ElectronRendererClient::DidCreateScriptContext (and the worker equivalent) save Blink's fetch/Response/FormData/Request/Headers/ EventSource as temporary globalThis.blink* properties before Node initialization may overwrite them. node/init.ts and worker/init.ts restore the originals but previously never deleted the temporary blink* globals. They persisted as non-standard global pollution visible to page content when contextIsolation is disabled -- a minor fingerprinting signal and a bypass for any preload that wraps window.fetch (page could call blinkfetch() instead). Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com> Co-authored-by: Samuel Attard <sattard@anthropic.com> |
||
|---|---|---|
| .. | ||
| asar-fs-wrapper.ts | ||
| init.ts | ||