mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: security: don't allow arbitrary methods to be invoked on webContents via IPC (#15919)

Browse source
This commit is contained in:
Milan Burda 2018-12-04 16:12:21 +01:00 • committed by Alexey Kuzmin
parent 0a23c0b032
commit aa2b2f7c8f
7 changed files with 115 additions and 90 deletions
Download patch file Download diff file Expand all files Collapse all files

70
lib/renderer/web-view/web-view.js
View file

@ -7,6 +7,7 @@ const ipcRenderer = require('@electron/internal/renderer/ipc-renderer-internal')
const guestViewInternal = require('@electron/internal/renderer/web-view/guest-view-internal')
const webViewConstants = require('@electron/internal/renderer/web-view/web-view-constants')
const errorUtils = require('@electron/internal/common/error-utils')
const { syncMethods, asyncMethods } = require('@electron/internal/common/web-view-methods')
// ID generator.
let nextId = 0
@ -230,71 +231,6 @@ const registerWebViewElement = function () {
}
}
// Public-facing API methods.
const methods = [
'getURL',
'loadURL',
'getTitle',
'isLoading',
'isLoadingMainFrame',
'isWaitingForResponse',
'stop',
'reload',
'reloadIgnoringCache',
'canGoBack',
'canGoForward',
'canGoToOffset',
'clearHistory',
'goBack',
'goForward',
'goToIndex',
'goToOffset',
'isCrashed',
'setUserAgent',
'getUserAgent',
'openDevTools',
'closeDevTools',
'isDevToolsOpened',
'isDevToolsFocused',
'inspectElement',
'setAudioMuted',
'isAudioMuted',
'isCurrentlyAudible',
'undo',
'redo',
'cut',
'copy',
'paste',
'pasteAndMatchStyle',
'delete',
'selectAll',
'unselect',
'replace',
'replaceMisspelling',
'findInPage',
'stopFindInPage',
'downloadURL',
'inspectServiceWorker',
'showDefinitionForSelection',
'setZoomFactor',
'setZoomLevel'
]
const nonblockMethods = [
'insertCSS',
'insertText',
'send',
'sendInputEvent',
'setLayoutZoomLevelLimits',
'setVisualZoomLevelLimits',
// with callback
'capturePage',
'executeJavaScript',
'getZoomFactor',
'getZoomLevel',
'print',
'printToPDF'
]
const getGuestInstanceId = function (self) {
const internal = v8Util.getHiddenValue(self, 'internal')
if (!internal.guestInstanceId) {
@ -314,7 +250,7 @@ const registerWebViewElement = function () {
}
}
}
for (const method of methods) {
for (const method of syncMethods) {
proto[method] = createBlockHandler(method)
}
@ -332,7 +268,7 @@ const registerWebViewElement = function () {
ipcRenderer.send('ELECTRON_GUEST_VIEW_MANAGER_ASYNC_CALL', requestId, getGuestInstanceId(this), method, args, callback != null)
}
}
for (const method of nonblockMethods) {
for (const method of asyncMethods) {
proto[method] = createNonBlockHandler(method)
}

17
lib/renderer/window-setup.js
View file

@ -146,15 +146,6 @@ function BrowserWindowProxy (ipcRenderer, guestId) {
}
}
// Forward history operations to browser.
const sendHistoryOperation = function (ipcRenderer, ...args) {
ipcRenderer.send('ELECTRON_NAVIGATION_CONTROLLER', ...args)
}
const getHistoryOperation = function (ipcRenderer, ...args) {
return ipcRenderer.sendSync('ELECTRON_SYNC_NAVIGATION_CONTROLLER', ...args)
}
module.exports = (ipcRenderer, guestInstanceId, openerId, hiddenPage, usesNativeWindowOpen) => {
if (guestInstanceId == null) {
// Override default window.close.
@ -199,20 +190,20 @@ module.exports = (ipcRenderer, guestInstanceId, openerId, hiddenPage, usesNative
})
window.history.back = function () {
sendHistoryOperation(ipcRenderer, 'goBack')
ipcRenderer.send('ELECTRON_NAVIGATION_CONTROLLER_GO_BACK')
}
window.history.forward = function () {
sendHistoryOperation(ipcRenderer, 'goForward')
ipcRenderer.send('ELECTRON_NAVIGATION_CONTROLLER_GO_FORWARD')
}
window.history.go = function (offset) {
sendHistoryOperation(ipcRenderer, 'goToOffset', +offset)
ipcRenderer.send('ELECTRON_NAVIGATION_CONTROLLER_GO_TO_OFFSET', +offset)
}
defineProperty(window.history, 'length', {
get: function () {
return getHistoryOperation(ipcRenderer, 'length')
return ipcRenderer.sendSync('ELECTRON_NAVIGATION_CONTROLLER_LENGTH')
}
})