fix: execute session preload scripts in sandboxed renderers (#16538)

lib/browser/rpc-server.js

@@ -534,8 +534,7 @@ ipcMain.on('ELECTRON_BROWSER_CLIPBOARD_WRITE_FIND_TEXT', function (event, text)
   setReturnValue(event, () => electron.clipboard.writeFindText(text))
 })
 
-ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
-  const preloadPath = event.sender._getPreloadPath()
+const getPreloadScript = function (preloadPath) {
   let preloadSrc = null
   let preloadError = null
   if (preloadPath) {
@@ -545,10 +544,17 @@ ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
       preloadError = errorUtils.serialize(err)
     }
   }
+  return { preloadPath, preloadSrc, preloadError }
+}
+
+ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
+  const preloadPaths = [
+    ...(event.sender.session ? event.sender.session.getPreloads() : []),
+    event.sender._getPreloadPath()
+  ]
+
   event.returnValue = {
-    preloadPath,
-    preloadSrc,
-    preloadError,
+    preloadScripts: preloadPaths.map(path => getPreloadScript(path)),
     isRemoteModuleEnabled: event.sender._isRemoteModuleEnabled(),
     isWebViewTagEnabled: guestViewManager.isWebViewTagEnabled(event.sender),
     process: {

lib/sandboxed_renderer/init.js

@@ -29,7 +29,7 @@ Object.setPrototypeOf(process, EventEmitter.prototype)
 const ipcRenderer = require('@electron/internal/renderer/ipc-renderer-internal')
 
 const {
-  preloadPath, preloadSrc, preloadError, isRemoteModuleEnabled, isWebViewTagEnabled, process: processProps
+  preloadScripts, isRemoteModuleEnabled, isWebViewTagEnabled, process: processProps
 } = ipcRenderer.sendSync('ELECTRON_BROWSER_SANDBOX_LOAD')
 
 process.isRemoteModuleEnabled = isRemoteModuleEnabled
@@ -151,17 +151,19 @@ function runPreloadScript (preloadSrc) {
   preloadFn(preloadRequire, preloadProcess, Buffer, global, setImmediate, clearImmediate)
 }
 
-try {
-  if (preloadSrc) {
-    runPreloadScript(preloadSrc)
-  } else if (preloadError) {
-    throw errorUtils.deserialize(preloadError)
+for (const { preloadPath, preloadSrc, preloadError } of preloadScripts) {
+  try {
+    if (preloadSrc) {
+      runPreloadScript(preloadSrc)
+    } else if (preloadError) {
+      throw errorUtils.deserialize(preloadError)
+    }
+  } catch (error) {
+    console.error(`Unable to load preload script: ${preloadPath}`)
+    console.error(`${error}`)
+
+    ipcRenderer.send('ELECTRON_BROWSER_PRELOAD_ERROR', preloadPath, errorUtils.serialize(error))
   }
-} catch (error) {
-  console.error(`Unable to load preload script: ${preloadPath}`)
-  console.error(`${error}`)
-
-  ipcRenderer.send('ELECTRON_BROWSER_PRELOAD_ERROR', preloadPath, errorUtils.serialize(error))
 }
 
 // Warn about security issues

spec/api-browser-window-spec.js

@@ -1384,23 +1384,29 @@ describe('BrowserWindow module', () => {
         assert.deepStrictEqual(defaultSession.getPreloads(), preloads)
       })
 
-      it('loads the script before other scripts in window including normal preloads', function (done) {
-        ipcMain.once('vars', function (event, preload1, preload2, preload3) {
-          assert.strictEqual(preload1, 'preload-1')
-          assert.strictEqual(preload2, 'preload-1-2')
-          assert.strictEqual(preload3, 'preload-1-2-3')
-          done()
-        })
-        w.destroy()
-        w = new BrowserWindow({
-          show: false,
-          webPreferences: {
-            nodeIntegration: true,
-            preload: path.join(fixtures, 'module', 'set-global-preload-3.js')
-          }
+      const generateSpecs = (description, sandbox) => {
+        describe(description, () => {
+          it('loads the script before other scripts in window including normal preloads', function (done) {
+            ipcMain.once('vars', function (event, preload1, preload2) {
+              assert.strictEqual(preload1, 'preload-1')
+              assert.strictEqual(preload2, 'preload-1-2')
+              done()
+            })
+            w.destroy()
+            w = new BrowserWindow({
+              show: false,
+              webPreferences: {
+                sandbox,
+                preload: path.join(fixtures, 'module', 'get-global-preload.js')
+              }
+            })
+            w.loadURL('about:blank')
+          })
         })
-        w.loadFile(path.join(fixtures, 'api', 'preloads.html'))
-      })
+      }
+
+      generateSpecs('without sandbox', false)
+      generateSpecs('with sandbox', true)
     })
 
     describe('"additionalArguments" option', () => {

spec/fixtures/module/get-global-preload.js

@@ -0,0 +1 @@
+require('electron').ipcRenderer.send('vars', window.preload1, window.preload2)

spec/fixtures/module/set-global-preload-3.js

@@ -1 +0,0 @@
-window.preload3 = window.preload2 + '-3'