Home Explore 引导页 在线工具 Blog
Register Sign In
Pchen0
/
electron
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: d987bee007
Branches Tags
electron
/
patches
/
chromium
/
fix_crash_loading_non-standard_schemes_in_iframes.patch

fix_crash_loading_non-standard_schemes_in_iframes.patch 3.9 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172 
  1. From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
    2. 

  2. From: Shelley Vohr <[email protected]>
    3. 

  3. Date: Mon, 29 Aug 2022 11:44:57 +0200
    4. 

  4. Subject: fix: crash loading non-standard schemes in iframes
    5. 

  5. 

  6. This fixes a crash that occurs when loading non-standard schemes from
    7. 

  7. iframes or webviews. This was happening because
    8. 

  8. ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin contains explicit
    9. 

  9. exceptions to allow built-in non-standard schemes, but does not check
    10. 

  10. for non-standard schemes registered by the embedder.
    11. 

  11. 

  12. This patch adjusts the origin calculation for subframe non-standard schemes in
    13. 

  13.  - browser process at `NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo`
    14. 

  14.  - render process at `DocumentLoader::CalculateOrigin`
    15. 

  15. 

  16. When top level frame navigates to non-standard scheme url, the origin is calculated
    17. 

  17. as `null` without any derivation. It is only in cases where there is a `initiator_origin`
    18. 

  18. then the origin is derived from it, which is usually the case for renderer initiated
    19. 

  19. navigations and iframes are no exceptions from this rule.
    20. 

  20. 

  21. The patch should be removed in favor of either:
    22. 

  22.   - Remove support for non-standard custom schemes
    23. 

  23.   - Register non-standard custom schemes as websafe schemes and update
    24. 

  24.   CPSPI::CanAccessDataForOrigin to allow them for any navigation.
    25. 

  25.   - Update the callsite to use RFHI::CanCommitOriginAndUrl in upstream, previous
    26. 

  26.   effort to do this can be found at https://chromium-review.googlesource.com/c/chromium/src/+/3856266.
    27. 

  27. 

  28. Upstream bug https://bugs.chromium.org/p/chromium/issues/detail?id=1081397.
    29. 

  29. 

  30. diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
    31. 

  31. index 73f61aa418db85558a0f8cfa574ee2e2f575ef90..4f376522e87fc8075eca6705b1bb781c86cde947 100644
    32. 

  32. --- a/content/browser/renderer_host/navigation_request.cc
    33. 

  33. +++ b/content/browser/renderer_host/navigation_request.cc
    34. 

  34. @@ -11048,6 +11048,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo() {
    35. 

  35.          "blob");
    36. 

  36.    }
    37. 

  37.  
    38. 

  38. +  if (!common_params().url.IsStandard() && !common_params().url.IsAboutBlank()) {
    39. 

  39. +    return std::make_pair(url::Origin::Resolve(common_params().url,
    40. 

  40. +                                url::Origin()),
    41. 

  41. +          "url_non_standard");
    42. 

  42. +  }
    43. 

  43. +
    44. 

  44.    // In cases not covered above, URLLoaderFactory should be associated with the
    45. 

  45.    // origin of |common_params.url| and/or |common_params.initiator_origin|.
    46. 

  46.    url::Origin resolved_origin = url::Origin::Resolve(
    47. 

  47. diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
    48. 

  48. index 0c7b5af098a53a8709cdf62d455520ccef222dbb..1b6a7942c1506abc2fbe7d1efe58c0964a4e3be0 100644
    49. 

  49. --- a/third_party/blink/renderer/core/loader/document_loader.cc
    50. 

  50. +++ b/third_party/blink/renderer/core/loader/document_loader.cc
    51. 

  51. @@ -2336,6 +2336,10 @@ Frame* DocumentLoader::CalculateOwnerFrame() {
    52. 

  52.  scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
    53. 

  53.      Document* owner_document) {
    54. 

  54.    scoped_refptr<SecurityOrigin> origin;
    55. 

  55. +  bool is_standard = false;
    56. 

  56. +  std::string protocol = url_.Protocol().Ascii();
    57. 

  57. +  is_standard = url::IsStandard(
    58. 

  58. +      protocol.data(), url::Component(0, static_cast<int>(protocol.size())));
    59. 

  59.    StringBuilder debug_info_builder;
    60. 

  60.    // Whether the origin is newly created within this call, instead of copied
    61. 

  61.    // from an existing document's origin or from `origin_to_commit_`. If this is
    62. 

  62. @@ -2389,6 +2393,10 @@ scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
    63. 

  63.      // the end of this function.
    64. 

  64.      origin = origin_to_commit_;
    65. 

  65.      debug_info_builder.Append("use_origin_to_commit");
    66. 

  66. +  } else if (!SecurityOrigin::ShouldUseInnerURL(url_) &&
    67. 

  67. +             !is_standard) {
    68. 

  68. +    debug_info_builder.Append("use_url_with_non_standard_scheme");
    69. 

  69. +    origin = SecurityOrigin::Create(url_);
    70. 

  70.    } else {
    71. 

  71.      debug_info_builder.Append("use_url_with_precursor");
    72. 

  72.      // Otherwise, create an origin that propagates precursor information
    73.