fix: block custom window.open when nativeWindowOpen is true (#23188)
This commit is contained in:
parent
3ac4fa85dd
commit
c798a6e5d1
2 changed files with 34 additions and 0 deletions
|
@ -219,6 +219,12 @@ const canAccessWindow = function (sender, target) {
|
|||
|
||||
// Routed window.open messages with raw options
|
||||
ipcMainInternal.on('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_OPEN', (event, url, frameName, features) => {
|
||||
// This should only be allowed for senders that have nativeWindowOpen: false
|
||||
const webPreferences = event.sender.getLastWebPreferences();
|
||||
if (webPreferences.nativeWindowOpen || webPreferences.sandbox) {
|
||||
event.returnValue = null;
|
||||
throw new Error('GUEST_WINDOW_MANAGER_WINDOW_OPEN denied: expected native window.open');
|
||||
}
|
||||
if (url == null || url === '') url = 'about:blank';
|
||||
if (frameName == null) frameName = '';
|
||||
if (features == null) features = '';
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue