fix: set XDG_CURRENT_DESKTOP env var back to original value before invoking xdg utils (#46787)

fix: set `XDG_CURRENT_DESKTOP` env var back to original value before invoking xdg utils (#45310)

* Fix XDG_CURRENT_DESKTOP before invoking XDGUtil

* apply suggestion

* use existing XDG_CURRENT_DESKTOP const

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Evan Simkowitz <esimkowitz@users.noreply.github.com>

patches/chromium/.patches

@@ -150,3 +150,4 @@ add_a_flag_to_enable_strict_js_compliance_in_audioworklet.patch
 remove_denormalenabler_from_scriptprocessornode.patch
 allow_denormal_flushing_to_outlive_scoped_object.patch
 fix_take_snapped_status_into_account_when_showing_a_window.patch
+cherry-pick-b8f80176b163.patch

patches/chromium/cherry-pick-b8f80176b163.patch

@@ -0,0 +1,174 @@
+From b8f80176b1636154c6bfc85a607b05cc3aec50cb Mon Sep 17 00:00:00 2001
+From: Alex Gough <ajgo@chromium.org>
+Date: Mon, 24 Mar 2025 09:04:37 -0700
+Subject: [PATCH] Avoid receiving or sending sentinel handle values
+
+These values can be misinterpreted by OS functions, so
+avoid sending or receiving them over IPCZ.
+
+(cherry picked from commit 36dbbf38697dd1e23ef8944bb9e57f6e0b3d41ec)
+
+Bug: 405143032
+Change-Id: Ib578fb4727e78e2697c60c42005daa97e08695e9
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6380193
+Reviewed-by: Will Harris <wfh@chromium.org>
+Commit-Queue: Alex Gough <ajgo@chromium.org>
+Reviewed-by: Daniel Cheng <dcheng@chromium.org>
+Cr-Original-Commit-Position: refs/heads/main@{#1436135}
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6383569
+Owners-Override: Srinivas Sista <srinivassista@chromium.org>
+Commit-Queue: Srinivas Sista <srinivassista@chromium.org>
+Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
+Cr-Commit-Position: refs/branch-heads/6998@{#2315}
+Cr-Branched-From: de9c6fafd8ae5c6ea0438764076ca7d04a0b165d-refs/heads/main@{#1415337}
+---
+
+diff --git a/base/win/win_util.h b/base/win/win_util.h
+index c10538d..0bc93a25 100644
+--- a/base/win/win_util.h
++++ b/base/win/win_util.h
+@@ -49,6 +49,25 @@
+ 
+ namespace win {
+ 
++inline bool IsPseudoHandle(HANDLE h) {
++  // Note that there appears to be no official documentation covering the
++  // existence of specific pseudo handle values. In practice it's clear that
++  // e.g. -1 is the current process, -2 is the current thread, etc. The largest
++  // negative value known to be an issue with DuplicateHandle in fuzzers is
++  // -12.
++  //
++  // Note that there is virtually no risk of a real handle value falling within
++  // this range and being misclassified as a pseudo handle.
++  //
++  // Cast through uintptr_t and then unsigned int to make the truncation to
++  // 32 bits explicit. Handles are size of-pointer but are always 32-bit values.
++  // https://msdn.microsoft.com/en-us/library/aa384203(VS.85).aspx says:
++  // 64-bit versions of Windows use 32-bit handles for interoperability.
++  constexpr int kMinimumKnownPseudoHandleValue = -12;
++  const auto value = static_cast<int32_t>(reinterpret_cast<uintptr_t>(h));
++  return value < 0 && value >= kMinimumKnownPseudoHandleValue;
++}
++
+ inline uint32_t HandleToUint32(HANDLE h) {
+   // Cast through uintptr_t and then unsigned int to make the truncation to
+   // 32 bits explicit. Handles are size of-pointer but are always 32-bit values.
+diff --git a/base/win/win_util_unittest.cc b/base/win/win_util_unittest.cc
+index 70eedf10..f8bbc0b 100644
+--- a/base/win/win_util_unittest.cc
++++ b/base/win/win_util_unittest.cc
+@@ -91,6 +91,12 @@
+   EXPECT_EQ(INVALID_HANDLE_VALUE, Uint32ToHandle(invalid_handle));
+ }
+ 
++TEST(BaseWinUtilTest, PseudoHandles) {
++  EXPECT_TRUE(IsPseudoHandle(::GetCurrentProcess()));
++  EXPECT_TRUE(IsPseudoHandle(::GetCurrentThread()));
++  EXPECT_FALSE(IsPseudoHandle(nullptr));
++}
++
+ TEST(BaseWinUtilTest, WStringFromGUID) {
+   const GUID kGuid = {0x7698f759,
+                       0xf5b0,
+diff --git a/mojo/core/ipcz_driver/transport.cc b/mojo/core/ipcz_driver/transport.cc
+index 96918f8..d1e3286 100644
+--- a/mojo/core/ipcz_driver/transport.cc
++++ b/mojo/core/ipcz_driver/transport.cc
+@@ -34,6 +34,7 @@
+ #include "third_party/ipcz/include/ipcz/ipcz.h"
+ 
+ #if BUILDFLAG(IS_WIN)
++#include "base/win/win_util.h"
+ #include "mojo/public/cpp/platform/platform_handle_security_util_win.h"
+ #endif
+ 
+@@ -135,10 +136,12 @@
+                   HandleOwner handle_owner,
+                   HandleData& out_handle_data,
+                   bool is_remote_process_untrusted) {
++  CHECK(handle.is_valid());
+   // Duplicating INVALID_HANDLE_VALUE passes a process handle. If you intend to
+   // do this, you must open a valid process handle, not pass the result of
+-  // GetCurrentProcess(). e.g. https://crbug.com/243339.
+-  CHECK(handle.is_valid());
++  // GetCurrentProcess() or GetCurrentThread(). e.g. https://crbug.com/243339.
++  CHECK(!handle.is_pseudo_handle());
++
+   if (handle_owner == HandleOwner::kSender) {
+     // Nothing to do when sending handles that belong to us. The recipient must
+     // be sufficiently privileged and equipped to duplicate such handles to
+@@ -178,6 +181,10 @@
+                             HandleOwner handle_owner,
+                             Transport& from_transport) {
+   const HANDLE handle = DataToHandle(data);
++  // Do not decode sentinel values used by Windows (INVALID_HANDLE_VALUE &
++  // GetCurrentThread()).
++  CHECK(!base::win::IsPseudoHandle(handle));
++
+   if (handle_owner == HandleOwner::kRecipient) {
+     if (from_transport.destination_type() != Transport::kBroker &&
+         !from_transport.is_peer_trusted() && !remote_process.is_current()) {
+diff --git a/mojo/core/platform_handle_in_transit.cc b/mojo/core/platform_handle_in_transit.cc
+index 44330d2..670dca4 100644
+--- a/mojo/core/platform_handle_in_transit.cc
++++ b/mojo/core/platform_handle_in_transit.cc
+@@ -18,6 +18,7 @@
+ 
+ #include "base/win/nt_status.h"
+ #include "base/win/scoped_handle.h"
++#include "base/win/win_util.h"
+ #include "mojo/public/cpp/platform/platform_handle_security_util_win.h"
+ #endif
+ 
+@@ -37,8 +38,8 @@
+ 
+   // Duplicating INVALID_HANDLE_VALUE passes a process handle. If you intend to
+   // do this, you must open a valid process handle, not pass the result of
+-  // GetCurrentProcess(). e.g. https://crbug.com/243339.
+-  CHECK(handle != INVALID_HANDLE_VALUE);
++  // GetCurrentProcess() or GetCurrentThread(). e.g. https://crbug.com/243339.
++  CHECK(!base::win::IsPseudoHandle(handle));
+ 
+   HANDLE out_handle;
+   BOOL result =
+@@ -164,17 +165,7 @@
+ #if BUILDFLAG(IS_WIN)
+ // static
+ bool PlatformHandleInTransit::IsPseudoHandle(HANDLE handle) {
+-  // Note that there appears to be no official documentation covering the
+-  // existence of specific pseudo handle values. In practice it's clear that
+-  // e.g. -1 is the current process, -2 is the current thread, etc. The largest
+-  // negative value known to be an issue with DuplicateHandle in the fuzzer is
+-  // -12.
+-  //
+-  // Note that there is virtually no risk of a real handle value falling within
+-  // this range and being misclassified as a pseudo handle.
+-  constexpr int kMinimumKnownPseudoHandleValue = -12;
+-  const auto value = static_cast<int32_t>(reinterpret_cast<uintptr_t>(handle));
+-  return value < 0 && value >= kMinimumKnownPseudoHandleValue;
++  return base::win::IsPseudoHandle(handle);
+ }
+ 
+ // static
+diff --git a/mojo/public/cpp/platform/platform_handle.h b/mojo/public/cpp/platform/platform_handle.h
+index 7154aeb..3390540d 100644
+--- a/mojo/public/cpp/platform/platform_handle.h
++++ b/mojo/public/cpp/platform/platform_handle.h
+@@ -13,6 +13,7 @@
+ 
+ #if BUILDFLAG(IS_WIN)
+ #include "base/win/scoped_handle.h"
++#include "base/win/win_util.h"
+ #elif BUILDFLAG(IS_FUCHSIA)
+ #include <lib/zx/handle.h>
+ #elif BUILDFLAG(IS_APPLE)
+@@ -117,6 +118,9 @@
+   bool is_valid() const { return is_valid_handle(); }
+   bool is_valid_handle() const { return handle_.IsValid(); }
+   bool is_handle() const { return type_ == Type::kHandle; }
++  bool is_pseudo_handle() const {
++    return base::win::IsPseudoHandle(handle_.get());
++  }
+   const base::win::ScopedHandle& GetHandle() const { return handle_; }
+   base::win::ScopedHandle TakeHandle() {
+     DCHECK_EQ(type_, Type::kHandle);

script/lint.js

@@ -278,7 +278,7 @@ const LINTERS = [{
 }, {
   key: 'md',
   roots: ['.'],
-  ignoreRoots: ['node_modules', 'spec/node_modules'],
+  ignoreRoots: ['.git', 'node_modules', 'spec/node_modules'],
   test: filename => filename.endsWith('.md'),
   run: async (opts, filenames) => {
     let errors = false;

shell/browser/api/electron_api_app.h

@@ -33,10 +33,6 @@ namespace base {
 class FilePath;
 }
 
-namespace gfx {
-class Image;
-}
-
 namespace gin {
 template <typename T>
 class Handle;
@@ -64,9 +60,6 @@ class App final : public ElectronBrowserClient::Delegate,
                   private content::GpuDataManagerObserver,
                   private content::BrowserChildProcessObserver {
  public:
-  using FileIconCallback =
-      base::RepeatingCallback<void(v8::Local<v8::Value>, const gfx::Image&)>;
-
   static gin::Handle<App> Create(v8::Isolate* isolate);
   static App* Get();
 

shell/browser/api/electron_api_global_shortcut.cc

@@ -6,6 +6,7 @@
 
 #include <vector>
 
+#include "base/containers/map_util.h"
 #include "extensions/common/command.h"
 #include "gin/dictionary.h"
 #include "gin/handle.h"
@@ -52,12 +53,13 @@ GlobalShortcut::~GlobalShortcut() {
 }
 
 void GlobalShortcut::OnKeyPressed(const ui::Accelerator& accelerator) {
-  if (!accelerator_callback_map_.contains(accelerator)) {
+  if (auto* cb = base::FindOrNull(accelerator_callback_map_, accelerator)) {
+    cb->Run();
+  } else {
     // This should never occur, because if it does, GlobalShortcutListener
     // notifies us with wrong accelerator.
     NOTREACHED();
   }
-  accelerator_callback_map_[accelerator].Run();
 }
 
 bool GlobalShortcut::RegisterAll(

shell/browser/native_window.cc

@@ -96,8 +96,6 @@ const char kElectronNativeWindowKey[] = "__ELECTRON_NATIVE_WINDOW__";
 NativeWindow::NativeWindow(const gin_helper::Dictionary& options,
                            NativeWindow* parent)
     : widget_(std::make_unique<views::Widget>()), parent_(parent) {
-  ++next_id_;
-
   options.Get(options::kFrame, &has_frame_);
   options.Get(options::kTransparent, &transparent_);
   options.Get(options::kEnableLargerThanScreen, &enable_larger_than_screen_);
@@ -809,9 +807,6 @@ void NativeWindow::HandlePendingFullscreenTransitions() {
   SetFullScreen(next_transition);
 }
 
-// static
-int32_t NativeWindow::next_id_ = 0;
-
 bool NativeWindow::IsTranslucent() const {
   // Transparent windows are translucent
   if (transparent()) {

shell/browser/native_window.h

@@ -400,7 +400,7 @@ class NativeWindow : public base::SupportsUserData,
   NativeWindow* parent() const { return parent_; }
   bool is_modal() const { return is_modal_; }
 
-  int32_t window_id() const { return next_id_; }
+  int32_t window_id() const { return window_id_; }
 
   void add_child_window(NativeWindow* child) {
     child_windows_.push_back(child);
@@ -463,7 +463,8 @@ class NativeWindow : public base::SupportsUserData,
  private:
   std::unique_ptr<views::Widget> widget_;
 
-  static int32_t next_id_;
+  static inline int32_t next_id_ = 0;
+  const int32_t window_id_ = ++next_id_;
 
   // The content view, weak ref.
   raw_ptr<views::View> content_view_ = nullptr;

shell/browser/ui/cocoa/electron_ns_window_delegate.mm

@@ -221,6 +221,12 @@ using FullScreenTransitionState =
   [super windowDidResize:notification];
   shell_->NotifyWindowResize();
   shell_->RedrawTrafficLights();
+  // When reduce motion is enabled windowDidResize is only called once after
+  // a resize and windowDidEndLiveResize is not called. So we need to call
+  // handleZoomEnd here as well.
+  if (NSWorkspace.sharedWorkspace.accessibilityDisplayShouldReduceMotion) {
+    [self handleZoomEnd];
+  }
 }
 
 - (void)windowWillMove:(NSNotification*)notification {
@@ -276,9 +282,7 @@ using FullScreenTransitionState =
   return YES;
 }
 
-- (void)windowDidEndLiveResize:(NSNotification*)notification {
-  resizingHorizontally_.reset();
-  shell_->NotifyWindowResized();
+- (void)handleZoomEnd {
   if (is_zooming_) {
     if (shell_->IsMaximized())
       shell_->NotifyWindowMaximize();
@@ -288,6 +292,12 @@ using FullScreenTransitionState =
   }
 }
 
+- (void)windowDidEndLiveResize:(NSNotification*)notification {
+  resizingHorizontally_.reset();
+  shell_->NotifyWindowResized();
+  [self handleZoomEnd];
+}
+
 - (void)windowWillEnterFullScreen:(NSNotification*)notification {
   // Store resizable mask so it can be restored after exiting fullscreen.
   is_resizable_ = shell_->HasStyleMask(NSWindowStyleMaskResizable);

shell/browser/ui/electron_desktop_window_tree_host_linux.cc

@@ -203,7 +203,7 @@ void ElectronDesktopWindowTreeHostLinux::UpdateFrameHints() {
     if (ui::OzonePlatform::GetInstance()->IsWindowCompositingSupported()) {
       // Set the opaque region.
       std::vector<gfx::Rect> opaque_region;
-      if (!IsShowingFrame()) {
+      if (IsShowingFrame()) {
         // The opaque region is a list of rectangles that contain only fully
         // opaque pixels of the window.  We need to convert the clipping
         // rounded-rect into this format.

shell/common/platform_util_linux.cc

@@ -13,6 +13,7 @@
 
 #include "base/cancelable_callback.h"
 #include "base/containers/contains.h"
+#include "base/containers/map_util.h"
 #include "base/environment.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_file.h"
@@ -55,6 +56,8 @@ const char kFreedesktopPortalName[] = "org.freedesktop.portal.Desktop";
 const char kFreedesktopPortalPath[] = "/org/freedesktop/portal/desktop";
 const char kFreedesktopPortalOpenURI[] = "org.freedesktop.portal.OpenURI";
 
+const char kOriginalXdgCurrentDesktopEnvVar[] = "ORIGINAL_XDG_CURRENT_DESKTOP";
+
 const char kMethodOpenDirectory[] = "OpenDirectory";
 
 class ShowItemHelper {
@@ -279,6 +282,12 @@ bool XDGUtil(const std::vector<std::string>& argv,
     base::nix::CreateLaunchOptionsWithXdgActivation(base::BindOnce(
         [](base::RepeatingClosure quit_loop, base::LaunchOptions* options_out,
            base::LaunchOptions options) {
+          // Correct the XDG_CURRENT_DESKTOP environment variable before calling
+          // XDG, in case it was changed for compatibility.
+          if (const auto* orig = base::FindOrNull(
+                  options.environment, kOriginalXdgCurrentDesktopEnvVar))
+            options.environment.emplace(base::nix::kXdgCurrentDesktopEnvVar,
+                                        *orig);
           *options_out = std::move(options);
           std::move(quit_loop).Run();
         },

shell/renderer/web_worker_observer.cc

@@ -4,10 +4,12 @@
 
 #include "shell/renderer/web_worker_observer.h"
 
+#include <string_view>
 #include <utility>
 
 #include "base/no_destructor.h"
 #include "base/ranges/algorithm.h"
+#include "base/strings/strcat.h"
 #include "base/threading/thread_local.h"
 #include "shell/common/api/electron_bindings.h"
 #include "shell/common/gin_helper/event_emitter_caller.h"
@@ -70,15 +72,14 @@ void WebWorkerObserver::WorkerScriptReadyForEvaluation(
   // is loaded. See corresponding change in node/init.ts.
   v8::Local<v8::Object> global = worker_context->Global();
 
-  std::vector<std::string> keys = {"fetch",   "Response", "FormData",
-                                   "Request", "Headers",  "EventSource"};
-  for (const auto& key : keys) {
+  for (const std::string_view key :
+       {"fetch", "Response", "FormData", "Request", "Headers", "EventSource"}) {
     v8::MaybeLocal<v8::Value> value =
-        global->Get(worker_context, gin::StringToV8(isolate, key.c_str()));
+        global->Get(worker_context, gin::StringToV8(isolate, key));
     if (!value.IsEmpty()) {
-      std::string blink_key = "blink" + key;
+      std::string blink_key = base::StrCat({"blink", key});
       global
-          ->Set(worker_context, gin::StringToV8(isolate, blink_key.c_str()),
+          ->Set(worker_context, gin::StringToV8(isolate, blink_key),
                 value.ToLocalChecked())
           .Check();
     }