Files
electron/lib/browser/ipc-main-internal-utils.ts
Samuel Attard 8bdae63036 fix: strictly validate sender for internal IPC reply channels (#50118)
The sender-mismatch check in invokeInWebContents and invokeInWebFrameMain
used a negative condition (`type === 'frame' && sender !== expected`),
which only rejected mismatched frame senders and accepted anything else.

Invert to a positive check so only the exact expected frame can resolve
the reply — matches the guard style used elsewhere in lib/browser/.
2026-03-08 15:39:04 -07:00

63 lines
1.9 KiB
TypeScript

import { ipcMainInternal } from '@electron/internal/browser/ipc-main-internal';
type IPCHandler = (event: ElectronInternal.IpcMainInternalEvent, ...args: any[]) => any
export const handleSync = function <T extends IPCHandler> (channel: string, handler: T) {
ipcMainInternal.on(channel, async (event, ...args) => {
try {
event.returnValue = [null, await handler(event, ...args)];
} catch (error) {
event.returnValue = [error];
}
});
};
let nextId = 0;
export function invokeInWebContents<T> (sender: Electron.WebContents, command: string, ...args: any[]) {
return new Promise<T>((resolve, reject) => {
const requestId = ++nextId;
const channel = `${command}_RESPONSE_${requestId}`;
ipcMainInternal.on(channel, function handler (event, error: Error, result: any) {
if (event.type !== 'frame' || event.sender !== sender) {
console.error(`Reply to ${command} sent by unexpected sender`);
return;
}
ipcMainInternal.removeListener(channel, handler);
if (error) {
reject(error);
} else {
resolve(result);
}
});
sender._sendInternal(command, requestId, ...args);
});
}
export function invokeInWebFrameMain<T> (sender: Electron.WebFrameMain, command: string, ...args: any[]) {
return new Promise<T>((resolve, reject) => {
const requestId = ++nextId;
const channel = `${command}_RESPONSE_${requestId}`;
const frameTreeNodeId = sender.frameTreeNodeId;
ipcMainInternal.on(channel, function handler (event, error: Error, result: any) {
if (event.type !== 'frame' || event.frameTreeNodeId !== frameTreeNodeId) {
console.error(`Reply to ${command} sent by unexpected sender`);
return;
}
ipcMainInternal.removeListener(channel, handler);
if (error) {
reject(error);
} else {
resolve(result);
}
});
sender._sendInternal(command, requestId, ...args);
});
}