Issue 6819 - Shadow globals in snippets

test/snippets.js

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-present eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 176 matching lines @@
       {
         if (foo != expected)
           throw new Error("Value mismatch");
       };
     `
   ];
 
   let template = `
     "use strict";
     {
+      let globals = {};

[Manish Jethani, 2018/07/31 14:17:08]

This is copied and pasted from lib/snippets.js (it's getting a bit ridiculous
but I'd still keep it this way for now).

+
+      for (let name of typeof window != "undefined" ? Object.keys(window) : [])
+        globals[name] = null;
+
+      for (let name of typeof global != "undefined" ? Object.keys(global) : [])
+        globals[name] = null;
+
+      if (typeof browser != "undefined")
+      {
+        globals.browser = {
+          runtime: {
+            getURL: browser.runtime.getURL
+          }
+        };
+      }
+
+      if (typeof document != "undefined")
+      {
+        globals.document = new Proxy(document, {
+          get(target, property)
+          {
+            if (property == "defaultView")
+              return null;
+
+            let value = target[property];
+            if (typeof value == "function")
+              return value.bind(target);
+
+            return value;
+          }
+        });
+      }
+
       const libraries = ${JSON.stringify(libraries)};
 
       const script = {{{script}}};
 
       let imports = Object.create(null);
       for (let library of libraries)
-        new Function("exports", library)(imports);
+      {
+        let func = new Function("exports", ...Object.keys(globals), library);
+        func(imports, ...Object.keys(globals).map(key => globals[key]));
+      }
 
       for (let [name, ...args] of script)
       {
         if (Object.prototype.hasOwnProperty.call(imports, name))
         {
           let value = imports[name];
           if (typeof value == "function")
             value(...args);
         }
       }
@@ skipping 18 matching lines @@
   // couple of things to note here: (1) each library has its own variables;
   // (2) script execution is stateless, i.e. the values are not retained
   // between executions. In the example below, assertFoo does not find 456 but
   // it doesn't find 123 either. It's the initial value 0.
   new Function(
     compileScript("setFoo 456; assertFoo 0", [
       ...libraries, "let foo = 1; exports.setFoo = value => { foo = value; };"
     ])
   )();
 
+  // Test sandboxing.

[Manish Jethani, 2018/07/31 14:17:08]

This is where we test the sandboxing. The process object should be set to null
in the snippet so it cannot do anything evil.

+  test.throws(
+    new Function(
+      compileScript("do-evil", [
+        // The global process object is shadowed to null so this snippet throws
+        // an error.
+        "exports['do-evil'] = function() { process.pid; };"
+      ])
+    ),
+    TypeError,
+    "Cannot read property 'pid' of null"
+  );
+
   test.done();
 };