Set prototype for GuestView*.prototype to null.

extensions/renderer/resources/guest_view/guest_view_events.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Event management for GuestViewContainers.
 
 var EventBindings = require('event_bindings');
 var GuestViewInternalNatives = requireNative('guest_view_internal');
 var MessagingNatives = requireNative('messaging_natives');
 
 var CreateEvent = function(name) {
   var eventOpts = {supportsListeners: true, supportsFilters: true};
   return new EventBindings.Event(name, undefined, eventOpts);
 };
 
 function GuestViewEvents(view) {
   view.events = this;
 
   this.view = view;
   this.on = {};
 
   // |setupEventProperty| is normally called automatically, but these events are
   // are registered here because they are dispatched from GuestViewContainer
   // instead of in response to extension events.
   this.setupEventProperty('contentresize');
   this.setupEventProperty('resize');
   this.setupEvents();
 }
 
+// Prevent GuestViewEvents inadvertently inheritng code from the global Object,

[lazyboy, 2017/03/13 18:15:14]

OK.
How about adding WebViewActionRequest and guest_view_attributes.js:Attribute as
well? Are there more?

[wjmaclean, 2017/03/13 19:34:48]

Done.

Will update. Yes, we are looking for more, but that search may take a while and
shouldn't block landing this CL.

[lazyboy, 2017/03/13 19:46:06]

Acknowledged.

+// allowing a pathway for unintended execution of user code.
+GuestViewEvents.prototype.__proto__ = null;
+
 // |GuestViewEvents.EVENTS| is a dictionary of extension events to be listened
 //     for, which specifies how each event should be handled. The events are
 //     organized by name, and by default will be dispatched as DOM events with
 //     the same name.
 // |cancelable| (default: false) specifies whether the DOM event's default
 //     behavior can be canceled. If the default action associated with the event
 //     is prevented, then its dispatch function will return false in its event
 //     handler. The event must have a specified |handler| for this to be
 //     meaningful.
 // |evt| specifies a descriptor object for the extension event. An event
@@ skipping 129 matching lines @@
     return $Function.apply(func, view.events, $Array.slice(arguments));
   };
 };
 
 // Implemented by the derived event manager, if one exists.
 GuestViewEvents.prototype.getEvents = function() { return {}; };
 
 // Exports.
 exports.$set('GuestViewEvents', GuestViewEvents);
 exports.$set('CreateEvent', CreateEvent);