mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1
electron/shell/common
History
Exact
trop[bot] a629331619
 fix: validate header name and value in webRequest.onBeforeSendHeaders (#51365) 
* fix: validate header name and value in webRequest.onBeforeSendHeaders

Chromium's net::HttpRequestHeaders::SetHeader() uses CHECK() to enforce
valid header names and values, which causes a fatal crash if the caller
passes invalid strings. When users modify requestHeaders in the
onBeforeSendHeaders callback with invalid header names (e.g. containing
spaces) or invalid header values (e.g. containing CRLF), the
gin::Converter<net::HttpRequestHeaders>::FromV8() calls SetHeader()
directly, triggering the CHECK and crashing the process.

This change adds pre-validation using net::HttpUtil::IsValidHeaderName()
and net::HttpUtil::IsValidHeaderValue() before calling SetHeader(),
silently skipping invalid headers instead of crashing.

Co-authored-by: loufulton <loufulton.cz@gmail.com>

* Update shell/common/gin_converters/net_converter.cc

Co-authored-by: Charles Kerr <charles@charleskerr.com>

Co-authored-by: loufultoncz-coder <loufulton.cz@gmail.com>

* Update spec/api-web-request-spec.ts

Co-authored-by: Charles Kerr <charles@charleskerr.com>

Co-authored-by: loufultoncz-coder <loufulton.cz@gmail.com>

* fix: lint

Co-authored-by: loufulton <loufulton.cz@gmail.com>

---------

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: loufulton <loufulton.cz@gmail.com>
2026-04-28 11:07:36 -05:00
..
api fix: apply IsSafeRedirectTarget to net module redirects (#50929) 2026-04-11 19:07:02 -07:00
asar chore: bump chromium to 146.0.7666.0 (41-x-y) (#49543) 2026-02-17 16:19:16 -05:00
extensions fix: add missed enum SaveRequestType to PdfViewerPrivate function (#48372) 2025-09-26 16:34:06 -04:00
gin_converters fix: validate header name and value in webRequest.onBeforeSendHeaders (#51365) 2026-04-28 11:07:36 -05:00
gin_helper refactor: attach translator holder via v8::Function data slot (#51120) 2026-04-17 16:49:56 -05:00
mac fix: use audit token instead of PID for parent code-signature check (#50934) 2026-04-11 19:05:43 -07:00
resources/mac fix: disable MallocNanoZone on mac (#33704) 2022-04-28 10:28:27 -04:00
application_info.cc refactor: remove stray .c_str() calls for absl::StrFormat() (#47548) 2025-06-26 11:41:30 +02:00
application_info.h feat: improve Windows Toast actions support (#49787) 2026-02-18 13:23:53 -05:00
application_info_linux.cc chore: bump chromium to 137.0.7149.0 (main) (#46777) 2025-04-28 11:39:12 -04:00
application_info_mac.mm chore: bump chromium to 118.0.5975.0 (main) (#39531) 2023-09-01 15:54:59 +09:00
application_info_win.cc feat: improve Windows Toast actions support (#49787) 2026-02-18 13:23:53 -05:00
BUILD.gn feat: route deprecated sync clipboard read through permission checks (#45377) 2025-02-05 15:13:29 +09:00
callback_util.h refactor: remove base::AdaptCallbackForRepeating patch (#48774) 2025-11-05 11:00:51 -08:00
color_util.cc chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
color_util.h chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
command_line_util_win.cc fix: use proper quoting for exe paths and args on Windows (#50076) 2026-03-04 13:37:50 -06:00
command_line_util_win.h fix: use proper quoting for exe paths and args on Windows (#50076) 2026-03-04 13:37:50 -06:00
crash_keys.cc fix: restore std::deque for dynamic crash key storage (#50837) 2026-04-10 10:18:48 +02:00
crash_keys.h chore: used nested namespaces (#34737) 2022-06-29 12:55:47 -07:00
electron_command_line.cc chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
electron_command_line.h chore: bump chromium to 141.0.7390.7 (main) (#48212) 2025-09-08 12:57:15 +02:00
electron_constants.h chore: bump chromium to 144.0.7514.0 (main) (#48840) 2025-11-10 13:27:35 +01:00
electron_paths.cc refactor: address PathProvider TODO (#49599) 2026-02-02 09:38:46 +01:00
electron_paths.h refactor: address PathProvider TODO (#49599) 2026-02-02 09:38:46 +01:00
heap_snapshot.cc refactor: use base::as_bytes() in WriteAsciiChunk() (#45724) 2025-02-20 20:19:48 -05:00
heap_snapshot.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00
key_weak_map.h perf: use absl::flat_hash_map instead of std::unordered_map (#46202) 2025-03-24 10:09:14 +01:00
keyboard_util.cc build: match upstream with unsafe buffer paths (#45853) 2025-03-06 16:04:18 -05:00
keyboard_util.h chore: migrate base::StringPiece to std::string_view (#40915) 2024-01-10 19:00:37 -06:00
language_util.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00
language_util_linux.cc chore: bump chromium to 137.0.7128.1 (main) (#46482) 2025-04-22 15:53:29 -04:00
language_util_mac.mm fix: respect system language preferences on Win/macOS (#23247) 2020-05-04 10:49:29 -07:00
language_util_win.cc chore: remove more unused #include calls (#43000) 2024-07-25 11:25:45 +02:00
logging.cc chore: bump chromium to 144.0.7547.0 (main) (#49058) 2025-12-04 16:40:04 -08:00
logging.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00
mac_util.h fix: -Wunsafe-buffer-usage warning in didRegisterForRemoteNotificationsWithDeviceToken (#44348) 2024-10-23 14:18:22 -05:00
mac_util.mm fix: -Wunsafe-buffer-usage warning in didRegisterForRemoteNotificationsWithDeviceToken (#44348) 2024-10-23 14:18:22 -05:00
node_bindings.cc fix: nodeIntegrationInWorker not working in AudioWorklet (#51006) 2026-04-20 12:01:52 +02:00
node_bindings.h fix: nodeIntegrationInWorker not working in AudioWorklet (#51006) 2026-04-20 12:01:52 +02:00
node_bindings_linux.cc refactor: NodeBindings::Create() returns a unique_ptr (#43361) 2024-08-20 15:34:59 -04:00
node_bindings_linux.h chore: remove unused #includes (#42971) 2024-07-22 11:31:32 +02:00
node_bindings_mac.cc refactor: remove allow_unsafe_buffers pragma from FD_ZERO (#48811) 2025-11-07 11:23:52 +01:00
node_bindings_mac.h chore: remove unused #includes (#42971) 2024-07-22 11:31:32 +02:00
node_bindings_win.cc chore: remove unused base/ includes (#43688) 2024-09-12 16:05:37 +02:00
node_bindings_win.h chore: remove unused #includes (#42971) 2024-07-22 11:31:32 +02:00
node_includes.h chore: bump node to v24.15.0 (41-x-y) (#51088) 2026-04-22 21:52:17 +02:00
node_util.cc chore: bump node to v24.15.0 (41-x-y) (#51088) 2026-04-22 21:52:17 +02:00
node_util.h refactor: avoid deprecated v8::Context::GetIsolate() calls pt 3 context get isolate pt 3 (#47901) 2025-07-30 09:14:38 -05:00
options_switches.h fix: offscreen rendering with correct screen info. (#50375) 2026-04-24 12:36:54 -04:00
platform_util.cc fix: misc-use-internal-linkage warnings (#44843) 2024-11-27 10:40:39 -06:00
platform_util.h refactor: have GetXdgAppId() return a std::optional<std::string> (#49318) 2026-01-07 14:30:09 -05:00
platform_util_internal.h chore: used nested namespaces (#34737) 2022-06-29 12:55:47 -07:00
platform_util_linux.cc refactor: initialize libgdk stubs before use in platform_util:Beep (#49865) 2026-02-19 12:47:16 +01:00
platform_util_mac.mm chore: clean up clang-tidy warnings (#50921) 2026-04-12 10:15:22 -05:00
platform_util_win.cc fix: launch crash when null device is disabled on Windows (#47870) 2025-10-11 18:00:04 -04:00
plugin.mojom chore: bump chromium to 129.0.6650.0 (main) (#43266) 2024-08-12 10:28:33 +02:00
plugin_info.cc chore: bump chromium to 123.0.6312.5 (main) (#41337) 2024-02-21 15:27:05 -05:00
plugin_info.h chore: bump chromium to 144.0.7514.0 (main) (#48840) 2025-11-10 13:27:35 +01:00
process_util.cc refactor: add EmitWarning(v8::Isolate*) helper (#43722) 2024-09-16 15:53:04 -05:00
process_util.h refactor: remove unused system header includes (#46015) 2025-03-14 10:59:15 -05:00
skia_util.cc chore: bump chromium to 143.0.7474.0 (main) (#48572) 2025-10-17 13:04:24 -04:00
skia_util.h refactor: spanify image utils (#44127) 2024-10-10 09:34:55 -04:00
thread_restrictions.h chore: bump chromium to 110.0.5415.0 (main) (#36186) 2022-11-17 14:59:23 -05:00
v8_util.cc feat: enable WASM trap handlers in all Node.js processes (#49839) 2026-02-18 13:22:36 -05:00
v8_util.h feat: enable WASM trap handlers in all Node.js processes (#49839) 2026-02-18 13:22:36 -05:00
web_contents_utility.mojom fix: avoid IPC for renderer webFrame.getZoom... APIs (#45499) 2025-02-10 16:09:11 -05:00
world_ids.h chore: add ELECTRON_ prefix to C++ include guards (#31925) 2021-11-22 16:34:31 +09:00