Bug 263187

Summary:	Make all senstitive $vm properties not enumerable by Object.getOwnPropertyNames.
Product:	WebKit	Reporter:	Mark Lam <mark.lam>
Component:	JavaScriptCore	Assignee:	Mark Lam <mark.lam>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Mark Lam 2023-10-16 00:08:28 PDT

$vm functions are not meant to be enumerable.  That's why all of them have the DontEnum attribute.  However, Object.getOwnPropertyNames does not honor this by default.  As a result, this can trip up fuzzers that happens to enumerate it with Object.getOwnPropertyNames.

rdar://112814894

Comment 1 Mark Lam 2023-10-16 00:20:01 PDT

Pull request: https://github.com/WebKit/WebKit/pull/19104

Comment 2 EWS 2023-10-16 07:28:47 PDT

Committed 269361@main (86513355ed9f): <https://commits.webkit.org/269361@main>

Reviewed commits have been landed. Closing PR #19104 and removing active labels.