; 4 | 5 | attacker = a[0] 6 | 7 | // precious should be reachable 8 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/provenanceTest2.js: -------------------------------------------------------------------------------- 1 | function foo(){return 10;} 2 | function bar(){return [document, function xyz(){}];} 3 | 4 | attacker = [foo,bar] 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test5.js: -------------------------------------------------------------------------------- 1 | var a = {} 2 | var b = {toString: function(){a.foo = this.foo}, foo:function reachable(){}} 3 | c[b]; 4 | 5 | attacker = a 6 | 7 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/globalVarTest4.js: -------------------------------------------------------------------------------- 1 | window[$A$Native(c)] = function reachable(){} 2 | window[$A$Num(d)] = function NOTreachable(){} 3 | 4 | attacker = toString 5 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/throwTest1.js: -------------------------------------------------------------------------------- 1 | function f(g){ 2 | try{ 3 | g(); 4 | } 5 | catch(x){ 6 | x(function reachable(){}); 7 | } 8 | } 9 | 10 | attacker = f; 11 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test1.js: -------------------------------------------------------------------------------- 1 | a = {}; 2 | 3 | a['1'] = function NOTReachable(){}; 4 | 5 | a['getElementById'] = function reachable(){}; 6 | 7 | attacker = a[$A$NumNot(b)]; 8 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test8.js: -------------------------------------------------------------------------------- 1 | a = {} // This is an important line 2 | 3 | a[0] = function reachable(){} 4 | 5 | a[1] = function reachable(){} 6 | 7 | attacker = a[$A$Num(z)] 8 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/protoTest1.js: -------------------------------------------------------------------------------- 1 | var o = { ___nodes___: function reachable(){}}; 2 | 3 | function f(x){ 4 | 5 | x.g(x.___nodes___); 6 | 7 | } 8 | 9 | attacker = [f,o] 10 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/arrLengthTest1.js: -------------------------------------------------------------------------------- 1 | var o1 = {}; 2 | var o2 = {toString: function(){o1.b = this.foo; return 0;}, foo: function reachable(){}} 3 | var arr = []; 4 | 5 | arr.length = o2; 6 | 7 | attacker = o1; 8 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test9.js: -------------------------------------------------------------------------------- 1 | a = {} // This is an important line 2 | 3 | a[0] = function NOTreachable(){} 4 | 5 | a[1] = function NOTreachable(){} 6 | 7 | attacker = [a[$A$NumNot(1)], function reachable(){}] 8 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/adsafeAnnTest2.js: -------------------------------------------------------------------------------- 1 | 2 | function Bunch(nodes) { 3 | this.___Nodes___ = nodes; 4 | } 5 | 6 | 7 | 8 | attacker = new Bunch(document); 9 | 10 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/test7.js: -------------------------------------------------------------------------------- 1 | a = {} // This is an important line 2 | 3 | a[0] = function NOTreachable(){} 4 | 5 | a[1] = function reachable(){} 6 | 7 | attacker = a[1] 8 | 9 | // precious should not be reachable 10 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/test18.js: -------------------------------------------------------------------------------- 1 | 2 | function Bunch(nodes) { 3 | this.___Nodes___ = nodes; 4 | } 5 | 6 | 7 | 8 | attacker = new Bunch(document); 9 | //document should NOT be reachable 10 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/table.js: -------------------------------------------------------------------------------- 1 | var trustedTable = [function NOTreachable(){}]; 2 | 3 | attacker = { 4 | push: function reachable1(x){trustedTable.push(x);}, 5 | store: function reachable2(i,x){trustedTable[$A$Num(i)] = x;} 6 | } 7 | 8 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/runTests: -------------------------------------------------------------------------------- 1 | testsize=$1 2 | tests=`ls ./Tests/*.js` 3 | for testName in $tests 4 | do 5 | echo Running TEST $testName 6 | cat $testName 7 | echo '\n-------------' 8 | node v8analyzer.js $testName out -cloneNative >>dump 9 | cat out 10 | echo '\n\n******************************************' 11 | done 12 | 13 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/adsafeAnn2.js: -------------------------------------------------------------------------------- 1 | attacker = (function () { 2 | 3 | 4 | 5 | // Return the ADSAFE object. 6 | 7 | return [ 8 | function (array) { 9 | 10 | b = Array.prototype.concat(array.___nodes___); 11 | }, 12 | {___nodes___:[document]} 13 | ]; 14 | }()); 15 | 16 | 17 | -------------------------------------------------------------------------------- /src/ses/strict-debug-bug.html: -------------------------------------------------------------------------------- 1 | 2 |
3 |Turn on "Start Debugging JavaScript", open the JavaScript 4 | console, refresh, and then type "2+3" in the JavaScript console. 5 | If it shows an Error with an closed triangle, open the triangle to 6 | see the error. 7 | 13 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/adsafeAnnTest2Result: -------------------------------------------------------------------------------- 1 | (NOTES: 2 | (1) We map all functions to the corresponding declaration sites. Multiple instances of the same declaration site are shown as the same function 3 | (2) Native prototype functions and attacker created functions are not shown 4 | ) 5 | 6 | Functions and DOM objects that the attacker can potentially hold are: 7 | 8 | Total number of functions = 0 -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/adsafeAnntes2Result: -------------------------------------------------------------------------------- 1 | (NOTES: 2 | (1) We map all functions to the corresponding declaration sites. Multiple instances of the same declaration site are shown as the same function 3 | (2) Native prototype functions and attacker created functions are not shown 4 | ) 5 | 6 | Functions and DOM objects that the attacker can potentially hold are: 7 | 8 | Total number of functions = 0 -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/runTestOld: -------------------------------------------------------------------------------- 1 | testFileName='./Tests/test' 2 | outFileName='testOutput' 3 | #echo $testFileName 4 | count=1 5 | testsize=`expr $1 + 1` 6 | while [ $count -lt $testsize ] 7 | do 8 | testName=$testFileName$count.js 9 | echo Running TEST $testName 10 | cat $testName 11 | echo '\n-------------' 12 | node v8analyzer.js $testName out -cloneNative >>dump 13 | cat out 14 | echo '\n\n******************************************' 15 | count=`expr $count + 1` 16 | done 17 | 18 | -------------------------------------------------------------------------------- /site/traits/prettify.css: -------------------------------------------------------------------------------- 1 | .str{color:#080}.kwd{color:#008}.com{color:#800}.typ{color:#606}.lit{color:#066}.pun{color:#660}.pln{color:#000}.tag{color:#008}.atn{color:#606}.atv{color:#080}.dec{color:#606}pre.prettyprint{padding:2px;border:1px solid #888}@media print{.str{color:#060}.kwd{color:#006;font-weight:bold}.com{color:#600;font-style:italic}.typ{color:#404;font-weight:bold}.lit{color:#044}.pun{color:#440}.pln{color:#000}.tag{color:#006;font-weight:bold}.atn{color:#404}.atv{color:#060}} 2 | pre { 3 | font-size: 1.3em; 4 | } 5 | pre.prettyprint.noborder { 6 | border:none; 7 | padding-left: 20px; 8 | } -------------------------------------------------------------------------------- /tests/harmony/gentests: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | verbose='false' 3 | 4 | while getopts "vh" OPTION 5 | do 6 | case $OPTION in 7 | v) 8 | verbose='true' 9 | ;; 10 | h) 11 | echo 'usage: '$0' [-v]' 12 | exit 0 13 | ;; 14 | *) 15 | # unrecognized args, quit 16 | exit 0 17 | ;; 18 | esac 19 | done 20 | # Reset $@ 21 | #shift `echo $OPTIND-1 | bc` 22 | 23 | echo '// this file was generated by '$0 $@ 24 | echo 'load("consolerunner.js");' 25 | for file in `find TestCases -name '*.js'` 26 | do 27 | echo 'load("'$file'");' 28 | done 29 | echo 'ES5Harness.startTesting('$verbose');' 30 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/CajitaTests/cajita.js: -------------------------------------------------------------------------------- 1 | 2 | attacker = (function(global) { 3 | 4 | 5 | 6 | 7 | function readPub(obj, name) { 8 | 9 | return obj.c(); 10 | 11 | return obj[name]; 12 | 13 | } 14 | 15 | 16 | 17 | 18 | function enforceStaticPath(result) { 19 | 20 | 21 | 22 | enforceStaticPath(readPub(result)); 23 | 24 | } 25 | 26 | 27 | 28 | enforceStaticPath({}) 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | Object.prototype.___nodes___ = function precious(){}; 37 | 38 | 39 | })(); 40 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/CajitaTests/cajita41.js: -------------------------------------------------------------------------------- 1 | 2 | 3 | attacker = (function(global) { 4 | 5 | 6 | function hasOwnPropertyO(obj, name) { 7 | 8 | if ( obj[$A$AdsafeReject(name)] === obj) { return true; } 9 | } 10 | 11 | 12 | 13 | function handleGenericMethod(obj, name, func) { 14 | obj[$A$AdsafeReject(name)] = func 15 | } 16 | 17 | 18 | 19 | 20 | 21 | 22 | /// Object 23 | 24 | handleGenericMethod(Object.prototype, 'hasOwnProperty', 25 | function hasOwnPropertyHandler(name) { 26 | return hasOwnPropertyO(this, name); 27 | }); 28 | })(); 29 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/SealerUnsealer/suBroken.js: -------------------------------------------------------------------------------- 1 | function Brand() { 2 | var flag = false; 3 | var squirrel = null; 4 | 5 | return { 6 | seal: function(payload) { 7 | return function box() { 8 | squirrel = payload; 9 | flag = true; 10 | } 11 | box.toString = function() { 12 | return "(box)"; 13 | } 14 | }, 15 | unseal: function(box) { 16 | flag = false; 17 | squirrel = null; 18 | box(); 19 | if (!flag) { 20 | throw 'Invalid Box'; 21 | } 22 | return squirrel; 23 | } 24 | }; 25 | } 26 | 27 | 28 | 29 | var brand = Brand(); 30 | 31 | function precious(){} 32 | 33 | attacker = {go: function goFunction(){brand.unseal(brand.seal(precious))}, 34 | unseal: brand.unseal} 35 | 36 | 37 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/AdsafeTests/adsafeAnntes3Result: -------------------------------------------------------------------------------- 1 | (NOTES: 2 | (1) We map all functions to the corresponding declaration sites. Multiple instances of the same declaration site are shown as the same function 3 | (2) Native prototype functions and attacker created functions are not shown 4 | ) 5 | 6 | Functions and DOM objects that the attacker can potentially hold are: 7 | 8 | Line No: 238---(function (id,f){root=(document["getElementById"](id+" "));newroot=(make_root(root,id));dom=newroot[0];f(dom,adsafe_lib);adsafe_lib={}}) 9 | 10 | Line No: 216---(function (text){quest("",this["___nodes___"]);return {}}) 11 | 12 | Line No: 259---(function (name,f){if (!adsafe_id){return error()}adsafe_lib[($A$AdsafeRejectNot(name))]=(f(adsafe_lib))}) 13 | 14 | Total number of functions = 3 -------------------------------------------------------------------------------- /tests/harmony/README: -------------------------------------------------------------------------------- 1 | This ES-Harmony Test Suite is an adaptation of the ES5 Conformance Test Suite that can run in a stand-alone shell (i.e. doesn't require a browser). 2 | 3 | Writing tests 4 | ------------- 5 | Create *.js files adhering to the ES5 Conformance Test suite format in the TestCases subdirectory. See example.js for a skeleton unit test. 6 | Have a look at the bottom of the file consolerunner.js for a list of utility assertion functions. 7 | 8 | Running the tests 9 | ----------------- 10 | First, generate a file that loads all test code by invoking: 11 | gentests > tests.js 12 | 13 | To run the tests, simply load the generated file with your favorite javascript shell, e.g.: 14 | js tests.js 15 | 16 | The shell should support 'load(string)' and 'print(string)' globals. 17 | 18 | The gentests script accepts a single '-v' verbose option that will also print passing tests. -------------------------------------------------------------------------------- /doc/proxies/bm/Proxies vs No Proxies BM.csv: -------------------------------------------------------------------------------- 1 | Operation,TM - Proxies,TM + Proxies,Operation,Relative overhead 2 | delete,0.00042,0.00041,delete,0.97619047619048 3 | getPrototypeOf,0.00047,0.00046,getPrototypeOf,0.97872340425532 4 | construct,0.00061,0.0006,construct,0.98360655737705 5 | hasOwn,0.00081,0.00081,hasOwn,1 6 | get,0.00038,0.00038,get,1 7 | set,0.0004,0.0004,set,1 8 | enumerate,0.00158,0.00158,enumerate,1 9 | ===,0.00043,0.00043,===,1 10 | getOwnPropertyDescriptor,0.00148,0.0015,getOwnPropertyDescriptor,1.01351351351351 11 | invoke,0.00049,0.0005,invoke,1.02040816326531 12 | call,0.00047,0.00048,call,1.02127659574468 13 | enumerateOwn,0.0009,0.00092,enumerateOwn,1.02222222222222 14 | has,0.00041,0.00042,has,1.02439024390244 15 | typeof,0.00038,0.00039,typeof,1.02631578947368 16 | defineProperty,0.00101,0.00107,defineProperty,1.05940594059406 17 | instanceof,0.00049,0.00053,instanceof,1.08163265306122 -------------------------------------------------------------------------------- /doc/proxies-final/bm/Proxies vs No Proxies BM.csv: -------------------------------------------------------------------------------- 1 | Operation,TM - Proxies,TM + Proxies,Operation,Relative overhead 2 | delete,0.00042,0.00041,delete,0.97619047619048 3 | getPrototypeOf,0.00047,0.00046,getPrototypeOf,0.97872340425532 4 | construct,0.00061,0.0006,construct,0.98360655737705 5 | hasOwn,0.00081,0.00081,hasOwn,1 6 | get,0.00038,0.00038,get,1 7 | set,0.0004,0.0004,set,1 8 | enumerate,0.00158,0.00158,enumerate,1 9 | ===,0.00043,0.00043,===,1 10 | getOwnPropertyDescriptor,0.00148,0.0015,getOwnPropertyDescriptor,1.01351351351351 11 | invoke,0.00049,0.0005,invoke,1.02040816326531 12 | call,0.00047,0.00048,call,1.02127659574468 13 | enumerateOwn,0.0009,0.00092,enumerateOwn,1.02222222222222 14 | has,0.00041,0.00042,has,1.02439024390244 15 | typeof,0.00038,0.00039,typeof,1.02631578947368 16 | defineProperty,0.00101,0.00107,defineProperty,1.05940594059406 17 | instanceof,0.00049,0.00053,instanceof,1.08163265306122 -------------------------------------------------------------------------------- /src/ses/amdTest1.js: -------------------------------------------------------------------------------- 1 | // Copyright (C) 2011 Google Inc. 2 | // 3 | // Licensed under the Apache License, Version 2.0 (the "License"); 4 | // you may not use this file except in compliance with the License. 5 | // You may obtain a copy of the License at 6 | // 7 | // http://www.apache.org/licenses/LICENSE-2.0 8 | // 9 | // Unless required by applicable law or agreed to in writing, software 10 | // distributed under the License is distributed on an "AS IS" BASIS, 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | // See the License for the specific language governing permissions and 13 | // limitations under the License. 14 | 15 | /** 16 | * @fileoverview Trivial test of simple AMD loader. 17 | * Tests simple named case. No dependencies. 18 | * @requires define 19 | */ 20 | 21 | define('amdTest1', [], function() { 22 | "use strict"; 23 | 24 | return 'this'; 25 | }); 26 | -------------------------------------------------------------------------------- /src/ses/amdTestDir/amdTest2.js: -------------------------------------------------------------------------------- 1 | // Copyright (C) 2011 Google Inc. 2 | // 3 | // Licensed under the Apache License, Version 2.0 (the "License"); 4 | // you may not use this file except in compliance with the License. 5 | // You may obtain a copy of the License at 6 | // 7 | // http://www.apache.org/licenses/LICENSE-2.0 8 | // 9 | // Unless required by applicable law or agreed to in writing, software 10 | // distributed under the License is distributed on an "AS IS" BASIS, 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 | // See the License for the specific language governing permissions and 13 | // limitations under the License. 14 | 15 | /** 16 | * @fileoverview Trivial test of simple AMD loader. 17 | * Nested named module. No dependencies. 18 | * @requires define 19 | */ 20 | 21 | define('amdTestDir/amdTest2', [], function() { 22 | "use strict"; 23 | 24 | return ' is a '; 25 | }); 26 | -------------------------------------------------------------------------------- /src/util/EncapsulationAnalysis/NewVersion/Tests/SealerUnsealer/suFixed.js: -------------------------------------------------------------------------------- 1 | function Brand(){ 2 | var flag = false; 3 | var payload = null; 4 | 5 | return { 6 | seal: function (payloadToSeal){ 7 | function box(){ 8 | flag = true; 9 | payload = payloadToSeal; 10 | } 11 | box.toString = function(){return "(box)";} 12 | return box; 13 | }, 14 | unseal: function(box){ 15 | flag = false; 16 | payload = null; 17 | try{ 18 | box(); 19 | if (!flag) 20 | { throw 'Invalid Box'} 21 | else{ 22 | return payload; 23 | } 24 | }finally{ 25 | flag = false; 26 | payload = null; 27 | } 28 | } 29 | } 30 | }; 31 | 32 | var brand = Brand(); 33 | 34 | var box = brand.seal(function precious(){}); 35 | 36 | //attacker = [box,brand.seal] 37 | 38 | attacker = {go: function goFunction(){brand.unseal(brand.seal(precious))}, 39 | unseal: brand.unseal} 40 | -------------------------------------------------------------------------------- /site/traits/test.html: -------------------------------------------------------------------------------- 1 | 3 | 4 |
5 |