Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: b2411e05a8
Branches Tags
electron
/
patches
/
chromium
/
fix_crash_loading_non-standard_schemes_in_iframes.patch

fix_crash_loading_non-standard_schemes_in_iframes.patch 4.1 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Shelley Vohr <[email protected]>
    3. 

  3. Date: Mon, 29 Aug 2022 11:44:57 +0200
    4. 

  4. Subject: fix: crash loading non-standard schemes in iframes
    5. 

  5. 

  6. This fixes a crash that occurs when loading non-standard schemes from
    7. 

  7. iframes or webviews. This was happening because
    8. 

  8. ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin contains explicit
    9. 

  9. exceptions to allow built-in non-standard schemes, but does not check
    10. 

  10. for non-standard schemes registered by the embedder.
    11. 

  11. 

  12. Upstream, https://bugs.chromium.org/p/chromium/issues/detail?id=1081397
    13. 

  13. contains several paths forward - here I chose to swap out the
    14. 

  14. CHECK in navigation_request.cc from policy->CanAccessDataForOrigin to
    15. 

  15. policy->CanCommitOriginAndUrl.
    16. 

  16. 

  17. Upstreamed at https://chromium-review.googlesource.com/c/chromium/src/+/3856266.
    18. 

  18. 

  19. diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
    20. 

  20. index abdb8e291a7f321404aa70881af2fa60d2ef4db7..8bbc051f468bee65b292c9b75c52cc4f01e02db6 100644
    21. 

  21. --- a/content/browser/renderer_host/navigation_request.cc
    22. 

  22. +++ b/content/browser/renderer_host/navigation_request.cc
    23. 

  23. @@ -7392,10 +7392,11 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponseWithDebugInfo() {
    24. 

  24.    if (IsForMhtmlSubframe())
    25. 

  25.      return origin_with_debug_info;
    26. 

  26.  
    27. 

  27. -  int process_id = GetRenderFrameHost()->GetProcess()->GetID();
    28. 

  28. -  auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
    29. 

  29. -  CHECK(
    30. 

  30. -      policy->CanAccessDataForOrigin(process_id, origin_with_debug_info.first));
    31. 

  31. +  CanCommitStatus can_commit = GetRenderFrameHost()->CanCommitOriginAndUrl(
    32. 

  32. +    origin_with_debug_info.first, GetURL(), IsSameDocument(), IsPdf(),
    33. 

  33. +    GetUrlInfo().is_sandboxed);
    34. 

  34. +  CHECK_EQ(CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL, can_commit);
    35. 

  35. +
    36. 

  36.    return origin_with_debug_info;
    37. 

  37.  }
    38. 

  38.  
    39. 

  39. diff --git a/content/browser/renderer_host/render_frame_host_impl.h b/content/browser/renderer_host/render_frame_host_impl.h
    40. 

  40. index 40c8eeb812338b3dc9f4f59d7672a9c4340f4305..e56bc9d06b9bef150b8de0dd66bbcc2901d6da2f 100644
    41. 

  41. --- a/content/browser/renderer_host/render_frame_host_impl.h
    42. 

  42. +++ b/content/browser/renderer_host/render_frame_host_impl.h
    43. 

  43. @@ -2904,6 +2904,17 @@ class CONTENT_EXPORT RenderFrameHostImpl
    44. 

  44.    // last committed document.
    45. 

  45.    CookieChangeListener::CookieChangeInfo GetCookieChangeInfo();
    46. 

  46.  
    47. 

  47. +  // Returns whether the given origin and URL is allowed to commit in the
    48. 

  48. +  // current RenderFrameHost. The |url| is used to ensure it matches the origin
    49. 

  49. +  // in cases where it is applicable. This is a more conservative check than
    50. 

  50. +  // RenderProcessHost::FilterURL, since it will be used to kill processes that
    51. 

  51. +  // commit unauthorized origins.
    52. 

  52. +  CanCommitStatus CanCommitOriginAndUrl(const url::Origin& origin,
    53. 

  53. +                                        const GURL& url,
    54. 

  54. +                                        bool is_same_document_navigation,
    55. 

  55. +                                        bool is_pdf,
    56. 

  56. +                                        bool is_sandboxed);
    57. 

  57. +
    58. 

  58.    // Sets a ResourceCache in the renderer. `this` must be active and there must
    59. 

  59.    // be no pending navigation. `remote` must have the same and process
    60. 

  60.    // isolation policy.
    61. 

  61. @@ -3246,17 +3257,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
    62. 

  62.    // relevant.
    63. 

  63.    void ResetWaitingState();
    64. 

  64.  
    65. 

  65. -  // Returns whether the given origin and URL is allowed to commit in the
    66. 

  66. -  // current RenderFrameHost. The |url| is used to ensure it matches the origin
    67. 

  67. -  // in cases where it is applicable. This is a more conservative check than
    68. 

  68. -  // RenderProcessHost::FilterURL, since it will be used to kill processes that
    69. 

  69. -  // commit unauthorized origins.
    70. 

  70. -  CanCommitStatus CanCommitOriginAndUrl(const url::Origin& origin,
    71. 

  71. -                                        const GURL& url,
    72. 

  72. -                                        bool is_same_document_navigation,
    73. 

  73. -                                        bool is_pdf,
    74. 

  74. -                                        bool is_sandboxed);
    75. 

  75. -
    76. 

  76.    // Returns whether a subframe navigation request should be allowed to commit
    77. 

  77.    // to the current RenderFrameHost.
    78. 

  78.    bool CanSubframeCommitOriginAndUrl(NavigationRequest* navigation_request);
    79.