fix: postMessage
crash with invalid transferrable (#46666)
* fix: postMessage crash with invalid transferrable Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com> * chore: address review feedback Co-authored-by: Charles Kerr <charles@charleskerr.com> Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com> --------- Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com> Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
This commit is contained in:
parent
ee04cb9ebe
commit
0675686451
5 changed files with 82 additions and 31 deletions
|
@ -330,6 +330,9 @@ void UtilityProcessWrapper::PostMessage(gin::Arguments* args) {
|
|||
return;
|
||||
|
||||
blink::TransferableMessage transferable_message;
|
||||
gin_helper::ErrorThrower thrower(args->isolate());
|
||||
|
||||
// |message| is any value that can be serialized to StructuredClone.
|
||||
v8::Local<v8::Value> message_value;
|
||||
if (args->GetNext(&message_value)) {
|
||||
if (!electron::SerializeV8Value(args->isolate(), message_value,
|
||||
|
@ -342,9 +345,25 @@ void UtilityProcessWrapper::PostMessage(gin::Arguments* args) {
|
|||
v8::Local<v8::Value> transferables;
|
||||
std::vector<gin::Handle<MessagePort>> wrapped_ports;
|
||||
if (args->GetNext(&transferables)) {
|
||||
std::vector<v8::Local<v8::Value>> wrapped_port_values;
|
||||
if (!gin::ConvertFromV8(args->isolate(), transferables,
|
||||
&wrapped_port_values)) {
|
||||
thrower.ThrowTypeError("transferables must be an array of MessagePorts");
|
||||
return;
|
||||
}
|
||||
|
||||
for (size_t i = 0; i < wrapped_port_values.size(); ++i) {
|
||||
if (!gin_helper::IsValidWrappable(wrapped_port_values[i],
|
||||
&MessagePort::kWrapperInfo)) {
|
||||
thrower.ThrowTypeError(
|
||||
base::StrCat({"Port at index ", base::NumberToString(i),
|
||||
" is not a valid port"}));
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
if (!gin::ConvertFromV8(args->isolate(), transferables, &wrapped_ports)) {
|
||||
gin_helper::ErrorThrower(args->isolate())
|
||||
.ThrowTypeError("Invalid value for transfer");
|
||||
thrower.ThrowTypeError("Passed an invalid MessagePort");
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -17,6 +17,7 @@
|
|||
#include "shell/common/gin_helper/dictionary.h"
|
||||
#include "shell/common/gin_helper/error_thrower.h"
|
||||
#include "shell/common/gin_helper/event_emitter_caller.h"
|
||||
#include "shell/common/gin_helper/wrappable.h"
|
||||
#include "shell/common/node_includes.h"
|
||||
#include "shell/common/v8_util.h"
|
||||
#include "third_party/abseil-cpp/absl/container/flat_hash_set.h"
|
||||
|
@ -26,25 +27,6 @@
|
|||
|
||||
namespace electron {
|
||||
|
||||
namespace {
|
||||
|
||||
bool IsValidWrappable(const v8::Local<v8::Value>& val) {
|
||||
if (!val->IsObject())
|
||||
return false;
|
||||
|
||||
v8::Local<v8::Object> port = val.As<v8::Object>();
|
||||
|
||||
if (port->InternalFieldCount() != gin::kNumberOfInternalFields)
|
||||
return false;
|
||||
|
||||
const auto* info = static_cast<gin::WrapperInfo*>(
|
||||
port->GetAlignedPointerFromInternalField(gin::kWrapperInfoIndex));
|
||||
|
||||
return info && info->embedder == gin::kEmbedderNativeGin;
|
||||
}
|
||||
|
||||
} // namespace
|
||||
|
||||
gin::WrapperInfo MessagePort::kWrapperInfo = {gin::kEmbedderNativeGin};
|
||||
|
||||
MessagePort::MessagePort() = default;
|
||||
|
@ -77,16 +59,14 @@ void MessagePort::PostMessage(gin::Arguments* args) {
|
|||
blink::TransferableMessage transferable_message;
|
||||
gin_helper::ErrorThrower thrower(args->isolate());
|
||||
|
||||
// |message| is any value that can be serialized to StructuredClone.
|
||||
v8::Local<v8::Value> message_value;
|
||||
if (!args->GetNext(&message_value)) {
|
||||
thrower.ThrowTypeError("Expected at least one argument to postMessage");
|
||||
return;
|
||||
}
|
||||
|
||||
if (!electron::SerializeV8Value(args->isolate(), message_value,
|
||||
&transferable_message)) {
|
||||
// SerializeV8Value sets an exception.
|
||||
return;
|
||||
if (args->GetNext(&message_value)) {
|
||||
if (!electron::SerializeV8Value(args->isolate(), message_value,
|
||||
&transferable_message)) {
|
||||
// SerializeV8Value sets an exception.
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
v8::Local<v8::Value> transferables;
|
||||
|
@ -100,7 +80,8 @@ void MessagePort::PostMessage(gin::Arguments* args) {
|
|||
}
|
||||
|
||||
for (unsigned i = 0; i < wrapped_port_values.size(); ++i) {
|
||||
if (!IsValidWrappable(wrapped_port_values[i])) {
|
||||
if (!gin_helper::IsValidWrappable(wrapped_port_values[i],
|
||||
&MessagePort::kWrapperInfo)) {
|
||||
thrower.ThrowTypeError("Port at index " + base::NumberToString(i) +
|
||||
" is not a valid port");
|
||||
return;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue