[Extensions] Don't allow built-in extensions code to be overridden

extensions/renderer/module_system.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/module_system.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
@@ skipping 78 matching lines @@
       v8::String::Utf8Value stack_value(v8_stack_trace);
       if (*stack_value)
         stack_trace.assign(*stack_value, stack_value.length());
       else
         stack_trace = "<could not convert stack trace to string>";
     }
     Fatal(context_, CreateExceptionString(try_catch) + "{" + stack_trace + "}");
   }
 };
 
+// Sets a property on the "exports" object for bindings. Called by JS with
+// exports.$set(<key>, <value>).
+void SetExportsProperty(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  v8::Local<v8::Object> obj = args.This();
+  DCHECK_EQ(2, args.Length());
+  DCHECK(args[0]->IsString());
+  obj->ForceSet(args[0], args[1], v8::ReadOnly);

[Devlin, 2015/10/23 22:08:28]

This works, but it looks like ForceSet() is deprecated.  What's the alternative?
 (Set() will just hit the custom setter, so that doesn't work.)

Another approach would be using the safe-builtin $Object.defineProperty() in the
.js files - but I was struggling to find a way to put that into a function that
could be passed in in WrapSource().

[jochen (gone - plz use gerrit), 2015/10/26 15:46:54]

You'd use v8::Object::DefineOwnProperty()

[Devlin, 2015/10/27 23:08:54]

Ah, for some reason I thought that would hit the accessor, but looks like it
works.

+}
+
 }  // namespace
 
 std::string ModuleSystem::ExceptionHandler::CreateExceptionString(
     const v8::TryCatch& try_catch) {
   v8::Local<v8::Message> message(try_catch.Message());
   if (message.IsEmpty()) {
     return "try_catch has no message";
   }
 
   std::string resource_name = "<unknown resource>";
@@ skipping 526 matching lines @@
   if (func_as_value.IsEmpty() || func_as_value->IsUndefined()) {
     Fatal(context_, "Bad source for require(" + module_name + ")");
     return v8::Undefined(GetIsolate());
   }
 
   v8::Local<v8::Function> func = v8::Local<v8::Function>::Cast(func_as_value);
 
   v8::Local<v8::Object> define_object = v8::Object::New(GetIsolate());
   gin::ModuleRegistry::InstallGlobals(GetIsolate(), define_object);
 
-  v8::Local<v8::Value> exports = v8::Object::New(GetIsolate());
+  v8::Local<v8::Object> exports = v8::Object::New(GetIsolate());
+
+  v8::Local<v8::FunctionTemplate> tmpl = v8::FunctionTemplate::New(
+      GetIsolate(),
+      &SetExportsProperty);
+  v8::Local<v8::String> v8_key;
+  if (!v8_helpers::ToV8String(GetIsolate(), "$set", &v8_key)) {
+    NOTREACHED();
+    return v8::Undefined(GetIsolate());
+  }
+
+  v8::Local<v8::Function> function;
+  if (!tmpl->GetFunction(v8_context).ToLocal(&function)) {
+    NOTREACHED();
+    return v8::Undefined(GetIsolate());
+  }
+
+  exports->ForceSet(v8_key, function, v8::ReadOnly);
+
   v8::Local<v8::Object> natives(NewInstance());
   CHECK(!natives.IsEmpty());  // this can fail if v8 has issues
 
   // These must match the argument order in WrapSource.
   v8::Local<v8::Value> args[] = {
       // AMD.
       GetPropertyUnsafe(v8_context, define_object, "define"),
       // CommonJS.
       GetPropertyUnsafe(v8_context, natives, "require",
                         v8::NewStringType::kInternalized),
@@ skipping 61 matching lines @@
 
 void ModuleSystem::ClobberExistingNativeHandler(const std::string& name) {
   NativeHandlerMap::iterator existing_handler = native_handler_map_.find(name);
   if (existing_handler != native_handler_map_.end()) {
     clobbered_native_handlers_.push_back(existing_handler->second);
     native_handler_map_.erase(existing_handler);
   }
 }
 
 }  // namespace extensions