mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

feat: sandbox renderer processes for cross-origin frames (#18650)

Browse source
This commit is contained in:
Milan Burda 2019-06-20 12:10:56 +02:00 • committed by Alexey Kuzmin
parent 23286fe557
commit f3f2990b9e
8 changed files with 139 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

13
shell/browser/web_contents_preferences.cc
View file

@ -271,7 +271,8 @@ WebContentsPreferences* WebContentsPreferences::From(
}
void WebContentsPreferences::AppendCommandLineSwitches(
base::CommandLine* command_line) {
base::CommandLine* command_line,
bool is_subframe) {
// Check if plugins are enabled.
if (IsEnabled(options::kPlugins))
command_line->AppendSwitch(switches::kEnablePlugins);
@ -293,10 +294,16 @@ void WebContentsPreferences::AppendCommandLineSwitches(
if (IsEnabled(options::kWebviewTag))
command_line->AppendSwitch(switches::kWebviewTag);
// Sandbox can be enabled for renderer processes hosting cross-origin frames
// unless nodeIntegrationInSubFrames is enabled
bool can_sandbox_frame =
is_subframe && !IsEnabled(options::kNodeIntegrationInSubFrames);
// If the `sandbox` option was passed to the BrowserWindow's webPreferences,
// pass `--enable-sandbox` to the renderer so it won't have any node.js
// integration.
if (IsEnabled(options::kSandbox)) {
// integration. Otherwise disable Chromium sandbox, unless app.enableSandbox()
// was called.
if (IsEnabled(options::kSandbox) || can_sandbox_frame) {
command_line->AppendSwitch(switches::kEnableSandbox);
} else if (!command_line->HasSwitch(switches::kEnableSandbox)) {
command_line->AppendSwitch(service_manager::switches::kNoSandbox);