mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

Don't pass preloadPath via ELECTRON_BROWSER_SANDBOX_LOAD for security reasons (#13031)

Browse source
This commit is contained in:
Milan Burda 2018-08-11 00:19:49 +02:00 • committed by Charles Kerr
parent e08ce7127a
commit 702cc84bd3
8 changed files with 57 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

39
atom/browser/web_contents_preferences.cc
View file

@ -169,6 +169,30 @@ bool WebContentsPreferences::GetPreference(const base::StringPiece& name,
return GetAsString(&preference_, name, value);
}
bool WebContentsPreferences::GetPreloadPath(
base::FilePath::StringType* path) const {
DCHECK(path);
base::FilePath::StringType preload;
if (GetAsString(&preference_, options::kPreloadScript, &preload)) {
if (base::FilePath(preload).IsAbsolute()) {
*path = std::move(preload);
return true;
} else {
LOG(ERROR) << "preload script must have absolute path.";
}
} else if (GetAsString(&preference_, options::kPreloadURL, &preload)) {
// Translate to file path if there is "preload-url" option.
base::FilePath preload_path;
if (net::FileURLToFilePath(GURL(preload), &preload_path)) {
*path = std::move(preload_path.value());
return true;
} else {
LOG(ERROR) << "preload url must be file:// protocol.";
}
}
return false;
}
// static
content::WebContents* WebContentsPreferences::GetWebContentsFromProcessID(
int process_id) {
@ -228,19 +252,8 @@ void WebContentsPreferences::AppendCommandLineSwitches(
// The preload script.
base::FilePath::StringType preload;
if (GetAsString(&preference_, options::kPreloadScript, &preload)) {
if (base::FilePath(preload).IsAbsolute())
command_line->AppendSwitchNative(switches::kPreloadScript, preload);
else
LOG(ERROR) << "preload script must have absolute path.";
} else if (GetAsString(&preference_, options::kPreloadURL, &preload)) {
// Translate to file path if there is "preload-url" option.
base::FilePath preload_path;
if (net::FileURLToFilePath(GURL(preload), &preload_path))
command_line->AppendSwitchPath(switches::kPreloadScript, preload_path);
else
LOG(ERROR) << "preload url must be file:// protocol.";
}
if (GetPreloadPath(&preload))
command_line->AppendSwitchNative(switches::kPreloadScript, preload);
// Custom args for renderer process
auto* customArgs =