Bypassing AllowReflection = false via exceptions

[MissyMelissa]

It looks like it's possible to bypass AllowReflection = false via exceptions. Here is a very basic example that demonstrates the problem:

using System;
using Microsoft.ClearScript.V8;

namespace ClearScriptTest2
{
	public class Test
	{
	}

	class Program
	{
		static void Main(string[] args)
		{
			using (var engine = new V8ScriptEngine()) {
				engine.AddHostType("Console", typeof(Console));
				engine.AddHostObject("test", new Test());
				engine.AllowReflection = false;

				engine.Execute("try { test.GetType(); } catch (ex) { Console.WriteLine(ex.hostException.GetType().Assembly.FullName); }");
			}

			Console.ReadLine();
		}
	}
}

The first GetType() will throw an exception (and it is caught by javascript), but the second ex.hostException.GetType() does not throw an exception.

[ClearScriptLib]

Nice find! The problem is that ClearScript traps Object.GetType but not Exception.GetType.

[Rene-Sackers]

@ClearScriptLib I assume you're overriding GetType on that exception, maybe check if the calling method is an override of Object.GetType using this on this?

[ClearScriptLib]

@Rene-Sackers Exception.GetType isn't an override of Object.GetType; in fact, the latter isn't virtual. Exception.GetType is an implementation of an interface method (_Exception.GetType). It calls Object.GetType internally, but otherwise the methods are unrelated. Our fix simply blocks all three.

[MissyMelissa]

Thank you for the quick fix!

[Rene-Sackers]

Cool! One more question though.

Shouldn't all these be checked/blocked, in case any are exposed through AddHostType? It might be irrelevant, only a question/suggestion :)

[ClearScriptLib]

@Rene-Sackers You make a good point, but most of the remaining GetType methods are reachable only if the script has already gained access to a reflection object. We also don't expect hosts to expose JScript.NET internals for scripting. AppDomain is an interesting case, but Object and Exception should cover most things likely to be made scriptable.