fix: execute session preload scripts in sandboxed renderers (#16538)

lib/browser/rpc-server.js

@@ -534,8 +534,7 @@ ipcMain.on('ELECTRON_BROWSER_CLIPBOARD_WRITE_FIND_TEXT', function (event, text)
   setReturnValue(event, () => electron.clipboard.writeFindText(text))
 })
 
-ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
-  const preloadPath = event.sender._getPreloadPath()
+const getPreloadScript = function (preloadPath) {
   let preloadSrc = null
   let preloadError = null
   if (preloadPath) {
@@ -545,10 +544,17 @@ ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
       preloadError = errorUtils.serialize(err)
     }
   }
+  return { preloadPath, preloadSrc, preloadError }
+}
+
+ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
+  const preloadPaths = [
+    ...(event.sender.session ? event.sender.session.getPreloads() : []),
+    event.sender._getPreloadPath()
+  ]
+
   event.returnValue = {
-    preloadPath,
-    preloadSrc,
-    preloadError,
+    preloadScripts: preloadPaths.map(path => getPreloadScript(path)),
     isRemoteModuleEnabled: event.sender._isRemoteModuleEnabled(),
     isWebViewTagEnabled: guestViewManager.isWebViewTagEnabled(event.sender),
     process: {

lib/sandboxed_renderer/init.js

@@ -29,7 +29,7 @@ Object.setPrototypeOf(process, EventEmitter.prototype)
 const ipcRenderer = require('@electron/internal/renderer/ipc-renderer-internal')
 
 const {
-  preloadPath, preloadSrc, preloadError, isRemoteModuleEnabled, isWebViewTagEnabled, process: processProps
+  preloadScripts, isRemoteModuleEnabled, isWebViewTagEnabled, process: processProps
 } = ipcRenderer.sendSync('ELECTRON_BROWSER_SANDBOX_LOAD')
 
 process.isRemoteModuleEnabled = isRemoteModuleEnabled
@@ -151,6 +151,7 @@ function runPreloadScript (preloadSrc) {
   preloadFn(preloadRequire, preloadProcess, Buffer, global, setImmediate, clearImmediate)
 }
 
+for (const { preloadPath, preloadSrc, preloadError } of preloadScripts) {
   try {
     if (preloadSrc) {
       runPreloadScript(preloadSrc)
@@ -163,6 +164,7 @@ try {
 
     ipcRenderer.send('ELECTRON_BROWSER_PRELOAD_ERROR', preloadPath, errorUtils.serialize(error))
   }
+}
 
 // Warn about security issues
 if (process.isMainFrame) {

spec/api-browser-window-spec.js

@@ -1384,24 +1384,30 @@ describe('BrowserWindow module', () => {
         assert.deepStrictEqual(defaultSession.getPreloads(), preloads)
       })
 
+      const generateSpecs = (description, sandbox) => {
+        describe(description, () => {
           it('loads the script before other scripts in window including normal preloads', function (done) {
-        ipcMain.once('vars', function (event, preload1, preload2, preload3) {
+            ipcMain.once('vars', function (event, preload1, preload2) {
               assert.strictEqual(preload1, 'preload-1')
               assert.strictEqual(preload2, 'preload-1-2')
-          assert.strictEqual(preload3, 'preload-1-2-3')
               done()
             })
             w.destroy()
             w = new BrowserWindow({
               show: false,
               webPreferences: {
-            nodeIntegration: true,
-            preload: path.join(fixtures, 'module', 'set-global-preload-3.js')
+                sandbox,
+                preload: path.join(fixtures, 'module', 'get-global-preload.js')
               }
             })
-        w.loadFile(path.join(fixtures, 'api', 'preloads.html'))
+            w.loadURL('about:blank')
           })
         })
+      }
+
+      generateSpecs('without sandbox', false)
+      generateSpecs('with sandbox', true)
+    })
 
     describe('"additionalArguments" option', () => {
       it('adds extra args to process.argv in the renderer process', (done) => {

spec/fixtures/module/get-global-preload.js

@@ -0,0 +1 @@
+require('electron').ipcRenderer.send('vars', window.preload1, window.preload2)

spec/fixtures/module/set-global-preload-3.js

@@ -1 +0,0 @@
-window.preload3 = window.preload2 + '-3'