Normative: Provide source text to HostEnsureCanCompileStrings #3222

ptomato · 2023-11-16T01:57:48Z

This is based on Mike Samuel's work in #1498, but ultimately goes in a different direction. Due to #2670, this change can be made simpler than it previously was.

This change provides the source text to be evaluated, and the grammar symbol that should be used to parse it, to the host hook HostEnsureCanCompileStrings.

One example of where this is needed is for allowing a Content Security Policy to provide hashes for code executed via eval() or new Function():
w3c/webappsec-csp#623
This is useful on its own, but has come up again in the topic of ShadowRealm-HTML integration. In a ShadowRealm you can either execute code asynchronously, with ShadowRealm.p.importValue, or synchronously, with ShadowRealm.p.evaluate. Because the latter uses eval() inside the ShadowRealm, it's subject to CSP rules, so the only CSP policy that will let you execute synchronously in the realm is unsafe-eval.

~~The original purpose of #1498 was to support Trusted Types, which is still a goal of this PR.~~

This is a separate needs-consensus PR, rather than being part of the ShadowRealm proposal, because it's useful independently of ShadowRealm, and also ShadowRealm would go forward regardless of whether this goes forward.

Prior art: https://github.com/tc39/proposal-dynamic-code-brand-checks

ptomato · 2023-11-16T02:00:05Z

cc @mikesamuel

spec.html

ptomato · 2023-11-29T01:02:25Z

Updated to reflect the consensus in TC39 plenary of 2023-11-27:

eval() and friends pass their argument to HostEnsureCanCompileStrings
new Function() and friends pass their unstringified argument to HostEnsureCanCompileStrings, only if there is a single argument. If there is more than one argument, the previous behaviour is maintained.
In the case of direct eval, we inform HostEnsureCanCompileStrings of this.

caridy · 2023-11-29T03:54:05Z

thanks for the update @ptomato, this is looking good!

spec.html

ptomato · 2023-11-29T23:10:39Z

I've updated this to reflect the option that had the most support in today's plenary meeting: passing the body string to the host hook after stringifying it.

(I've also removed the references to #1498 from the commit message and reset the author; this PR no longer subsumes the goal of #1498, and in fact has ship-of-Theseus'ed so that it now contains nothing from the original)

cc @erights for further discussion

spec.html

nicolo-ribaudo · 2023-12-06T19:39:17Z

Note that Firefox, Safari and Chrome already implement Option 2. Test case:

<html>
<head>
  <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
</head>
<script>
new Function({
  toString: () => {
    console.log("Should not happen");
    return "return 2"
  },
});
</script>
</html>

All the three browsers log before throwing.

The observable change introduced my option 2 would thus just be matching web reality :)

bakkot · 2023-12-06T20:00:39Z

For posterity, "option 2" refers to this slide.

nicolo-ribaudo

(note: do not merge yet because we haven't had the chance to talk about this with MM, which he asked to do before merging)

spec.html

jmdyck

Looks okay to me.

ptomato · 2024-02-07T01:02:51Z

@tc39/ecma262-editors I realized this one wasn't in the list of things that would be added before ES2024 is cut. But I believe all of the discussions have been resolved, is there anything else preventing it from making the cut?

) This change provides the source text to be evaluated, and the grammar symbol that should be used to parse it, to the host hook HostEnsureCanCompileStrings. One example of where this is needed is for allowing a Content Security Policy to provide hashes for code executed via `eval()` or `new Function()`: w3c/webappsec-csp#623 This is useful on its own, but has come up again in the topic of ShadowRealm-HTML integration. In a ShadowRealm you can either execute code asynchronously, with ShadowRealm.p.importValue, or synchronously, with ShadowRealm.p.evaluate. Because the latter uses `eval()` inside the ShadowRealm, it's subject to CSP rules, so the only CSP policy that will let you execute synchronously in the realm is `unsafe-eval`. This is a separate needs-consensus PR, rather than being part of the ShadowRealm proposal, because it's useful independently of ShadowRealm, and also ShadowRealm would go forward regardless of whether this goes forward. Prior art: https://github.com/tc39/proposal-dynamic-code-brand-checks

changes addressed

As of tc39/ecma262#3222 the signature of HostEnsureCanCompileStrings changed. This adapts to the new signature by pulling in the latest version of ecma262-biblio and adding the missing arguments. Closes: tc39#367

As of tc39/ecma262#3222 the signature of HostEnsureCanCompileStrings changed. This adapts to the new signature by pulling in the latest version of ecma262-biblio and adding the missing arguments. Closes: #367

…changed. This updates the README to reflect the current state.

…changed. This updates the spec to better reflect the current state.

…changed. This updates the spec to better reflect the current state. This also updates the README accordingly.

ptomato mentioned this pull request Nov 16, 2023

Provide HostEnsureCanCompileString implementors more context #1498

Open

ljharb reviewed Nov 16, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

spec.html Outdated Show resolved Hide resolved

jmdyck previously requested changes Nov 16, 2023

View reviewed changes

ptomato force-pushed the source-text-hostensurecancompilestrings branch from d07cd69 to 8b2f141 Compare November 16, 2023 19:41

ptomato requested a review from jmdyck November 16, 2023 19:48

jmdyck reviewed Nov 16, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

spec.html Outdated Show resolved Hide resolved

spec.html Outdated Show resolved Hide resolved

ptomato force-pushed the source-text-hostensurecancompilestrings branch 2 times, most recently from 2a8a0a0 to a4dbfc8 Compare November 17, 2023 18:42

michaelficarra reviewed Nov 21, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

ptomato force-pushed the source-text-hostensurecancompilestrings branch 2 times, most recently from 9659303 to a0c6261 Compare November 29, 2023 00:59

nicolo-ribaudo reviewed Nov 29, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

spec.html Outdated Show resolved Hide resolved

ptomato force-pushed the source-text-hostensurecancompilestrings branch from a0c6261 to e149547 Compare November 29, 2023 23:05

michaelficarra reviewed Nov 29, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

michaelficarra reviewed Nov 29, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

ptomato force-pushed the source-text-hostensurecancompilestrings branch from e149547 to 82fc88b Compare November 30, 2023 17:22

michaelficarra reviewed Nov 30, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

ptomato force-pushed the source-text-hostensurecancompilestrings branch from 82fc88b to f3bc8eb Compare November 30, 2023 17:37

michaelficarra approved these changes Nov 30, 2023

View reviewed changes

caridy mentioned this pull request Dec 5, 2023

Finalize the integrations that guard eval & Function.constructor w3c/trusted-types#207

Closed

syg approved these changes Dec 6, 2023

View reviewed changes

nicolo-ribaudo suggested changes Dec 7, 2023

View reviewed changes

michaelficarra reviewed Dec 14, 2023

View reviewed changes

spec.html Outdated Show resolved Hide resolved

ptomato force-pushed the source-text-hostensurecancompilestrings branch from 1ebabde to db61ea2 Compare December 14, 2023 16:29

bakkot reviewed Jan 8, 2024

View reviewed changes

spec.html Outdated Show resolved Hide resolved

jmdyck reviewed Jan 8, 2024

View reviewed changes

ptomato force-pushed the source-text-hostensurecancompilestrings branch from 639273d to af086c8 Compare January 9, 2024 01:08

nicolo-ribaudo added the has consensus This has committee consensus. label Feb 5, 2024

nicolo-ribaudo mentioned this pull request Feb 5, 2024

HostEnsureCanCompileStrings takes only one argument tc39/proposal-shadowrealm#367

Closed

michaelficarra added the es2024 to be landed before es2024 label Feb 7, 2024

bakkot approved these changes Feb 9, 2024

View reviewed changes

michaelficarra added the ready to merge Editors believe this PR needs no further reviews, and is ready to land. label Feb 9, 2024

ljharb force-pushed the source-text-hostensurecancompilestrings branch from af086c8 to b07ca06 Compare February 14, 2024 05:28

ljharb merged commit b07ca06 into tc39:main Feb 14, 2024
7 checks passed

ptomato mentioned this pull request Feb 15, 2024

Editorial: Adapt to new HostEnsureCanCompileStrings tc39/proposal-shadowrealm#400

Merged

lukewarlow added a commit to lukewarlow/proposal-dynamic-code-brand-checks that referenced this pull request Feb 20, 2024

As of tc39/ecma262#3222 the signature of HostEnsureCanCompileStrings …

9283e94

…changed. This updates the README to reflect the current state.

lukewarlow mentioned this pull request Feb 20, 2024

Update README to match current HostEnsureCanCompileStrings definition. tc39/proposal-dynamic-code-brand-checks#9

Closed

lukewarlow added a commit to lukewarlow/proposal-dynamic-code-brand-checks that referenced this pull request Feb 20, 2024

As of tc39/ecma262#3222 the signature of HostEnsureCanCompileStrings …

2f7bfc8

…changed. This updates the spec to better reflect the current state.

lukewarlow mentioned this pull request Feb 20, 2024

Update the spec based on recent HostEnsureCanCompileStrings changes tc39/proposal-dynamic-code-brand-checks#10

Merged

lukewarlow mentioned this pull request Feb 21, 2024

Integration with Shadow Realms? w3c/trusted-types#442

Open

This was referenced Feb 22, 2024

Change HostEnsureCanCompileStrings to the new spec boa-dev/boa#3690

Merged

Fix incorrect tests for CreateDynamicFunction tc39/test262#4013

Closed

This was referenced Feb 22, 2024

Include the string to be compiled in the call to HostEnsureCanCompileStrings #938

Open

Normative: Restore params/body ToString order in new Function #3288

Merged

lukewarlow mentioned this pull request Mar 8, 2024

Normative: Allow CodeLike object evaluation #3294

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Normative: Provide source text to HostEnsureCanCompileStrings #3222

Normative: Provide source text to HostEnsureCanCompileStrings #3222

ptomato commented Nov 16, 2023 •

edited

Loading

ptomato commented Nov 16, 2023

ptomato commented Nov 29, 2023

caridy commented Nov 29, 2023

ptomato commented Nov 29, 2023

nicolo-ribaudo commented Dec 6, 2023 •

edited

Loading

bakkot commented Dec 6, 2023

nicolo-ribaudo left a comment •

edited

Loading

jmdyck left a comment

ptomato commented Feb 7, 2024

Normative: Provide source text to HostEnsureCanCompileStrings #3222

Normative: Provide source text to HostEnsureCanCompileStrings #3222

Conversation

ptomato commented Nov 16, 2023 • edited Loading

ptomato commented Nov 16, 2023

ptomato commented Nov 29, 2023

caridy commented Nov 29, 2023

ptomato commented Nov 29, 2023

nicolo-ribaudo commented Dec 6, 2023 • edited Loading

bakkot commented Dec 6, 2023

nicolo-ribaudo left a comment • edited Loading

Choose a reason for hiding this comment

jmdyck left a comment

Choose a reason for hiding this comment

ptomato commented Feb 7, 2024

ptomato commented Nov 16, 2023 •

edited

Loading

nicolo-ribaudo commented Dec 6, 2023 •

edited

Loading

nicolo-ribaudo left a comment •

edited

Loading