Prevent module system from loading arbitrary modules

extensions/renderer/resources/binding.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var Event = require('event_bindings').Event;
 var forEach = require('utils').forEach;
 // Note: Beware sneaky getters/setters when using GetAvailbility(). Use safe/raw
 // variables as arguments.
 var GetAvailability = requireNative('v8_context').GetAvailability;
 var exceptionHandler = require('uncaught_exception_handler');
@@ skipping 148 matching lines @@
 
 function isSchemaNodeSupported(schemaNode, platform, manifestVersion) {
   return isPlatformSupported(schemaNode, platform) &&
       isManifestVersionSupported(schemaNode, manifestVersion);
 }
 
 function createCustomType(type) {
   var jsModuleName = type.js_module;
   logging.CHECK(jsModuleName, 'Custom type ' + type.id +
                 ' has no "js_module" property.');
+  // This list contains all types that has a js_module property. It is ugly to

[Devlin, 2016/04/20 14:12:20]

/sigh... I was trying to avoid doing this, because it seemed like any time we
leak the schema object, we open the door to multiple attacks (not just here), so
this seemed like it was only treating the very specific case.  But, there've
been enough of these that I'm convinced.

+  // hard-code them here, but the number of APIs that use js_module has not
+  // changed since the introduction of js_modules in crbug.com/222156.
+  // This whitelist serves as an extra line of defence to avoid exposing
+  // arbitrary extension modules when the |type| definition is poisoned.
+  var whitelistedModules = [
+    'ChromeDirectSetting',
+    'ChromeSetting',
+    'ContentSetting',
+    'StorageArea',
+  ];
+  logging.CHECK($Array.indexOf(whitelistedModules, jsModuleName) !== -1,
+                'Module ' + jsModuleName + ' does not define a custom type.');
   var jsModule = require(jsModuleName);
   logging.CHECK(jsModule, 'No module ' + jsModuleName + ' found for ' +
                 type.id + '.');
   var customType = jsModule[jsModuleName];
   logging.CHECK(customType, jsModuleName + ' must export itself.');
   customType.prototype = new CustomBindingsObject();
   customType.prototype.setSchema(type);
   return customType;
 }
 
@@ skipping 373 matching lines @@
                     availability.message);
       return;
     }
 
     this.runHooks_(mod, schema);
     return mod;
   }
 };
 
 exports.$set('Binding', Binding);