fix: restrict sendToFrame to same-process frames by default (#26875)

This commit is contained in:
Jeremy Rose 2020-12-09 12:48:16 -08:00 committed by GitHub
parent 76f721474e
commit 07a1c2a3e5
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 89 additions and 36 deletions

View file

@ -5,6 +5,7 @@
#include "shell/common/gin_helper/event_emitter.h"
#include "content/public/browser/render_frame_host.h"
#include "content/public/browser/render_process_host.h"
#include "shell/browser/api/event.h"
#include "shell/common/gin_helper/dictionary.h"
#include "shell/common/gin_helper/object_template_builder.h"
@ -67,8 +68,10 @@ v8::Local<v8::Object> CreateNativeEvent(
Dictionary dict(isolate, event);
dict.Set("sender", sender);
// Should always set frameId even when callback is null.
if (frame)
if (frame) {
dict.Set("frameId", frame->GetRoutingID());
dict.Set("processId", frame->GetProcess()->GetID());
}
return event;
}