mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: ensure snapshot is valid (#48104)

Browse source 
feat: add support for embedder snapshot validation
This commit is contained in:
Keeley Hammond 2025-08-18 14:37:48 -07:00 • committed by GitHub
commit 3f92511cde
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 138 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
shell/app/electron_main_delegate.cc
View file

@ -23,10 +23,13 @@
#include "components/content_settings/core/common/content_settings_pattern.h"
#include "content/public/app/initialize_mojo_core.h"
#include "content/public/common/content_switches.h"
#include "crypto/hash.h"
#include "electron/buildflags/buildflags.h"
#include "electron/fuses.h"
#include "electron/mas.h"
#include "electron/snapshot_checksum.h"
#include "extensions/common/constants.h"
#include "gin/v8_initializer.h"
#include "ipc/ipc_buildflags.h"
#include "sandbox/policy/switches.h"
#include "services/tracing/public/cpp/stack_sampling/tracing_sampler_profiler.h"
@ -49,6 +52,7 @@
#include "third_party/abseil-cpp/absl/types/variant.h"
#include "ui/base/resource/resource_bundle.h"
#include "ui/base/ui_base_switches.h"
#include "v8/include/v8-snapshot.h"
#if BUILDFLAG(IS_MAC)
#include "shell/app/electron_main_delegate_mac.h"
@ -206,6 +210,20 @@ void RegisterPathProvider() {
PATH_END);
}
void ValidateV8Snapshot(v8::StartupData* data) {
if (data->data &&
electron::fuses::IsEmbeddedAsarIntegrityValidationEnabled()) {
CHECK_GT(data->raw_size, 0);
UNSAFE_BUFFERS({
base::span<const char> span_data(
data->data, static_cast<unsigned long>(data->raw_size));
CHECK(base::ToLowerASCII(base::HexEncode(
crypto::hash::Sha256(base::as_bytes(span_data)))) ==
electron::snapshot_checksum::kChecksum);
})
}
}
} // namespace
std::string LoadResourceBundle(const std::string& locale) {
@ -229,7 +247,9 @@ std::string LoadResourceBundle(const std::string& locale) {
return loaded_locale;
}
ElectronMainDelegate::ElectronMainDelegate() = default;
ElectronMainDelegate::ElectronMainDelegate() {
gin::SetV8SnapshotValidator(base::BindRepeating(&ValidateV8Snapshot));
}
ElectronMainDelegate::~ElectronMainDelegate() = default;