mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: access violation during redirects (intercepted requests) (#25393)

Browse source 
* fix: don't delete loader factory when request is pending

When intercepted request is pending we need to make sure that
loader factory is not deleted, especially when redirect occurs.
Otherwise, it may cause access violation.

* fix: added logic that removes requests from collection

* fix: fixed lint errors

* fix: fixed review remark

* fix: fixed review remarks

Removed intercepted_requests_ collection
and leverage pending_receivers_.

* fix: brought back removed line
This commit is contained in:
marcin-prochownik 2020-10-06 09:20:56 +02:00 • committed by GitHub
parent 125c5a6e9b
commit 8207f6901d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 48 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

15
shell/browser/net/proxying_url_loader_factory.cc
View file

@ -801,12 +801,16 @@ void ProxyingURLLoaderFactory::CreateLoaderAndStart(
// Check if user has intercepted this scheme.
auto it = intercepted_handlers_.find(request.url.scheme());
if (it != intercepted_handlers_.end()) {
mojo::Remote<network::mojom::URLLoaderFactory> loader_remote;
this->Clone(loader_remote.BindNewPipeAndPassReceiver());
// <scheme, <type, handler>>
it->second.second.Run(
request, base::BindOnce(&ElectronURLLoaderFactory::StartLoading,
std::move(loader), routing_id, request_id,
options, request, std::move(client),
traffic_annotation, this, it->second.first));
request,
base::BindOnce(&ElectronURLLoaderFactory::StartLoading,
std::move(loader), routing_id, request_id, options,
request, std::move(client), traffic_annotation,
loader_remote.Unbind(), it->second.first));
return;
}
@ -896,7 +900,8 @@ void ProxyingURLLoaderFactory::RemoveRequest(int32_t network_service_request_id,
void ProxyingURLLoaderFactory::MaybeDeleteThis() {
// Even if all URLLoaderFactory pipes connected to this object have been
// closed it has to stay alive until all active requests have completed.
if (target_factory_.is_bound() || !requests_.empty())
if (target_factory_.is_bound() || !requests_.empty() ||
!proxy_receivers_.empty())
return;
delete this;