[Extensions] Don't allow built-in extensions code to be overridden

extensions/renderer/module_system.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/module_system.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/stl_util.h"
@@ skipping 78 matching lines @@
       v8::String::Utf8Value stack_value(v8_stack_trace);
       if (*stack_value)
         stack_trace.assign(*stack_value, stack_value.length());
       else
         stack_trace = "<could not convert stack trace to string>";
     }
     Fatal(context_, CreateExceptionString(try_catch) + "{" + stack_trace + "}");
   }
 };
 
+// Sets a property on the "exports" object for bindings. Called by JS with
+// exports.$set(<key>, <value>).
+void SetExportsProperty(
+    const v8::FunctionCallbackInfo<v8::Value>& args) {
+  v8::Local<v8::Object> obj = args.This();
+  DCHECK_EQ(2, args.Length());
+  DCHECK(args[0]->IsString());
+  v8::Maybe<bool> result =
+      obj->DefineOwnProperty(args.GetIsolate()->GetCallingContext(),

[jochen (gone - plz use gerrit), 2015/10/28 14:22:18]

I know this is copy/paste, but this should really be GetCurrentContext().

[Devlin, 2015/10/28 20:38:17]

Done.  For my own edification, can you explain why?  (Naively, I would think
using the context that called the JS code would be preferred over whichever
context is on the top of the stack.)

[dcheng, 2015/10/30 21:32:59]

https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/aEkGnu1mkBc has
some context which might be helpful.

Disclaimer: I myself find the current vs calling context (and entered vs current
as well:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/SJZVnlbxFOY) to
be quite confusing.

+                             args[0]->ToString(), args[1], v8::ReadOnly);
+  if (!result.IsJust() || !result.FromJust())

[jochen (gone - plz use gerrit), 2015/10/28 14:22:18]

if (!result.FromMaybe(false)) is shorter

[Devlin, 2015/10/28 20:38:18]

Nifty, done.

+    LOG(ERROR) << "Failed to set private property on the export.";
+}
+
 }  // namespace
 
 std::string ModuleSystem::ExceptionHandler::CreateExceptionString(
     const v8::TryCatch& try_catch) {
   v8::Local<v8::Message> message(try_catch.Message());
   if (message.IsEmpty()) {
     return "try_catch has no message";
   }
 
   std::string resource_name = "<unknown resource>";
@@ skipping 526 matching lines @@
   if (func_as_value.IsEmpty() || func_as_value->IsUndefined()) {
     Fatal(context_, "Bad source for require(" + module_name + ")");
     return v8::Undefined(GetIsolate());
   }
 
   v8::Local<v8::Function> func = v8::Local<v8::Function>::Cast(func_as_value);
 
   v8::Local<v8::Object> define_object = v8::Object::New(GetIsolate());
   gin::ModuleRegistry::InstallGlobals(GetIsolate(), define_object);
 
-  v8::Local<v8::Value> exports = v8::Object::New(GetIsolate());
+  v8::Local<v8::Object> exports = v8::Object::New(GetIsolate());
+
+  v8::Local<v8::FunctionTemplate> tmpl = v8::FunctionTemplate::New(
+      GetIsolate(),
+      &SetExportsProperty);
+  v8::Local<v8::String> v8_key;
+  if (!v8_helpers::ToV8String(GetIsolate(), "$set", &v8_key)) {
+    NOTREACHED();
+    return v8::Undefined(GetIsolate());
+  }
+
+  v8::Local<v8::Function> function;
+  if (!tmpl->GetFunction(v8_context).ToLocal(&function)) {
+    NOTREACHED();
+    return v8::Undefined(GetIsolate());
+  }
+
+  exports->ForceSet(v8_key, function, v8::ReadOnly);
+
   v8::Local<v8::Object> natives(NewInstance());
   CHECK(!natives.IsEmpty());  // this can fail if v8 has issues
 
   // These must match the argument order in WrapSource.
   v8::Local<v8::Value> args[] = {
       // AMD.
       GetPropertyUnsafe(v8_context, define_object, "define"),
       // CommonJS.
       GetPropertyUnsafe(v8_context, natives, "require",
                         v8::NewStringType::kInternalized),
@@ skipping 61 matching lines @@
 
 void ModuleSystem::ClobberExistingNativeHandler(const std::string& name) {
   NativeHandlerMap::iterator existing_handler = native_handler_map_.find(name);
   if (existing_handler != native_handler_map_.end()) {
     clobbered_native_handlers_.push_back(existing_handler->second);
     native_handler_map_.erase(existing_handler);
   }
 }
 
 }  // namespace extensions