mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

fix: ensure ElectronBrowser mojo service is only bound to appropriate render frames (#33323)

Browse source 
* fix: ensure ElectronBrowser mojo service is only bound to authorized render frames

Notes: no-notes

* refactor: extract electron API IPC to its own mojo interface

* fix: just check main frame not primary main frame
This commit is contained in:
Samuel Attard 2022-03-18 19:50:05 -07:00 • committed by GitHub
parent f2b06324b8
commit e07c2b84d7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
17 changed files with 381 additions and 229 deletions
Download patch file Download diff file Expand all files Collapse all files

30
shell/browser/electron_browser_client.cc
View file

@ -77,13 +77,14 @@
#include "shell/browser/api/electron_api_web_request.h"
#include "shell/browser/badging/badge_manager.h"
#include "shell/browser/child_web_contents_tracker.h"
#include "shell/browser/electron_api_ipc_handler_impl.h"
#include "shell/browser/electron_autofill_driver_factory.h"
#include "shell/browser/electron_browser_context.h"
#include "shell/browser/electron_browser_handler_impl.h"
#include "shell/browser/electron_browser_main_parts.h"
#include "shell/browser/electron_navigation_throttle.h"
#include "shell/browser/electron_quota_permission_context.h"
#include "shell/browser/electron_speech_recognition_manager_delegate.h"
#include "shell/browser/electron_web_contents_utility_handler_impl.h"
#include "shell/browser/font_defaults.h"
#include "shell/browser/javascript_environment.h"
#include "shell/browser/media/media_capture_devices_dispatcher.h"
@ -1515,14 +1516,33 @@ void ElectronBrowserClient::
render_frame_host, // NOLINT(runtime/references)
blink::AssociatedInterfaceRegistry&
associated_registry) { // NOLINT(runtime/references)
auto* contents =
content::WebContents::FromRenderFrameHost(&render_frame_host);
if (contents) {
auto* prefs = WebContentsPreferences::From(contents);
if (render_frame_host.GetFrameTreeNodeId() ==
contents->GetMainFrame()->GetFrameTreeNodeId() ||
(prefs && prefs->AllowsNodeIntegrationInSubFrames())) {
associated_registry.AddInterface(base::BindRepeating(
[](content::RenderFrameHost* render_frame_host,
mojo::PendingAssociatedReceiver<electron::mojom::ElectronApiIPC>
receiver) {
ElectronApiIPCHandlerImpl::Create(render_frame_host,
std::move(receiver));
},
&render_frame_host));
}
}
associated_registry.AddInterface(base::BindRepeating(
[](content::RenderFrameHost* render_frame_host,
mojo::PendingAssociatedReceiver<electron::mojom::ElectronBrowser>
receiver) {
ElectronBrowserHandlerImpl::Create(render_frame_host,
std::move(receiver));
mojo::PendingAssociatedReceiver<
electron::mojom::ElectronWebContentsUtility> receiver) {
ElectronWebContentsUtilityHandlerImpl::Create(render_frame_host,
std::move(receiver));
},
&render_frame_host));
associated_registry.AddInterface(base::BindRepeating(
[](content::RenderFrameHost* render_frame_host,
mojo::PendingAssociatedReceiver<mojom::ElectronAutofillDriver>