mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

Don't pass preloadPath via ELECTRON_BROWSER_SANDBOX_LOAD for security reasons (#13031)

Browse source
This commit is contained in:
Milan Burda 2018-08-11 00:19:49 +02:00 • committed by Charles Kerr
parent e08ce7127a
commit 702cc84bd3
8 changed files with 57 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

11
atom/browser/api/atom_api_web_contents.cc
View file

@ -1884,6 +1884,16 @@ void WebContents::OnGetZoomLevel(content::RenderFrameHost* rfh,
rfh->Send(reply_msg);
}
v8::Local<v8::Value> WebContents::GetPreloadPath(v8::Isolate* isolate) const {
if (auto* web_preferences = WebContentsPreferences::From(web_contents())) {
base::FilePath::StringType preload;
if (web_preferences->GetPreloadPath(&preload)) {
return mate::ConvertToV8(isolate, preload);
}
}
return v8::Null(isolate);
}
v8::Local<v8::Value> WebContents::GetWebPreferences(
v8::Isolate* isolate) const {
auto* web_preferences = WebContentsPreferences::From(web_contents());
@ -2047,6 +2057,7 @@ void WebContents::BuildPrototype(v8::Isolate* isolate,
.SetMethod("setZoomFactor", &WebContents::SetZoomFactor)
.SetMethod("_getZoomFactor", &WebContents::GetZoomFactor)
.SetMethod("getType", &WebContents::GetType)
.SetMethod("_getPreloadPath", &WebContents::GetPreloadPath)
.SetMethod("getWebPreferences", &WebContents::GetWebPreferences)
.SetMethod("getLastWebPreferences", &WebContents::GetLastWebPreferences)
.SetMethod("getOwnerBrowserWindow", &WebContents::GetOwnerBrowserWindow)

3
atom/browser/api/atom_api_web_contents.h
View file

@ -230,6 +230,9 @@ class WebContents : public mate::TrackableObject<WebContents>,
const std::vector<std::string>& features,
const scoped_refptr<network::ResourceRequestBody>& body);
// Returns the preload script path of current WebContents.
v8::Local<v8::Value> GetPreloadPath(v8::Isolate* isolate) const;
// Returns the web preferences of current WebContents.
v8::Local<v8::Value> GetWebPreferences(v8::Isolate* isolate) const;
v8::Local<v8::Value> GetLastWebPreferences(v8::Isolate* isolate) const;

39
atom/browser/web_contents_preferences.cc
View file

@ -169,6 +169,30 @@ bool WebContentsPreferences::GetPreference(const base::StringPiece& name,
return GetAsString(&preference_, name, value);
}
bool WebContentsPreferences::GetPreloadPath(
base::FilePath::StringType* path) const {
DCHECK(path);
base::FilePath::StringType preload;
if (GetAsString(&preference_, options::kPreloadScript, &preload)) {
if (base::FilePath(preload).IsAbsolute()) {
*path = std::move(preload);
return true;
} else {
LOG(ERROR) << "preload script must have absolute path.";
}
} else if (GetAsString(&preference_, options::kPreloadURL, &preload)) {
// Translate to file path if there is "preload-url" option.
base::FilePath preload_path;
if (net::FileURLToFilePath(GURL(preload), &preload_path)) {
*path = std::move(preload_path.value());
return true;
} else {
LOG(ERROR) << "preload url must be file:// protocol.";
}
}
return false;
}
// static
content::WebContents* WebContentsPreferences::GetWebContentsFromProcessID(
int process_id) {
@ -228,19 +252,8 @@ void WebContentsPreferences::AppendCommandLineSwitches(
// The preload script.
base::FilePath::StringType preload;
if (GetAsString(&preference_, options::kPreloadScript, &preload)) {
if (base::FilePath(preload).IsAbsolute())
command_line->AppendSwitchNative(switches::kPreloadScript, preload);
else
LOG(ERROR) << "preload script must have absolute path.";
} else if (GetAsString(&preference_, options::kPreloadURL, &preload)) {
// Translate to file path if there is "preload-url" option.
base::FilePath preload_path;
if (net::FileURLToFilePath(GURL(preload), &preload_path))
command_line->AppendSwitchPath(switches::kPreloadScript, preload_path);
else
LOG(ERROR) << "preload url must be file:// protocol.";
}
if (GetPreloadPath(&preload))
command_line->AppendSwitchNative(switches::kPreloadScript, preload);
// Custom args for renderer process
auto* customArgs =

3
atom/browser/web_contents_preferences.h
View file

@ -55,6 +55,9 @@ class WebContentsPreferences
// Return true if the particular preference value exists.
bool GetPreference(const base::StringPiece& name, std::string* value) const;
// Returns the preload script path.
bool GetPreloadPath(base::FilePath::StringType* path) const;
// Returns the web preferences.
base::Value* preference() { return &preference_; }
base::Value* last_preference() { return &last_preference_; }