From b91778b638d6ea7407dfefadb2b8df7c90d526d7 Mon Sep 17 00:00:00 2001
From: Milan Burda <milan.burda@gmail.com>
Date: Thu, 24 Jan 2019 22:35:25 +0100
Subject: [PATCH] fix: execute session preload scripts in sandboxed renderers

---
 lib/browser/rpc-server.js                    | 16 ++++++---
 lib/sandboxed_renderer/init.js               | 24 +++++++------
 spec/api-browser-window-spec.js              | 38 +++++++++++---------
 spec/fixtures/module/get-global-preload.js   |  1 +
 spec/fixtures/module/set-global-preload-3.js |  1 -
 5 files changed, 47 insertions(+), 33 deletions(-)
 create mode 100644 spec/fixtures/module/get-global-preload.js
 delete mode 100644 spec/fixtures/module/set-global-preload-3.js

diff --git a/lib/browser/rpc-server.js b/lib/browser/rpc-server.js
index bae2d8a153f2a..962a4da8797bd 100644
--- a/lib/browser/rpc-server.js
+++ b/lib/browser/rpc-server.js
@@ -534,8 +534,7 @@ ipcMain.on('ELECTRON_BROWSER_CLIPBOARD_WRITE_FIND_TEXT', function (event, text)
   setReturnValue(event, () => electron.clipboard.writeFindText(text))
 })
 
-ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
-  const preloadPath = event.sender._getPreloadPath()
+const getPreloadScript = function (preloadPath) {
   let preloadSrc = null
   let preloadError = null
   if (preloadPath) {
@@ -545,10 +544,17 @@ ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
       preloadError = errorUtils.serialize(err)
     }
   }
+  return { preloadPath, preloadSrc, preloadError }
+}
+
+ipcMain.on('ELECTRON_BROWSER_SANDBOX_LOAD', function (event) {
+  const preloadPaths = [
+    ...(event.sender.session ? event.sender.session.getPreloads() : []),
+    event.sender._getPreloadPath()
+  ]
+
   event.returnValue = {
-    preloadPath,
-    preloadSrc,
-    preloadError,
+    preloadScripts: preloadPaths.map(path => getPreloadScript(path)),
     isRemoteModuleEnabled: event.sender._isRemoteModuleEnabled(),
     isWebViewTagEnabled: guestViewManager.isWebViewTagEnabled(event.sender),
     process: {
diff --git a/lib/sandboxed_renderer/init.js b/lib/sandboxed_renderer/init.js
index f45e8edb35cce..877b905467e6d 100644
--- a/lib/sandboxed_renderer/init.js
+++ b/lib/sandboxed_renderer/init.js
@@ -29,7 +29,7 @@ Object.setPrototypeOf(process, EventEmitter.prototype)
 const ipcRenderer = require('@electron/internal/renderer/ipc-renderer-internal')
 
 const {
-  preloadPath, preloadSrc, preloadError, isRemoteModuleEnabled, isWebViewTagEnabled, process: processProps
+  preloadScripts, isRemoteModuleEnabled, isWebViewTagEnabled, process: processProps
 } = ipcRenderer.sendSync('ELECTRON_BROWSER_SANDBOX_LOAD')
 
 process.isRemoteModuleEnabled = isRemoteModuleEnabled
@@ -162,17 +162,19 @@ function runPreloadScript (preloadSrc) {
   preloadFn(preloadRequire, preloadProcess, Buffer, global, setImmediate, clearImmediate)
 }
 
-try {
-  if (preloadSrc) {
-    runPreloadScript(preloadSrc)
-  } else if (preloadError) {
-    throw errorUtils.deserialize(preloadError)
+for (const { preloadPath, preloadSrc, preloadError } of preloadScripts) {
+  try {
+    if (preloadSrc) {
+      runPreloadScript(preloadSrc)
+    } else if (preloadError) {
+      throw errorUtils.deserialize(preloadError)
+    }
+  } catch (error) {
+    console.error(`Unable to load preload script: ${preloadPath}`)
+    console.error(`${error}`)
+
+    ipcRenderer.send('ELECTRON_BROWSER_PRELOAD_ERROR', preloadPath, errorUtils.serialize(error))
   }
-} catch (error) {
-  console.error(`Unable to load preload script: ${preloadPath}`)
-  console.error(`${error}`)
-
-  ipcRenderer.send('ELECTRON_BROWSER_PRELOAD_ERROR', preloadPath, errorUtils.serialize(error))
 }
 
 // Warn about security issues
diff --git a/spec/api-browser-window-spec.js b/spec/api-browser-window-spec.js
index 1637c32993f31..a31e068e6c579 100644
--- a/spec/api-browser-window-spec.js
+++ b/spec/api-browser-window-spec.js
@@ -1382,23 +1382,29 @@ describe('BrowserWindow module', () => {
         assert.deepStrictEqual(defaultSession.getPreloads(), preloads)
       })
 
-      it('loads the script before other scripts in window including normal preloads', function (done) {
-        ipcMain.once('vars', function (event, preload1, preload2, preload3) {
-          assert.strictEqual(preload1, 'preload-1')
-          assert.strictEqual(preload2, 'preload-1-2')
-          assert.strictEqual(preload3, 'preload-1-2-3')
-          done()
-        })
-        w.destroy()
-        w = new BrowserWindow({
-          show: false,
-          webPreferences: {
-            nodeIntegration: true,
-            preload: path.join(fixtures, 'module', 'set-global-preload-3.js')
-          }
+      const generateSpecs = (description, sandbox) => {
+        describe(description, () => {
+          it('loads the script before other scripts in window including normal preloads', function (done) {
+            ipcMain.once('vars', function (event, preload1, preload2) {
+              assert.strictEqual(preload1, 'preload-1')
+              assert.strictEqual(preload2, 'preload-1-2')
+              done()
+            })
+            w.destroy()
+            w = new BrowserWindow({
+              show: false,
+              webPreferences: {
+                sandbox,
+                preload: path.join(fixtures, 'module', 'get-global-preload.js')
+              }
+            })
+            w.loadURL('about:blank')
+          })
         })
-        w.loadFile(path.join(fixtures, 'api', 'preloads.html'))
-      })
+      }
+
+      generateSpecs('without sandbox', false)
+      generateSpecs('with sandbox', true)
     })
 
     describe('"additionalArguments" option', () => {
diff --git a/spec/fixtures/module/get-global-preload.js b/spec/fixtures/module/get-global-preload.js
new file mode 100644
index 0000000000000..438397f37073d
--- /dev/null
+++ b/spec/fixtures/module/get-global-preload.js
@@ -0,0 +1 @@
+require('electron').ipcRenderer.send('vars', window.preload1, window.preload2)
diff --git a/spec/fixtures/module/set-global-preload-3.js b/spec/fixtures/module/set-global-preload-3.js
deleted file mode 100644
index 9cfef949277ed..0000000000000
--- a/spec/fixtures/module/set-global-preload-3.js
+++ /dev/null
@@ -1 +0,0 @@
-window.preload3 = window.preload2 + '-3'