security: block chrome.tabs.executeScript() for non chrome-extension:…

… URLs (#15929)
electron · Dec 11, 2018 · 607b53c · 607b53c
1 parent e044ada
commit 607b53c
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/lib/browser/chrome-extension.js b/lib/browser/chrome-extension.js
@@ -201,7 +201,18 @@ ipcMain.on('CHROME_TABS_SEND_MESSAGE', function (event, tabId, extensionId, isBa
   resultID++
 })
 
+const isChromeExtension = function (pageURL) {
+  const { protocol } = url.parse(pageURL)
+  return protocol === 'chrome-extension:'
+}
+
 ipcMain.on('CHROME_TABS_EXECUTESCRIPT', function (event, requestId, tabId, extensionId, details) {
+  const pageURL = event.sender._getURL()
+  if (!isChromeExtension(pageURL)) {
+    console.error(`Blocked ${pageURL} from calling chrome.tabs.executeScript()`)
+    return
+  }
+
   const contents = webContents.fromId(tabId)
   if (!contents) {
     console.error(`Sending message to unknown tab ${tabId}`)