mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: postMessage crash with invalid transferrable (#46666)

Browse source 
* fix: postMessage crash with invalid transferrable

Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

* chore: address review feedback

Co-authored-by: Charles Kerr <charles@charleskerr.com>

Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>

---------

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Shelley Vohr <shelley.vohr@gmail.com>
This commit is contained in:
trop[bot] 2025-04-17 18:23:26 +02:00 • committed by GitHub
parent ee04cb9ebe
commit 0675686451
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 82 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

23
shell/browser/api/electron_api_utility_process.cc
View file

@ -330,6 +330,9 @@ void UtilityProcessWrapper::PostMessage(gin::Arguments* args) {
return;
blink::TransferableMessage transferable_message;
gin_helper::ErrorThrower thrower(args->isolate());
// |message| is any value that can be serialized to StructuredClone.
v8::Local<v8::Value> message_value;
if (args->GetNext(&message_value)) {
if (!electron::SerializeV8Value(args->isolate(), message_value,
@ -342,9 +345,25 @@ void UtilityProcessWrapper::PostMessage(gin::Arguments* args) {
v8::Local<v8::Value> transferables;
std::vector<gin::Handle<MessagePort>> wrapped_ports;
if (args->GetNext(&transferables)) {
std::vector<v8::Local<v8::Value>> wrapped_port_values;
if (!gin::ConvertFromV8(args->isolate(), transferables,
&wrapped_port_values)) {
thrower.ThrowTypeError("transferables must be an array of MessagePorts");
return;
}
for (size_t i = 0; i < wrapped_port_values.size(); ++i) {
if (!gin_helper::IsValidWrappable(wrapped_port_values[i],
&MessagePort::kWrapperInfo)) {
thrower.ThrowTypeError(
base::StrCat({"Port at index ", base::NumberToString(i),
" is not a valid port"}));
return;
}
}
if (!gin::ConvertFromV8(args->isolate(), transferables, &wrapped_ports)) {
gin_helper::ErrorThrower(args->isolate())
.ThrowTypeError("Invalid value for transfer");
thrower.ThrowTypeError("Passed an invalid MessagePort");
return;
}
}

39
shell/browser/api/message_port.cc
View file

@ -17,6 +17,7 @@
#include "shell/common/gin_helper/dictionary.h"
#include "shell/common/gin_helper/error_thrower.h"
#include "shell/common/gin_helper/event_emitter_caller.h"
#include "shell/common/gin_helper/wrappable.h"
#include "shell/common/node_includes.h"
#include "shell/common/v8_util.h"
#include "third_party/abseil-cpp/absl/container/flat_hash_set.h"
@ -26,25 +27,6 @@
namespace electron {
namespace {
bool IsValidWrappable(const v8::Local<v8::Value>& val) {
if (!val->IsObject())
return false;
v8::Local<v8::Object> port = val.As<v8::Object>();
if (port->InternalFieldCount() != gin::kNumberOfInternalFields)
return false;
const auto* info = static_cast<gin::WrapperInfo*>(
port->GetAlignedPointerFromInternalField(gin::kWrapperInfoIndex));
return info && info->embedder == gin::kEmbedderNativeGin;
}
} // namespace
gin::WrapperInfo MessagePort::kWrapperInfo = {gin::kEmbedderNativeGin};
MessagePort::MessagePort() = default;
@ -77,16 +59,14 @@ void MessagePort::PostMessage(gin::Arguments* args) {
blink::TransferableMessage transferable_message;
gin_helper::ErrorThrower thrower(args->isolate());
// |message| is any value that can be serialized to StructuredClone.
v8::Local<v8::Value> message_value;
if (!args->GetNext(&message_value)) {
thrower.ThrowTypeError("Expected at least one argument to postMessage");
return;
}
if (!electron::SerializeV8Value(args->isolate(), message_value,
&transferable_message)) {
// SerializeV8Value sets an exception.
return;
if (args->GetNext(&message_value)) {
if (!electron::SerializeV8Value(args->isolate(), message_value,
&transferable_message)) {
// SerializeV8Value sets an exception.
return;
}
}
v8::Local<v8::Value> transferables;
@ -100,7 +80,8 @@ void MessagePort::PostMessage(gin::Arguments* args) {
}
for (unsigned i = 0; i < wrapped_port_values.size(); ++i) {
if (!IsValidWrappable(wrapped_port_values[i])) {
if (!gin_helper::IsValidWrappable(wrapped_port_values[i],
&MessagePort::kWrapperInfo)) {
thrower.ThrowTypeError("Port at index " + base::NumberToString(i) +
" is not a valid port");
return;