mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1
electron/shell/common
History
Exact
trop[bot] ff69f9e490
 fix: validate header name and value in webRequest.onBeforeSendHeaders (#51364) 
* fix: validate header name and value in webRequest.onBeforeSendHeaders

Chromium's net::HttpRequestHeaders::SetHeader() uses CHECK() to enforce
valid header names and values, which causes a fatal crash if the caller
passes invalid strings. When users modify requestHeaders in the
onBeforeSendHeaders callback with invalid header names (e.g. containing
spaces) or invalid header values (e.g. containing CRLF), the
gin::Converter<net::HttpRequestHeaders>::FromV8() calls SetHeader()
directly, triggering the CHECK and crashing the process.

This change adds pre-validation using net::HttpUtil::IsValidHeaderName()
and net::HttpUtil::IsValidHeaderValue() before calling SetHeader(),
silently skipping invalid headers instead of crashing.

Co-authored-by: loufulton <loufulton.cz@gmail.com>

* Update shell/common/gin_converters/net_converter.cc

Co-authored-by: Charles Kerr <charles@charleskerr.com>

Co-authored-by: loufultoncz-coder <loufulton.cz@gmail.com>

* Update spec/api-web-request-spec.ts

Co-authored-by: Charles Kerr <charles@charleskerr.com>

Co-authored-by: loufultoncz-coder <loufulton.cz@gmail.com>

* fix: lint

Co-authored-by: loufulton <loufulton.cz@gmail.com>

---------

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: loufulton <loufulton.cz@gmail.com>
2026-04-28 12:02:12 -05:00
..
api fix: apply IsSafeRedirectTarget to net module redirects (#50928) 2026-04-11 07:34:24 -05:00
asar chore: bump chromium to 143.0.7451.0 (main) (#48362) 2025-10-13 12:21:54 -04:00
extensions fix: add missed enum SaveRequestType to PdfViewerPrivate function (#48372) 2025-09-26 16:34:06 -04:00
gin_converters fix: validate header name and value in webRequest.onBeforeSendHeaders (#51364) 2026-04-28 12:02:12 -05:00
gin_helper refactor: attach translator holder via v8::Function data slot (#51121) 2026-04-17 18:06:58 -05:00
mac fix: use audit token instead of PID for parent code-signature check (#50935) 2026-04-11 17:11:58 -04:00
resources/mac fix: disable MallocNanoZone on mac (#33704) 2022-04-28 10:28:27 -04:00
application_info.cc refactor: remove stray .c_str() calls for absl::StrFormat() (#47548) 2025-06-26 11:41:30 +02:00
application_info.h feat: improve Windows Toast actions support (#49786) 2026-02-18 13:22:10 -05:00
application_info_linux.cc chore: bump chromium to 137.0.7149.0 (main) (#46777) 2025-04-28 11:39:12 -04:00
application_info_mac.mm chore: bump chromium to 118.0.5975.0 (main) (#39531) 2023-09-01 15:54:59 +09:00
application_info_win.cc feat: improve Windows Toast actions support (#49786) 2026-02-18 13:22:10 -05:00
BUILD.gn feat: route deprecated sync clipboard read through permission checks (#45377) 2025-02-05 15:13:29 +09:00
callback_util.h refactor: remove base::AdaptCallbackForRepeating patch (#48790) 2025-11-05 18:25:01 -05:00
color_util.cc chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
color_util.h chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
command_line_util_win.cc fix: use proper quoting for exe paths and args on Windows (#50075) 2026-03-05 10:27:40 +01:00
command_line_util_win.h fix: use proper quoting for exe paths and args on Windows (#50075) 2026-03-05 10:27:40 +01:00
crash_keys.cc fix: restore std::deque for dynamic crash key storage (#50838) 2026-04-09 14:49:22 +02:00
crash_keys.h chore: used nested namespaces (#34737) 2022-06-29 12:55:47 -07:00
electron_command_line.cc chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
electron_command_line.h chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
electron_constants.h chore: bump chromium to 144.0.7514.0 (40-x-y) (#48868) 2025-11-10 18:32:34 +01:00
electron_paths.cc refactor: address PathProvider TODO (#49601) 2026-02-02 09:39:20 +01:00
electron_paths.h refactor: address PathProvider TODO (#49601) 2026-02-02 09:39:20 +01:00
heap_snapshot.cc refactor: use base::as_bytes() in WriteAsciiChunk() (#45724) 2025-02-20 20:19:48 -05:00
heap_snapshot.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00
key_weak_map.h perf: use absl::flat_hash_map instead of std::unordered_map (#46202) 2025-03-24 10:09:14 +01:00
keyboard_util.cc build: match upstream with unsafe buffer paths (#45853) 2025-03-06 16:04:18 -05:00
keyboard_util.h chore: migrate base::StringPiece to std::string_view (#40915) 2024-01-10 19:00:37 -06:00
language_util.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00
language_util_linux.cc chore: bump chromium to 137.0.7128.1 (main) (#46482) 2025-04-22 15:53:29 -04:00
language_util_mac.mm fix: respect system language preferences on Win/macOS (#23247) 2020-05-04 10:49:29 -07:00
language_util_win.cc chore: remove more unused #include calls (#43000) 2024-07-25 11:25:45 +02:00
logging.cc chore: bump chromium to 144.0.7547.0 (40-x-y) (#49146) 2025-12-05 12:18:13 -05:00
logging.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00
mac_util.h fix: -Wunsafe-buffer-usage warning in didRegisterForRemoteNotificationsWithDeviceToken (#44348) 2024-10-23 14:18:22 -05:00
mac_util.mm fix: -Wunsafe-buffer-usage warning in didRegisterForRemoteNotificationsWithDeviceToken (#44348) 2024-10-23 14:18:22 -05:00
node_bindings.cc fix: nodeIntegrationInWorker not working in AudioWorklet (#51004) 2026-04-21 16:16:24 +02:00
node_bindings.h fix: nodeIntegrationInWorker not working in AudioWorklet (#51004) 2026-04-21 16:16:24 +02:00
node_bindings_linux.cc refactor: NodeBindings::Create() returns a unique_ptr (#43361) 2024-08-20 15:34:59 -04:00
node_bindings_linux.h chore: remove unused #includes (#42971) 2024-07-22 11:31:32 +02:00
node_bindings_mac.cc chore: bump chromium to 137.0.7128.1 (main) (#46482) 2025-04-22 15:53:29 -04:00
node_bindings_mac.h chore: remove unused #includes (#42971) 2024-07-22 11:31:32 +02:00
node_bindings_win.cc chore: remove unused base/ includes (#43688) 2024-09-12 16:05:37 +02:00
node_bindings_win.h chore: remove unused #includes (#42971) 2024-07-22 11:31:32 +02:00
node_includes.h feat: add error event for utility process (#43774) 2024-09-27 10:17:06 +09:00
node_util.cc chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
node_util.h refactor: avoid deprecated v8::Context::GetIsolate() calls pt 3 context get isolate pt 3 (#47901) 2025-07-30 09:14:38 -05:00
options_switches.h feat: make Chrome extensions work on custom protocols (#50588) 2026-04-02 20:10:04 -07:00
platform_util.cc fix: misc-use-internal-linkage warnings (#44843) 2024-11-27 10:40:39 -06:00
platform_util.h fix: launch crash when null device is disabled on Windows (#47870) 2025-10-11 18:00:04 -04:00
platform_util_internal.h chore: used nested namespaces (#34737) 2022-06-29 12:55:47 -07:00
platform_util_linux.cc refactor: initialize libgdk stubs before use in platform_util:Beep (#49864) 2026-02-19 14:24:12 +01:00
platform_util_mac.mm fix: unexpected openExternal dialog on macOS Tahoe (#48502) 2025-10-10 12:48:44 +02:00
platform_util_win.cc fix: launch crash when null device is disabled on Windows (#47870) 2025-10-11 18:00:04 -04:00
plugin.mojom chore: bump chromium to 129.0.6650.0 (main) (#43266) 2024-08-12 10:28:33 +02:00
plugin_info.cc chore: bump chromium to 123.0.6312.5 (main) (#41337) 2024-02-21 15:27:05 -05:00
plugin_info.h chore: bump chromium to 144.0.7514.0 (40-x-y) (#48868) 2025-11-10 18:32:34 +01:00
process_util.cc refactor: add EmitWarning(v8::Isolate*) helper (#43722) 2024-09-16 15:53:04 -05:00
process_util.h refactor: remove unused system header includes (#46015) 2025-03-14 10:59:15 -05:00
skia_util.cc chore: bump chromium to 143.0.7474.0 (main) (#48572) 2025-10-17 13:04:24 -04:00
skia_util.h refactor: spanify image utils (#44127) 2024-10-10 09:34:55 -04:00
thread_restrictions.h chore: bump chromium to 110.0.5415.0 (main) (#36186) 2022-11-17 14:59:23 -05:00
v8_util.cc fix: revert enabling WASM trap handlers in all Node.js processes (#48976) 2025-11-14 18:57:05 -08:00
v8_util.h fix: revert enabling WASM trap handlers in all Node.js processes (#48976) 2025-11-14 18:57:05 -08:00
web_contents_utility.mojom fix: avoid IPC for renderer webFrame.getZoom... APIs (#45499) 2025-02-10 16:09:11 -05:00
world_ids.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00