security: allow to block desktopCapturer.getSources() calls (#15964)

* security: allow to block desktopCapturer.getSources() calls

* return empty instead of error

* fix: release resources of DesktopCapturer on exit

lib/browser/api/web-contents.js

@@ -377,6 +377,10 @@ WebContents.prototype._init = function () {
     })
   })
 
+  this.on('desktop-capturer-get-sources', (event, ...args) => {
+    app.emit('desktop-capturer-get-sources', event, this, ...args)
+  })
+
   this.on('remote-require', (event, ...args) => {
     app.emit('remote-require', event, this, ...args)
   })

lib/browser/desktop-capturer.js

@@ -1,7 +1,9 @@
 'use strict'
 
 const ipcMain = require('@electron/internal/browser/ipc-main-internal')
+
 const { desktopCapturer } = process.atomBinding('desktop_capturer')
+const eventBinding = process.atomBinding('event')
 
 const deepEqual = (a, b) => JSON.stringify(a) === JSON.stringify(b)
 
@@ -12,6 +14,14 @@ const electronSources = 'ELECTRON_BROWSER_DESKTOP_CAPTURER_GET_SOURCES'
 const capturerResult = (id) => `ELECTRON_RENDERER_DESKTOP_CAPTURER_RESULT_${id}`
 
 ipcMain.on(electronSources, (event, captureWindow, captureScreen, thumbnailSize, fetchWindowIcons, id) => {
+  const customEvent = eventBinding.createWithSender(event.sender)
+  event.sender.emit('desktop-capturer-get-sources', customEvent)
+
+  if (customEvent.defaultPrevented) {
+    event.sender._sendInternal(capturerResult(id), [])
+    return
+  }
+
   const request = {
     id,
     options: {