Merge 48667 - Prevent extensions from clobbering JSON implementation that ext...

chrome/renderer/resources/event_bindings.js

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var chrome = chrome || {};
 (function () {
   native function GetChromeHidden();
   native function AttachEvent(eventName);
   native function DetachEvent(eventName);
 
   var chromeHidden = GetChromeHidden();
+  
+  // Local implementation of JSON.parse & JSON.stringify that protect us
+  // from being clobbered by an extension.
+  chromeHidden.JSON = new (function() {
+    const $Object = Object;
+    const $Array = Array;
+    const $jsonStringify = JSON.stringify;
+    const $jsonParse = JSON.parse;
+
+    this.stringify = function(thing) {
+      var customizedObjectToJSON = $Object.prototype.toJSON;
+      var customizedArrayToJSON = $Array.prototype.toJSON;
+      if (customizedObjectToJSON !== undefined) {
+        $Object.prototype.toJSON = null;
+      }
+      if (customizedArrayToJSON !== undefined) {
+        $Array.prototype.toJSON = null;
+      }
+      try {
+        return $jsonStringify(thing);
+      } finally {
+        if (customizedObjectToJSON !== undefined) {
+          $Object.prototype.toJSON = customizedObjectToJSON;
+        }
+        if (customizedArrayToJSON !== undefined) {
+          $Array.prototype.toJSON = customizedArrayToJSON;
+        }
+      }
+    };
+
+    this.parse = function(thing) {
+      return $jsonParse(thing);
+    };
+  })();
 
   // Event object.  If opt_eventName is provided, this object represents
   // the unique instance of that named event, and dispatching an event
   // with that name will route through this object's listeners.
   //
   // Example:
   //   chrome.tabs.onChanged = new chrome.Event("tab-changed");
   //   chrome.tabs.onChanged.addListener(function(data) { alert(data); });
   //   chromeHidden.Event.dispatch("tab-changed", "hi");
   // will result in an alert dialog that says 'hi'.
@@ skipping 24 matching lines @@
   var allAttachedEvents = [];
 
   chromeHidden.Event = {};
 
   // Dispatches a named event with the given JSON array, which is deserialized
   // before dispatch. The JSON array is the list of arguments that will be
   // sent with the event callback.
   chromeHidden.Event.dispatchJSON = function(name, args) {
     if (attachedNamedEvents[name]) {
       if (args) {
-        args = JSON.parse(args);
+        args = chromeHidden.JSON.parse(args);
       }
       return attachedNamedEvents[name].dispatch.apply(
           attachedNamedEvents[name], args);
     }
   };
 
   // Dispatches a named event with the given arguments, supplied as an array.
   chromeHidden.Event.dispatch = function(name, args) {
     if (attachedNamedEvents[name]) {
       attachedNamedEvents[name].dispatch.apply(
@@ skipping 118 matching lines @@
       var event = allAttachedEvents[i];
       if (event)
         event.detach_();
     }
   }
 
   chromeHidden.dispatchError = function(msg) {
     console.error(msg);
   }
 })();