mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

security: only handle related IPCs when <webview> tag is enabled (#15859)

Browse source 
* refactor: move guest-view-manager related IPC handling out of rpc-server

* feat: only handle related IPCs when <webview> tag is enabled
This commit is contained in:
Milan Burda 2018-11-30 10:44:38 +01:00 • committed by Cheng Zhao
parent 8cca1c987b
commit 8483cb4aa7
4 changed files with 63 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

34
lib/browser/rpc-server.js
View file

@ -413,40 +413,6 @@ handleRemoteCommand('ELECTRON_BROWSER_GUEST_WEB_CONTENTS', function (event, cont
return valueToMeta(event.sender, contextId, guestViewManager.getGuest(guestInstanceId))
})
ipcMain.on('ELECTRON_BROWSER_ASYNC_CALL_TO_GUEST_VIEW', function (event, requestId, guestInstanceId, method, args, hasCallback) {
new Promise(resolve => {
const guestViewManager = require('@electron/internal/browser/guest-view-manager')
const guest = guestViewManager.getGuest(guestInstanceId)
if (guest.hostWebContents !== event.sender) {
throw new Error('Access denied')
}
if (hasCallback) {
guest[method](...args, resolve)
} else {
resolve(guest[method](...args))
}
}).then(result => {
return [null, result]
}, error => {
return [errorUtils.serialize(error)]
}).then(responseArgs => {
event.sender._sendInternal(`ELECTRON_RENDERER_ASYNC_CALL_TO_GUEST_VIEW_RESPONSE_${requestId}`, ...responseArgs)
})
})
ipcMain.on('ELECTRON_BROWSER_SYNC_CALL_TO_GUEST_VIEW', function (event, guestInstanceId, method, args) {
try {
const guestViewManager = require('@electron/internal/browser/guest-view-manager')
const guest = guestViewManager.getGuest(guestInstanceId)
if (guest.hostWebContents !== event.sender) {
throw new Error('Access denied')
}
event.returnValue = [null, guest[method].apply(guest, args)]
} catch (error) {
event.returnValue = [errorUtils.serialize(error)]
}
})
// Implements window.close()
ipcMain.on('ELECTRON_BROWSER_WINDOW_CLOSE', function (event) {
const window = event.sender.getOwnerBrowserWindow()