Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(354)

Issue 2892253002: Fix for GuestView exposure through shift(). (Closed)

Created:
3 years, 7 months ago by paulmeyer
Modified:
3 years, 7 months ago
Reviewers:
lazyboy
CC:
chromium-reviews, chromium-apps-reviews_chromium.org, extensions-reviews_chromium.org
Target Ref:
refs/heads/master
Project:
chromium
Visibility:
Public.

Description

Fix for GuestView exposure through shift(). This patch converts all uses of shift() in the GuestView JavaScript objects to use $Array.shift() instead. This will prevent GuestView JavaScript objects from being exposed via overriding shift(). This patch also utilizes a weak pointer in GuestViewContainer::OnHandleCallback() to ensure that |this| has not been deleted in the callback, thus preventing further use-after-free bugs of this type. BUG=718292 Review-Url: https://codereview.chromium.org/2892253002 Cr-Commit-Position: refs/heads/master@{#474765} Committed: https://chromium.googlesource.com/chromium/src/+/c3e0f34012c116cbfefa64683ac33f5ebe621618

Patch Set 1 #

Total comments: 1

Patch Set 2 : Removed WeakPtr from this patch. #

Unified diffs Side-by-side diffs Delta from patch set Stats (+4 lines, -3 lines) Patch
M extensions/renderer/resources/guest_view/extension_view/extension_view.js View 1 chunk +1 line, -1 line 0 comments Download
M extensions/renderer/resources/guest_view/guest_view.js View 1 chunk +1 line, -1 line 0 comments Download
M extensions/renderer/safe_builtins.cc View 1 chunk +2 lines, -1 line 0 comments Download

Messages

Total messages: 18 (11 generated)
paulmeyer
3 years, 7 months ago (2017-05-24 15:42:06 UTC) #5
lazyboy
The shift change looks good, however you should extract the WeakPtr CL separately to Lucas/James. ...
3 years, 7 months ago (2017-05-25 18:04:02 UTC) #8
commit-bot: I haz the power
CQ is trying da patch. Follow status at: https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2892253002/40001
3 years, 7 months ago (2017-05-25 18:26:07 UTC) #10
commit-bot: I haz the power
No L-G-T-M from a valid reviewer yet. CQ run can only be started once the ...
3 years, 7 months ago (2017-05-25 18:26:09 UTC) #12
lazyboy
lgtm
3 years, 7 months ago (2017-05-25 18:30:34 UTC) #13
commit-bot: I haz the power
CQ is trying da patch. Follow status at: https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2892253002/40001
3 years, 7 months ago (2017-05-25 19:02:25 UTC) #15
commit-bot: I haz the power
3 years, 7 months ago (2017-05-25 19:57:42 UTC) #18
Message was sent while issue was closed.
Committed patchset #2 (id:40001) as
https://chromium.googlesource.com/chromium/src/+/c3e0f34012c116cbfefa64683ac3...

Powered by Google App Engine
This is Rietveld 408576698