mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

Don't pass preloadPath via ELECTRON_BROWSER_SANDBOX_LOAD for security reasons (#13031) (#14026)

Browse source
This commit is contained in:
Milan Burda 2018-08-11 19:53:33 +02:00 • committed by Charles Kerr
parent fb2afe8656
commit b5bfd9867b
8 changed files with 55 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

12
atom/renderer/atom_sandboxed_renderer_client.cc
View file

@ -169,16 +169,12 @@ void AtomSandboxedRendererClient::DidCreateScriptContext(
if (!render_frame->IsMainFrame() && !IsDevTools(render_frame))
return;
base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
base::FilePath preload_script_path =
command_line->GetSwitchValuePath(switches::kPreloadScript);
auto* isolate = context->GetIsolate();
v8::HandleScope handle_scope(isolate);
v8::Context::Scope context_scope(context);
// Wrap the bundle into a function that receives the binding object and the
// preload script path as arguments.
std::string left = "(function(binding, preloadPath, require) {\n";
std::string left = "(function(binding, require) {\n";
std::string right = "\n})";
// Compile the wrapper and run it to get the function object
auto script = v8::Script::Compile(v8::String::Concat(
@ -191,10 +187,10 @@ void AtomSandboxedRendererClient::DidCreateScriptContext(
auto binding = v8::Object::New(isolate);
InitializeBindings(binding, context);
AddRenderBindings(isolate, binding);
v8::Local<v8::Value> args[] = {
binding, mate::ConvertToV8(isolate, preload_script_path.value())};
v8::Local<v8::Value> args[] = {binding};
// Execute the function with proper arguments
ignore_result(func->Call(context, v8::Null(isolate), 2, args));
ignore_result(
func->Call(context, v8::Null(isolate), node::arraysize(args), args));
}
void AtomSandboxedRendererClient::WillReleaseScriptContext(