From d1c9f5e309352a300232aedb3bf4b5424283da1a Mon Sep 17 00:00:00 2001
From: Milan Burda <milan.burda@gmail.com>
Date: Wed, 17 Jul 2019 02:13:05 +0200
Subject: [PATCH] fix: don't execute preload scripts for internal <iframe> in
 <webview> (#19260)

---
 shell/renderer/atom_render_frame_observer.cc  |  3 +-
 shell/renderer/atom_renderer_client.cc        |  3 +-
 .../atom_sandboxed_renderer_client.cc         |  3 +-
 shell/renderer/renderer_client_base.cc        | 24 ++++++++++++++
 shell/renderer/renderer_client_base.h         |  4 +++
 spec/api-subframe-spec.js                     | 33 +++++++++++++++++++
 .../sub-frames/webview-iframe-preload.js      | 14 ++++++++
 7 files changed, 81 insertions(+), 3 deletions(-)
 create mode 100644 spec/fixtures/sub-frames/webview-iframe-preload.js

diff --git a/shell/renderer/atom_render_frame_observer.cc b/shell/renderer/atom_render_frame_observer.cc
index 926ad477252db..a22667f16ea5f 100644
--- a/shell/renderer/atom_render_frame_observer.cc
+++ b/shell/renderer/atom_render_frame_observer.cc
@@ -81,7 +81,8 @@ void AtomRenderFrameObserver::DidCreateScriptContext(
 
   if (should_create_isolated_context) {
     CreateIsolatedWorldContext();
-    renderer_client_->SetupMainWorldOverrides(context, render_frame_);
+    if (!renderer_client_->IsWebViewFrame(context, render_frame_))
+      renderer_client_->SetupMainWorldOverrides(context, render_frame_);
   }
 
   if (world_id >= World::ISOLATED_WORLD_EXTENSIONS &&
diff --git a/shell/renderer/atom_renderer_client.cc b/shell/renderer/atom_renderer_client.cc
index a25ce6c68e67d..e74d70a3a42b1 100644
--- a/shell/renderer/atom_renderer_client.cc
+++ b/shell/renderer/atom_renderer_client.cc
@@ -83,7 +83,8 @@ void AtomRendererClient::DidCreateScriptContext(
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kNodeIntegrationInSubFrames);
   bool should_load_node =
-      is_main_frame || is_devtools || allow_node_in_subframes;
+      (is_main_frame || is_devtools || allow_node_in_subframes) &&
+      !IsWebViewFrame(renderer_context, render_frame);
   if (!should_load_node) {
     return;
   }
diff --git a/shell/renderer/atom_sandboxed_renderer_client.cc b/shell/renderer/atom_sandboxed_renderer_client.cc
index 071112578968d..689373b26b3d2 100644
--- a/shell/renderer/atom_sandboxed_renderer_client.cc
+++ b/shell/renderer/atom_sandboxed_renderer_client.cc
@@ -208,7 +208,8 @@ void AtomSandboxedRendererClient::DidCreateScriptContext(
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kNodeIntegrationInSubFrames);
   bool should_load_preload =
-      is_main_frame || is_devtools || allow_node_in_sub_frames;
+      (is_main_frame || is_devtools || allow_node_in_sub_frames) &&
+      !IsWebViewFrame(context, render_frame);
   if (!should_load_preload)
     return;
 
diff --git a/shell/renderer/renderer_client_base.cc b/shell/renderer/renderer_client_base.cc
index b88fccf74a1a9..b8b600a66050c 100644
--- a/shell/renderer/renderer_client_base.cc
+++ b/shell/renderer/renderer_client_base.cc
@@ -310,4 +310,28 @@ v8::Local<v8::Value> RendererClientBase::RunScript(
   return script->Run(context).ToLocalChecked();
 }
 
+bool RendererClientBase::IsWebViewFrame(
+    v8::Handle<v8::Context> context,
+    content::RenderFrame* render_frame) const {
+  auto* isolate = context->GetIsolate();
+
+  if (render_frame->IsMainFrame())
+    return false;
+
+  mate::Dictionary window_dict(
+      isolate, GetContext(render_frame->GetWebFrame(), isolate)->Global());
+
+  v8::Local<v8::Object> frame_element;
+  if (!window_dict.Get("frameElement", &frame_element))
+    return false;
+
+  mate::Dictionary frame_element_dict(isolate, frame_element);
+
+  v8::Local<v8::Object> internal;
+  if (!frame_element_dict.GetHidden("internal", &internal))
+    return false;
+
+  return !internal.IsEmpty();
+}
+
 }  // namespace electron
diff --git a/shell/renderer/renderer_client_base.h b/shell/renderer/renderer_client_base.h
index 970d3db01ccdc..15397933fa53b 100644
--- a/shell/renderer/renderer_client_base.h
+++ b/shell/renderer/renderer_client_base.h
@@ -45,6 +45,10 @@ class RendererClientBase : public content::ContentRendererClient {
   static v8::Local<v8::Value> RunScript(v8::Local<v8::Context> context,
                                         v8::Local<v8::String> source);
 
+  // v8Util.getHiddenValue(window.frameElement, 'internal')
+  bool IsWebViewFrame(v8::Handle<v8::Context> context,
+                      content::RenderFrame* render_frame) const;
+
  protected:
   void AddRenderBindings(v8::Isolate* isolate,
                          v8::Local<v8::Object> binding_object);
diff --git a/spec/api-subframe-spec.js b/spec/api-subframe-spec.js
index 142a4e5c167ee..bf1b11418c7a2 100644
--- a/spec/api-subframe-spec.js
+++ b/spec/api-subframe-spec.js
@@ -149,6 +149,39 @@ describe('renderer nodeIntegrationInSubFrames', () => {
   ).forEach(config => {
     generateTests(config.title, config.webPreferences)
   })
+
+  describe('internal <iframe> inside of <webview>', () => {
+    let w
+
+    beforeEach(async () => {
+      await closeWindow(w)
+      w = new BrowserWindow({
+        show: false,
+        width: 400,
+        height: 400,
+        webPreferences: {
+          preload: path.resolve(__dirname, 'fixtures/sub-frames/webview-iframe-preload.js'),
+          nodeIntegrationInSubFrames: true,
+          webviewTag: true
+        }
+      })
+    })
+
+    afterEach(() => {
+      return closeWindow(w).then(() => {
+        w = null
+      })
+    })
+
+    it('should not load preload scripts', async () => {
+      const promisePass = emittedOnce(ipcMain, 'webview-loaded')
+      const promiseFail = emittedOnce(ipcMain, 'preload-in-frame').then(() => {
+        throw new Error('preload loaded in internal frame')
+      })
+      await w.loadURL('about:blank')
+      return Promise.race([promisePass, promiseFail])
+    })
+  })
 })
 
 describe('cross-site frame sandboxing', () => {
diff --git a/spec/fixtures/sub-frames/webview-iframe-preload.js b/spec/fixtures/sub-frames/webview-iframe-preload.js
new file mode 100644
index 0000000000000..926db8bad77a2
--- /dev/null
+++ b/spec/fixtures/sub-frames/webview-iframe-preload.js
@@ -0,0 +1,14 @@
+const { ipcRenderer } = require('electron')
+
+if (process.isMainFrame) {
+  window.addEventListener('DOMContentLoaded', () => {
+    const webview = document.createElement('webview')
+    webview.src = 'about:blank'
+    webview.addEventListener('did-finish-load', () => {
+      ipcRenderer.send('webview-loaded')
+    }, { once: true })
+    document.body.appendChild(webview)
+  })
+} else {
+  ipcRenderer.send('preload-in-frame')
+}