[Extensions] Update last_error.js, send_request.js

extensions/renderer/resources/send_request.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var exceptionHandler = require('uncaught_exception_handler');
 var lastError = require('lastError');
 var logging = requireNative('logging');
 var natives = requireNative('sendRequest');
 var validate = require('schemaUtils').validate;
 
 // All outstanding requests from sendRequest().
-var requests = {};
+var requests = { __proto__: null };
 
 // Used to prevent double Activity Logging for API calls that use both custom
 // bindings and ExtensionFunctions (via sendRequest).
 var calledSendRequest = false;
 
 // Runs a user-supplied callback safely.
 function safeCallbackApply(name, request, callback, args) {
   try {
     $Function.apply(callback, request, args);
   } catch (e) {
@@ skipping 58 matching lines @@
     }
   } finally {
     delete requests[requestId];
     lastError.clear(chrome);
     if (callerChrome !== chrome)
       lastError.clear(callerChrome);
   }
 }
 
 function prepareRequest(args, argSchemas) {
-  var request = {};
+  var request = { __proto__: null };
   var argCount = args.length;
 
   // Look for callback param.
   if (argSchemas.length > 0 &&
       argSchemas[argSchemas.length - 1].type == "function") {
     request.callback = args[args.length - 1];
     request.callbackSchema = argSchemas[argSchemas.length - 1];
     --argCount;
   }
 
-  request.args = [];
-  for (var k = 0; k < argCount; k++) {
-    request.args[k] = args[k];
-  }
-
+  request.args = $Array.slice(args, 0, argCount);
   return request;
 }
 
 // Send an API request and optionally register a callback.
 // |optArgs| is an object with optional parameters as follows:
 // - customCallback: a callback that should be called instead of the standard
 //   callback.
 // - forIOThread: true if this function should be handled on the browser IO
 //   thread.
 // - preserveNullInObjects: true if it is safe for null to be in objects.
 // - stack: An optional string that contains the stack trace, to be displayed
 //   to the user if an error occurs.
 function sendRequest(functionName, args, argSchemas, optArgs) {
   calledSendRequest = true;
   if (!optArgs)
-    optArgs = {};
+    optArgs = { __proto__: null };
+  logging.DCHECK(optArgs.__proto__ == null);

[robwu, 2016/04/25 22:25:53]

$Object.getPrototypeOf(optArgs) === null

If not set, __proto__ can be spoofed.

[Devlin, 2016/04/25 22:35:00]

I had thought about that, but this is only to check our own code for issues.  If
anyone can call sendRequest but us, we're already in a bad state.  This is just
to verify that our own callsites are correct, and, for that, this is sufficient.
 Can you think of a counter case where doing $Object.getPrototypeOf() would be
more helpful?

[robwu, 2016/04/25 22:53:27]

It's just a debug assertion, so it doesn't matter.

   var request = prepareRequest(args, argSchemas);
   request.stack = optArgs.stack || exceptionHandler.getExtensionStackTrace();
   if (optArgs.customCallback) {
     request.customCallback = optArgs.customCallback;
   }
 
   var hasCallback = request.callback || optArgs.customCallback;
   var requestId =
       natives.StartRequest(functionName, request.args, hasCallback,
                            optArgs.forIOThread, optArgs.preserveNullInObjects);
   request.id = requestId;
   requests[requestId] = request;
 }
 
 function getCalledSendRequest() {
   return calledSendRequest;
 }
 
 function clearCalledSendRequest() {
   calledSendRequest = false;
 }
 
 exports.$set('sendRequest', sendRequest);
 exports.$set('getCalledSendRequest', getCalledSendRequest);
 exports.$set('clearCalledSendRequest', clearCalledSendRequest);
 exports.$set('safeCallbackApply', safeCallbackApply);
 
 // Called by C++.
 exports.$set('handleResponse', handleResponse);