mirror of
https://github.com/electron/electron.git
synced 2026-01-09 15:38:08 -05:00
08a51f3339
* chore: bump chromium in DEPS to 121.0.6154.0
* chore: bump chromium in DEPS to 121.0.6155.0
* fix patches
* chore: update patches
* patch out reference to GetOcclusionTracker
* un-flag PIPOcclusionTracker
* chore: bump chromium in DEPS to 121.0.6157.0
* fix conflicts
https://chromium-review.googlesource.com/c/chromium/src/+/5038807
* add PIP occlusion tracker sources to chromium_src
* 5037591: Replace feature_list's Initialize* methods with Init*.
https://chromium-review.googlesource.com/c/chromium/src/+/5037591
* 4811903: Move //content/browser/renderer_host/input/synthetic_gesture_controller to //content/common/input
https://chromium-review.googlesource.com/c/chromium/src/+/4811903
* 4917953: usb: Add usb-unrestricted to permission policy
https://chromium-review.googlesource.com/c/chromium/src/+/4917953
* 5072395: Remove unused `creation_context` parameter from blink/public APIs
https://chromium-review.googlesource.com/c/chromium/src/+/5072395
* 5052035: [X11] Change AtomCache from a singleton to owned by Connection
https://chromium-review.googlesource.com/c/chromium/src/+/5052035
* fix v8/.patches
* node script/gen-libc++-filenames.js
* 5035771: Remove the SetImage method of ImageButton
https://chromium-review.googlesource.com/c/chromium/src/+/5035771
* fixup! 5052035: [X11] Change AtomCache from a singleton to owned by Connection
* fixup! 5035771: Remove the SetImage method of ImageButton
* chore: bump chromium in DEPS to 121.0.6159.0
* 4505903: [Extensions] Add lastAccessed property to chrome.tabs.Tab
https://chromium-review.googlesource.com/c/chromium/src/+/4505903
* update patches
* don't duplicate tabs API types
this causes weird memory bugs if the two get out of sync
* fix UAF in TrayIconCocoa
not sure why this is popping up just now ... this has been broken for ages afaict
* Revert "don't duplicate tabs API types"
This reverts commit 80dff2efaa.
This is failing tests with extensions API schema check failures, so
revert for now. we'll fix it later.
* revert v8 change causing node crashes
* chore: reduce diffs in revert_api_dcheck-fail_when_we_reenter_v8_while_terminating.patch
---------
Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Jeremy Rose <jeremya@chromium.org>
Co-authored-by: PatchUp <73610968+patchup[bot]@users.noreply.github.com>
Co-authored-by: clavin <clavin@electronjs.org>
Co-authored-by: Charles Kerr <charles@charleskerr.com>
68 lines
3.6 KiB
Diff
68 lines
3.6 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Shelley Vohr <shelley.vohr@gmail.com>
|
|
Date: Mon, 29 Aug 2022 11:44:57 +0200
|
|
Subject: fix: crash loading non-standard schemes in iframes
|
|
|
|
This fixes a crash that occurs when loading non-standard schemes from
|
|
iframes or webviews. This was happening because
|
|
ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin contains explicit
|
|
exceptions to allow built-in non-standard schemes, but does not check
|
|
for non-standard schemes registered by the embedder.
|
|
|
|
This patch adjusts the origin calculation for non-standard schemes in
|
|
- browser process at `NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo`
|
|
- render process at `DocumentLoader::CalculateOrigin`
|
|
|
|
When top level frame navigates to non-standard scheme url, the origin is calculated
|
|
as `null` without any derivation. It is only in cases where there is a `initiator_origin`
|
|
then the origin is derived from it, which is usually the case for renderer initiated
|
|
navigations and iframes are no exceptions from this rule.
|
|
|
|
Upstream bug https://bugs.chromium.org/p/chromium/issues/detail?id=1081397.
|
|
|
|
Upstreamed at https://chromium-review.googlesource.com/c/chromium/src/+/3856266.
|
|
|
|
diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
|
|
index 74d589a117309e44c5b625f195edb6a44ee5283e..0a901c70c634a9f236b1e3fae9d0d20cdf2f3078 100644
|
|
--- a/content/browser/renderer_host/navigation_request.cc
|
|
+++ b/content/browser/renderer_host/navigation_request.cc
|
|
@@ -10028,6 +10028,12 @@ NavigationRequest::GetOriginForURLLoaderFactoryUncheckedWithDebugInfo() {
|
|
return std::make_pair(parent->GetLastCommittedOrigin(), "about_srcdoc");
|
|
}
|
|
|
|
+ if (!common_params().url.IsStandard()) {
|
|
+ return std::make_pair(url::Origin::Resolve(common_params().url,
|
|
+ url::Origin()),
|
|
+ "url_non_standard");
|
|
+ }
|
|
+
|
|
// In cases not covered above, URLLoaderFactory should be associated with the
|
|
// origin of |common_params.url| and/or |common_params.initiator_origin|.
|
|
url::Origin resolved_origin = url::Origin::Resolve(
|
|
diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
|
|
index 96f83f7afba6baa54eda98beadd350eec0a86e2a..d4f06da5914f724525722af8f9e9e9b0b08384e5 100644
|
|
--- a/third_party/blink/renderer/core/loader/document_loader.cc
|
|
+++ b/third_party/blink/renderer/core/loader/document_loader.cc
|
|
@@ -2125,6 +2125,10 @@ Frame* DocumentLoader::CalculateOwnerFrame() {
|
|
scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
|
|
Document* owner_document) {
|
|
scoped_refptr<SecurityOrigin> origin;
|
|
+ bool is_standard = false;
|
|
+ std::string protocol = url_.Protocol().Ascii();
|
|
+ is_standard = url::IsStandard(
|
|
+ protocol.data(), url::Component(0, static_cast<int>(protocol.size())));
|
|
StringBuilder debug_info_builder;
|
|
if (origin_to_commit_) {
|
|
// Origin to commit is specified by the browser process, it must be taken
|
|
@@ -2172,6 +2176,10 @@ scoped_refptr<SecurityOrigin> DocumentLoader::CalculateOrigin(
|
|
debug_info_builder.Append(", url=");
|
|
debug_info_builder.Append(owner_document->Url().BaseAsString());
|
|
debug_info_builder.Append(")");
|
|
+ } else if (!SecurityOrigin::ShouldUseInnerURL(url_) &&
|
|
+ !is_standard) {
|
|
+ debug_info_builder.Append("use_url_with_non_standard_scheme");
|
|
+ origin = SecurityOrigin::Create(url_);
|
|
} else {
|
|
debug_info_builder.Append("use_url_with_precursor");
|
|
// Otherwise, create an origin that propagates precursor information
|