mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

Don't pass preloadPath via ELECTRON_BROWSER_SANDBOX_LOAD for security reasons (#13031)

Browse source
This commit is contained in:
Milan Burda 2018-08-11 00:19:49 +02:00 • committed by Charles Kerr
parent e08ce7127a
commit 702cc84bd3
8 changed files with 57 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lib/browser/rpc-server.js
View file

@ -440,7 +440,8 @@ ipcMain.on('ELECTRON_BROWSER_WINDOW_CLOSE', function (event) {
event.returnValue = null
})
ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event, preloadPath) {
ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
const preloadPath = event.sender._getPreloadPath()
let preloadSrc = null
let preloadError = null
if (preloadPath) {
@ -451,8 +452,8 @@ ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event, preloadPath) {
}
}
event.returnValue = {
preloadSrc: preloadSrc,
preloadError: preloadError,
preloadSrc,
preloadError,
platform: process.platform,
env: process.env
}