mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: ensure the sandboxed preloads globals do not leak (#17712)

Browse source
This commit is contained in:
Samuel Attard 2019-04-16 13:57:02 -04:00 • committed by Shelley Vohr
parent b3d8db6996
commit be6fb7cb12
6 changed files with 157 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

42
spec/api-browser-window-spec.js
View file

@ -1357,6 +1357,48 @@ describe('BrowserWindow module', () => {
afterEach(() => { ipcMain.removeAllListeners('answer') })
describe('"preload" option', () => {
const doesNotLeakSpec = (name, webPrefs) => {
it(name, async function () {
w.destroy()
w = new BrowserWindow({
webPreferences: {
...webPrefs,
preload: path.resolve(fixtures, 'module', 'empty.js')
},
show: false
})
const leakResult = emittedOnce(ipcMain, 'leak-result')
w.loadFile(path.join(fixtures, 'api', 'no-leak.html'))
const [, result] = await leakResult
console.log(result)
expect(result).to.have.property('require', 'undefined')
expect(result).to.have.property('exports', 'undefined')
expect(result).to.have.property('windowExports', 'undefined')
expect(result).to.have.property('windowPreload', 'undefined')
expect(result).to.have.property('windowRequire', 'undefined')
})
}
doesNotLeakSpec('does not leak require', {
nodeIntegration: false,
sandbox: false,
contextIsolation: false
})
doesNotLeakSpec('does not leak require when sandbox is enabled', {
nodeIntegration: false,
sandbox: true,
contextIsolation: false
})
doesNotLeakSpec('does not leak require when context isolation is enabled', {
nodeIntegration: false,
sandbox: false,
contextIsolation: true
})
doesNotLeakSpec('does not leak require when context isolation and sandbox are enabled', {
nodeIntegration: false,
sandbox: true,
contextIsolation: true
})
it('loads the script before other scripts in window', async () => {
const preload = path.join(fixtures, 'module', 'set-global.js')
w.destroy()

17
spec/fixtures/api/no-leak.html vendored Normal file
View file

@ -0,0 +1,17 @@
<!DOCTYPE html>
<html lang="en">
<head>
<title>Document</title>
</head>
<body>
<script>
window.postMessage({
require: typeof require,
exports: typeof exports,
windowRequire: typeof window.require,
windowExports: typeof window.exports,
windowPreload: typeof window.sandboxed_preload,
})
</script>
</body>
</html>

5
spec/fixtures/module/empty.js vendored Normal file
View file

@ -0,0 +1,5 @@
const { ipcRenderer } = require('electron')
window.addEventListener('message', (event) => {
ipcRenderer.send('leak-result', event.data)
})