2020-03-20 20:28:31 +00:00
|
|
|
'use strict';
|
2016-03-18 18:51:02 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
const electron = require('electron');
|
|
|
|
const { BrowserWindow } = electron;
|
2020-06-23 03:32:45 +00:00
|
|
|
const { isSameOrigin } = process._linkedBinding('electron_common_v8_util');
|
2020-03-20 20:28:31 +00:00
|
|
|
const { ipcMainInternal } = require('@electron/internal/browser/ipc-main-internal');
|
|
|
|
const ipcMainUtils = require('@electron/internal/browser/ipc-main-internal-utils');
|
2020-04-21 20:23:00 +00:00
|
|
|
const { parseFeatures } = require('@electron/internal/common/parse-features-string');
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
const hasProp = {}.hasOwnProperty;
|
|
|
|
const frameToGuest = new Map();
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2017-05-17 20:37:23 +00:00
|
|
|
// Security options that child windows will always inherit from parent windows
|
|
|
|
const inheritedWebPreferences = new Map([
|
|
|
|
['contextIsolation', true],
|
|
|
|
['javascript', false],
|
2017-07-10 22:44:40 +00:00
|
|
|
['nativeWindowOpen', true],
|
2017-05-17 20:37:23 +00:00
|
|
|
['nodeIntegration', false],
|
2018-10-13 17:50:07 +00:00
|
|
|
['enableRemoteModule', false],
|
2017-07-10 23:23:04 +00:00
|
|
|
['sandbox', true],
|
2019-01-22 19:24:46 +00:00
|
|
|
['webviewTag', false],
|
2020-05-06 19:52:59 +00:00
|
|
|
['nodeIntegrationInSubFrames', false],
|
|
|
|
['enableWebSQL', false]
|
2020-03-20 20:28:31 +00:00
|
|
|
]);
|
2017-05-17 20:37:23 +00:00
|
|
|
|
2016-01-14 18:35:29 +00:00
|
|
|
// Copy attribute of |parent| to |child| if it is not defined in |child|.
|
2017-01-04 22:50:05 +00:00
|
|
|
const mergeOptions = function (child, parent, visited) {
|
|
|
|
// Check for circular reference.
|
2020-03-20 20:28:31 +00:00
|
|
|
if (visited == null) visited = new Set();
|
|
|
|
if (visited.has(parent)) return;
|
2017-01-04 22:50:05 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
visited.add(parent);
|
2017-01-04 22:50:05 +00:00
|
|
|
for (const key in parent) {
|
2020-03-20 20:28:31 +00:00
|
|
|
if (key === 'type') continue;
|
|
|
|
if (!hasProp.call(parent, key)) continue;
|
|
|
|
if (key in child && key !== 'webPreferences') continue;
|
2017-01-04 22:50:05 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
const value = parent[key];
|
2019-08-05 19:50:51 +00:00
|
|
|
if (typeof value === 'object' && !Array.isArray(value)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
child[key] = mergeOptions(child[key] || {}, value, visited);
|
2017-01-04 22:50:05 +00:00
|
|
|
} else {
|
2020-03-20 20:28:31 +00:00
|
|
|
child[key] = value;
|
2016-01-12 02:40:23 +00:00
|
|
|
}
|
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
visited.delete(parent);
|
2017-01-04 22:50:05 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return child;
|
|
|
|
};
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2016-01-14 18:35:29 +00:00
|
|
|
// Merge |options| with the |embedder|'s window's options.
|
2016-06-09 17:35:48 +00:00
|
|
|
const mergeBrowserWindowOptions = function (embedder, options) {
|
2016-10-07 00:45:13 +00:00
|
|
|
if (options.webPreferences == null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
options.webPreferences = {};
|
2016-10-07 00:45:13 +00:00
|
|
|
}
|
2016-01-12 02:40:23 +00:00
|
|
|
if (embedder.browserWindowOptions != null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
let parentOptions = embedder.browserWindowOptions;
|
2018-03-12 15:28:34 +00:00
|
|
|
|
|
|
|
// if parent's visibility is available, that overrides 'show' flag (#12125)
|
2020-07-06 17:50:03 +00:00
|
|
|
const win = BrowserWindow.fromWebContents(embedder);
|
2018-03-12 15:28:34 +00:00
|
|
|
if (win != null) {
|
2020-03-26 18:05:45 +00:00
|
|
|
parentOptions = {
|
|
|
|
...win.getBounds(),
|
|
|
|
...embedder.browserWindowOptions,
|
|
|
|
show: win.isVisible()
|
|
|
|
};
|
2018-03-12 15:28:34 +00:00
|
|
|
}
|
|
|
|
|
2016-01-14 18:35:29 +00:00
|
|
|
// Inherit the original options if it is a BrowserWindow.
|
2020-03-20 20:28:31 +00:00
|
|
|
mergeOptions(options, parentOptions);
|
2016-01-12 02:40:23 +00:00
|
|
|
} else {
|
2017-05-24 18:30:59 +00:00
|
|
|
// Or only inherit webPreferences if it is a webview.
|
2020-03-20 20:28:31 +00:00
|
|
|
mergeOptions(options.webPreferences, embedder.getLastWebPreferences());
|
2016-01-12 02:40:23 +00:00
|
|
|
}
|
2016-03-30 17:51:56 +00:00
|
|
|
|
2017-05-17 20:37:23 +00:00
|
|
|
// Inherit certain option values from parent window
|
2020-03-20 20:28:31 +00:00
|
|
|
const webPreferences = embedder.getLastWebPreferences();
|
2017-05-17 20:37:23 +00:00
|
|
|
for (const [name, value] of inheritedWebPreferences) {
|
2018-08-09 17:15:23 +00:00
|
|
|
if (webPreferences[name] === value) {
|
2020-03-20 20:28:31 +00:00
|
|
|
options.webPreferences[name] = value;
|
2017-05-17 20:37:23 +00:00
|
|
|
}
|
2017-04-21 17:59:33 +00:00
|
|
|
}
|
|
|
|
|
2020-01-06 21:23:03 +00:00
|
|
|
if (!webPreferences.nativeWindowOpen) {
|
|
|
|
// Sets correct openerId here to give correct options to 'new-window' event handler
|
2020-03-20 20:28:31 +00:00
|
|
|
options.webPreferences.openerId = embedder.id;
|
2020-01-06 21:23:03 +00:00
|
|
|
}
|
2016-09-29 13:43:40 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return options;
|
|
|
|
};
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2020-03-26 18:05:45 +00:00
|
|
|
const MULTIPART_CONTENT_TYPE = 'multipart/form-data';
|
|
|
|
const URL_ENCODED_CONTENT_TYPE = 'application/x-www-form-urlencoded';
|
|
|
|
function makeContentTypeHeader ({ contentType, boundary }) {
|
|
|
|
const header = `content-type: ${contentType};`;
|
|
|
|
if (contentType === MULTIPART_CONTENT_TYPE) {
|
|
|
|
return `${header} boundary=${boundary}`;
|
|
|
|
}
|
|
|
|
return header;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Figure out appropriate headers for post data.
|
|
|
|
const parseContentTypeFormat = function (postData) {
|
|
|
|
if (postData.length) {
|
|
|
|
// For multipart forms, the first element will start with the boundary
|
|
|
|
// notice, which looks something like `------WebKitFormBoundary12345678`
|
|
|
|
// Note, this regex would fail when submitting a urlencoded form with an
|
|
|
|
// input attribute of name="--theKey", but, uhh, don't do that?
|
|
|
|
const postDataFront = postData[0].bytes.toString();
|
|
|
|
const boundary = /^--.*[^-\r\n]/.exec(postDataFront);
|
|
|
|
if (boundary) {
|
|
|
|
return {
|
|
|
|
boundary: boundary[0].substr(2),
|
|
|
|
contentType: MULTIPART_CONTENT_TYPE
|
|
|
|
};
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// Either the form submission didn't contain any inputs (the postData array
|
|
|
|
// was empty), or we couldn't find the boundary and thus we can assume this is
|
|
|
|
// a key=value style form.
|
|
|
|
return {
|
|
|
|
contentType: URL_ENCODED_CONTENT_TYPE
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2016-09-16 11:33:02 +00:00
|
|
|
// Setup a new guest with |embedder|
|
2016-09-29 14:01:05 +00:00
|
|
|
const setupGuest = function (embedder, frameName, guest, options) {
|
2016-01-14 18:44:21 +00:00
|
|
|
// When |embedder| is destroyed we should also destroy attached guest, and if
|
|
|
|
// guest is closed by user then we should prevent |embedder| from double
|
|
|
|
// closing guest.
|
2020-03-20 20:28:31 +00:00
|
|
|
const guestId = guest.webContents.id;
|
2016-06-09 17:35:48 +00:00
|
|
|
const closedByEmbedder = function () {
|
2020-03-20 20:28:31 +00:00
|
|
|
guest.removeListener('closed', closedByUser);
|
|
|
|
guest.destroy();
|
|
|
|
};
|
2016-06-09 17:35:48 +00:00
|
|
|
const closedByUser = function () {
|
2020-03-20 20:28:31 +00:00
|
|
|
embedder._sendInternal('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_CLOSED_' + guestId);
|
|
|
|
embedder.removeListener('current-render-view-deleted', closedByEmbedder);
|
|
|
|
};
|
|
|
|
embedder.once('current-render-view-deleted', closedByEmbedder);
|
|
|
|
guest.once('closed', closedByUser);
|
2016-01-12 02:40:23 +00:00
|
|
|
if (frameName) {
|
2020-03-20 20:28:31 +00:00
|
|
|
frameToGuest.set(frameName, guest);
|
|
|
|
guest.frameName = frameName;
|
2016-03-24 20:15:04 +00:00
|
|
|
guest.once('closed', function () {
|
2020-03-20 20:28:31 +00:00
|
|
|
frameToGuest.delete(frameName);
|
|
|
|
});
|
2016-01-12 02:40:23 +00:00
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
return guestId;
|
|
|
|
};
|
2016-09-16 11:33:02 +00:00
|
|
|
|
|
|
|
// Create a new guest created by |embedder| with |options|.
|
2018-04-05 23:13:24 +00:00
|
|
|
const createGuest = function (embedder, url, referrer, frameName, options, postData) {
|
2020-03-20 20:28:31 +00:00
|
|
|
let guest = frameToGuest.get(frameName);
|
2016-09-16 11:33:02 +00:00
|
|
|
if (frameName && (guest != null)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
guest.loadURL(url);
|
|
|
|
return guest.webContents.id;
|
2016-09-16 11:33:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Remember the embedder window's id.
|
|
|
|
if (options.webPreferences == null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
options.webPreferences = {};
|
2016-09-16 11:33:02 +00:00
|
|
|
}
|
2016-09-29 13:43:40 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
guest = new BrowserWindow(options);
|
2018-12-05 08:03:39 +00:00
|
|
|
if (!options.webContents) {
|
2016-09-29 13:37:28 +00:00
|
|
|
// We should not call `loadURL` if the window was constructed from an
|
2018-12-05 08:03:39 +00:00
|
|
|
// existing webContents (window.open in a sandboxed renderer).
|
2016-09-29 13:37:28 +00:00
|
|
|
//
|
|
|
|
// Navigating to the url when creating the window from an existing
|
2018-12-05 08:03:39 +00:00
|
|
|
// webContents is not necessary (it will navigate there anyway).
|
2018-04-05 23:13:24 +00:00
|
|
|
const loadOptions = {
|
|
|
|
httpReferrer: referrer
|
2020-03-20 20:28:31 +00:00
|
|
|
};
|
2016-11-11 17:22:45 +00:00
|
|
|
if (postData != null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
loadOptions.postData = postData;
|
2020-03-26 18:05:45 +00:00
|
|
|
loadOptions.extraHeaders = makeContentTypeHeader(parseContentTypeFormat(postData));
|
2016-10-10 12:58:56 +00:00
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
guest.loadURL(url, loadOptions);
|
2016-09-29 13:37:28 +00:00
|
|
|
}
|
2016-06-09 17:35:48 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return setupGuest(embedder, frameName, guest, options);
|
|
|
|
};
|
2016-06-09 18:29:38 +00:00
|
|
|
|
2016-11-23 18:23:47 +00:00
|
|
|
const getGuestWindow = function (guestContents) {
|
2020-03-20 20:28:31 +00:00
|
|
|
let guestWindow = BrowserWindow.fromWebContents(guestContents);
|
2016-06-09 20:53:36 +00:00
|
|
|
if (guestWindow == null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
const hostContents = guestContents.hostWebContents;
|
2016-06-09 20:53:36 +00:00
|
|
|
if (hostContents != null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
guestWindow = BrowserWindow.fromWebContents(hostContents);
|
2016-06-09 20:53:36 +00:00
|
|
|
}
|
2016-06-09 18:29:38 +00:00
|
|
|
}
|
2019-07-08 23:43:49 +00:00
|
|
|
if (!guestWindow) {
|
2020-03-20 20:28:31 +00:00
|
|
|
throw new Error('getGuestWindow failed');
|
2019-07-08 23:43:49 +00:00
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
return guestWindow;
|
|
|
|
};
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2019-07-04 16:22:08 +00:00
|
|
|
const isChildWindow = function (sender, target) {
|
2020-03-20 20:28:31 +00:00
|
|
|
return target.getLastWebPreferences().openerId === sender.id;
|
|
|
|
};
|
2019-07-04 16:22:08 +00:00
|
|
|
|
|
|
|
const isRelatedWindow = function (sender, target) {
|
2020-03-20 20:28:31 +00:00
|
|
|
return isChildWindow(sender, target) || isChildWindow(target, sender);
|
|
|
|
};
|
2019-07-04 16:22:08 +00:00
|
|
|
|
|
|
|
const isScriptableWindow = function (sender, target) {
|
2020-03-20 20:28:31 +00:00
|
|
|
return isRelatedWindow(sender, target) && isSameOrigin(sender.getURL(), target.getURL());
|
|
|
|
};
|
2019-07-04 16:22:08 +00:00
|
|
|
|
|
|
|
const isNodeIntegrationEnabled = function (sender) {
|
2020-03-20 20:28:31 +00:00
|
|
|
return sender.getLastWebPreferences().nodeIntegration === true;
|
|
|
|
};
|
2019-07-04 16:22:08 +00:00
|
|
|
|
2016-11-15 08:45:34 +00:00
|
|
|
// Checks whether |sender| can access the |target|:
|
|
|
|
const canAccessWindow = function (sender, target) {
|
2020-03-24 02:34:52 +00:00
|
|
|
return isChildWindow(sender, target) ||
|
|
|
|
isScriptableWindow(sender, target) ||
|
|
|
|
isNodeIntegrationEnabled(sender);
|
2020-03-20 20:28:31 +00:00
|
|
|
};
|
2016-11-15 08:45:34 +00:00
|
|
|
|
2017-01-12 00:36:59 +00:00
|
|
|
// Routed window.open messages with raw options
|
2019-02-04 22:49:53 +00:00
|
|
|
ipcMainInternal.on('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_OPEN', (event, url, frameName, features) => {
|
2020-04-22 17:48:54 +00:00
|
|
|
// This should only be allowed for senders that have nativeWindowOpen: false
|
2020-04-22 18:06:30 +00:00
|
|
|
const lastWebPreferences = event.sender.getLastWebPreferences();
|
|
|
|
if (lastWebPreferences.nativeWindowOpen || lastWebPreferences.sandbox) {
|
2020-04-22 17:48:54 +00:00
|
|
|
event.returnValue = null;
|
|
|
|
throw new Error('GUEST_WINDOW_MANAGER_WINDOW_OPEN denied: expected native window.open');
|
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
if (url == null || url === '') url = 'about:blank';
|
|
|
|
if (frameName == null) frameName = '';
|
|
|
|
if (features == null) features = '';
|
2017-01-12 00:36:59 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
const disposition = 'new-window';
|
2020-04-21 20:23:00 +00:00
|
|
|
const { options, webPreferences, additionalFeatures } = parseFeatures(features);
|
|
|
|
if (!options.title) options.title = frameName;
|
|
|
|
options.webPreferences = webPreferences;
|
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
const referrer = { url: '', policy: 'default' };
|
2020-03-26 18:05:45 +00:00
|
|
|
internalWindowOpen(event, url, referrer, frameName, disposition, options, additionalFeatures, null);
|
2020-03-20 20:28:31 +00:00
|
|
|
});
|
2017-01-12 00:36:59 +00:00
|
|
|
|
|
|
|
// Routed window.open messages with fully parsed options
|
2019-12-16 01:30:25 +00:00
|
|
|
function internalWindowOpen (event, url, referrer, frameName, disposition, options, additionalFeatures, postData) {
|
2020-03-20 20:28:31 +00:00
|
|
|
options = mergeBrowserWindowOptions(event.sender, options);
|
2020-03-26 18:05:45 +00:00
|
|
|
const postBody = postData ? {
|
|
|
|
data: postData,
|
|
|
|
...parseContentTypeFormat(postData)
|
|
|
|
} : null;
|
|
|
|
|
|
|
|
event.sender.emit('new-window', event, url, frameName, disposition, options, additionalFeatures, referrer, postBody);
|
2020-03-20 20:28:31 +00:00
|
|
|
const { newGuest } = event;
|
2019-05-27 00:44:54 +00:00
|
|
|
if ((event.sender.getType() === 'webview' && event.sender.getLastWebPreferences().disablePopups) || event.defaultPrevented) {
|
2017-05-23 21:49:00 +00:00
|
|
|
if (newGuest != null) {
|
2017-03-28 10:58:23 +00:00
|
|
|
if (options.webContents === newGuest.webContents) {
|
2017-03-28 10:58:58 +00:00
|
|
|
// the webContents is not changed, so set defaultPrevented to false to
|
|
|
|
// stop the callers of this event from destroying the webContents.
|
2020-03-20 20:28:31 +00:00
|
|
|
event.defaultPrevented = false;
|
2017-03-23 13:43:06 +00:00
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
event.returnValue = setupGuest(event.sender, frameName, newGuest, options);
|
2016-09-29 12:41:35 +00:00
|
|
|
} else {
|
2020-03-20 20:28:31 +00:00
|
|
|
event.returnValue = null;
|
2016-09-29 12:41:35 +00:00
|
|
|
}
|
2016-01-12 02:40:23 +00:00
|
|
|
} else {
|
2020-03-20 20:28:31 +00:00
|
|
|
event.returnValue = createGuest(event.sender, url, referrer, frameName, options, postData);
|
2016-01-12 02:40:23 +00:00
|
|
|
}
|
2019-12-16 01:30:25 +00:00
|
|
|
}
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2019-08-23 22:45:50 +00:00
|
|
|
const makeSafeHandler = function (handler) {
|
|
|
|
return (event, guestId, ...args) => {
|
2019-12-16 01:30:25 +00:00
|
|
|
// Access webContents via electron to prevent circular require.
|
2020-03-20 20:28:31 +00:00
|
|
|
const guestContents = electron.webContents.fromId(guestId);
|
2019-07-08 23:43:49 +00:00
|
|
|
if (!guestContents) {
|
2020-03-20 20:28:31 +00:00
|
|
|
throw new Error(`Invalid guestId: ${guestId}`);
|
2019-07-08 23:43:49 +00:00
|
|
|
}
|
2016-11-23 18:23:47 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return handler(event, guestContents, ...args);
|
|
|
|
};
|
|
|
|
};
|
2019-08-23 22:45:50 +00:00
|
|
|
|
|
|
|
const handleMessage = function (channel, handler) {
|
2020-03-20 20:28:31 +00:00
|
|
|
ipcMainInternal.handle(channel, makeSafeHandler(handler));
|
|
|
|
};
|
2019-08-23 22:45:50 +00:00
|
|
|
|
|
|
|
const handleMessageSync = function (channel, handler) {
|
2020-03-20 20:28:31 +00:00
|
|
|
ipcMainUtils.handleSync(channel, makeSafeHandler(handler));
|
|
|
|
};
|
2019-08-23 22:45:50 +00:00
|
|
|
|
2019-12-13 18:10:56 +00:00
|
|
|
const securityCheck = function (contents, guestContents, check) {
|
|
|
|
if (!check(contents, guestContents)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
console.error(`Blocked ${contents.getURL()} from accessing guestId: ${guestContents.id}`);
|
|
|
|
throw new Error(`Access denied to guestId: ${guestContents.id}`);
|
2019-08-23 22:45:50 +00:00
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
};
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2018-12-04 15:12:21 +00:00
|
|
|
const windowMethods = new Set([
|
2019-07-08 23:43:49 +00:00
|
|
|
'destroy',
|
2018-12-04 15:12:21 +00:00
|
|
|
'focus',
|
|
|
|
'blur'
|
2020-03-20 20:28:31 +00:00
|
|
|
]);
|
2018-12-04 15:12:21 +00:00
|
|
|
|
2019-07-08 23:43:49 +00:00
|
|
|
handleMessage('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_METHOD', (event, guestContents, method, ...args) => {
|
2020-03-20 20:28:31 +00:00
|
|
|
securityCheck(event.sender, guestContents, canAccessWindow);
|
2016-11-23 18:23:47 +00:00
|
|
|
|
2019-07-08 23:43:49 +00:00
|
|
|
if (!windowMethods.has(method)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
console.error(`Blocked ${event.sender.getURL()} from calling method: ${method}`);
|
|
|
|
throw new Error(`Invalid method: ${method}`);
|
2016-11-16 01:41:15 +00:00
|
|
|
}
|
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return getGuestWindow(guestContents)[method](...args);
|
|
|
|
});
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2019-07-08 23:43:49 +00:00
|
|
|
handleMessage('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_POSTMESSAGE', (event, guestContents, message, targetOrigin, sourceOrigin) => {
|
2017-01-12 00:36:59 +00:00
|
|
|
if (targetOrigin == null) {
|
2020-03-20 20:28:31 +00:00
|
|
|
targetOrigin = '*';
|
2017-01-12 00:36:59 +00:00
|
|
|
}
|
|
|
|
|
2016-11-15 08:45:34 +00:00
|
|
|
// The W3C does not seem to have word on how postMessage should work when the
|
|
|
|
// origins do not match, so we do not do |canAccessWindow| check here since
|
2016-11-16 01:41:15 +00:00
|
|
|
// postMessage across origins is useful and not harmful.
|
2020-03-20 20:28:31 +00:00
|
|
|
securityCheck(event.sender, guestContents, isRelatedWindow);
|
2019-12-13 18:10:56 +00:00
|
|
|
|
2017-04-26 17:53:54 +00:00
|
|
|
if (targetOrigin === '*' || isSameOrigin(guestContents.getURL(), targetOrigin)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
const sourceId = event.sender.id;
|
|
|
|
guestContents._sendInternal('ELECTRON_GUEST_WINDOW_POSTMESSAGE', sourceId, message, sourceOrigin);
|
2016-01-12 02:40:23 +00:00
|
|
|
}
|
2020-03-20 20:28:31 +00:00
|
|
|
});
|
2016-01-12 02:40:23 +00:00
|
|
|
|
2019-08-23 22:45:50 +00:00
|
|
|
const webContentsMethodsAsync = new Set([
|
2019-07-08 23:43:49 +00:00
|
|
|
'loadURL',
|
|
|
|
'executeJavaScript',
|
|
|
|
'print'
|
2020-03-20 20:28:31 +00:00
|
|
|
]);
|
2018-12-04 15:12:21 +00:00
|
|
|
|
2019-07-08 23:43:49 +00:00
|
|
|
handleMessage('ELECTRON_GUEST_WINDOW_MANAGER_WEB_CONTENTS_METHOD', (event, guestContents, method, ...args) => {
|
2020-03-20 20:28:31 +00:00
|
|
|
securityCheck(event.sender, guestContents, canAccessWindow);
|
2019-08-23 22:45:50 +00:00
|
|
|
|
|
|
|
if (!webContentsMethodsAsync.has(method)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
console.error(`Blocked ${event.sender.getURL()} from calling method: ${method}`);
|
|
|
|
throw new Error(`Invalid method: ${method}`);
|
2016-11-25 18:03:47 +00:00
|
|
|
}
|
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return guestContents[method](...args);
|
|
|
|
});
|
2019-08-23 22:45:50 +00:00
|
|
|
|
|
|
|
const webContentsMethodsSync = new Set([
|
|
|
|
'getURL'
|
2020-03-20 20:28:31 +00:00
|
|
|
]);
|
2019-08-23 22:45:50 +00:00
|
|
|
|
|
|
|
handleMessageSync('ELECTRON_GUEST_WINDOW_MANAGER_WEB_CONTENTS_METHOD', (event, guestContents, method, ...args) => {
|
2020-03-20 20:28:31 +00:00
|
|
|
securityCheck(event.sender, guestContents, canAccessWindow);
|
2019-08-23 22:45:50 +00:00
|
|
|
|
|
|
|
if (!webContentsMethodsSync.has(method)) {
|
2020-03-20 20:28:31 +00:00
|
|
|
console.error(`Blocked ${event.sender.getURL()} from calling method: ${method}`);
|
|
|
|
throw new Error(`Invalid method: ${method}`);
|
2016-11-25 18:03:47 +00:00
|
|
|
}
|
2019-07-08 23:43:49 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
return guestContents[method](...args);
|
|
|
|
});
|
2019-12-16 01:30:25 +00:00
|
|
|
|
2020-03-20 20:28:31 +00:00
|
|
|
exports.internalWindowOpen = internalWindowOpen;
|