Javascript Binding - Add ability to limit access to JavaScript Bound objects to specific origins #5085
Conversation
| cefSharpObj->SetValue(kRenderProcessId, CefV8Value::CreateInt(processId), CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE); | ||
|
|
||
| global->SetValue(_jsBindingPropertyName, cefSharpObj, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_READONLY); | ||
| createObjects = false; |
There was a problem hiding this comment.
Extract this into a helper method would probably make this a lot cleaner
| @@ -33,6 +35,24 @@ public bool JavascriptBindingApiEnabled | |||
| } | |||
| } | |||
|
|
|||
| /// <summary> | |||
| /// When <see cref="JavascriptBindingApiEnabled"/> is set to true, set a collection | |||
| @@ -95,5 +115,17 @@ public bool AlwaysInterceptAsynchronously | |||
| alwaysInterceptAsynchronously = value; | |||
| } | |||
| } | |||
|
|
|||
| /// <summary> | |||
| /// HasJavascriptBindingApiAllowOrigins | |||
|
Could probably use some more tests, specifically for multiple origins in the list |
|
❌ Build CefSharp 135.0.170-CI5207 failed (commit bcf0a561b5 by @amaitland) |
|
❌ Build CefSharp 135.0.170-CI5209 failed (commit 8a395dfd16 by @amaitland) |
amaitland
force-pushed
the
feature/jsbindingalloworiginlist
branch
from
b98cfbe to
218de9c
Compare
amaitland
force-pushed
the
feature/jsbindingalloworiginlist
branch
from
218de9c to
60203e5
Compare
|
|
||
| auto clrOrigin = StringUtils::ToClr(origin); | ||
|
|
||
| auto originEqual = String::Compare(clrframeUrlOrigin, clrOrigin, StringComparison::InvariantCultureIgnoreCase); |
There was a problem hiding this comment.
Need to find a more efficient string comparison, ideally compare the native strings
|
✅ Build CefSharp 135.0.170-CI5213 completed (commit 0ac4c7d444 by @amaitland) |
| /// <remarks> | ||
| /// If you wish to create the CefSharp object for a limited set of origins then set this property | ||
| /// </remarks> | ||
| public string[] JavascriptBindingApiAllowOrigins |
There was a problem hiding this comment.
The origin returned from CEF when it's parsed always has a trailing /, we should ensure that there's always a trailing slash programmatically
| @@ -29,6 +29,8 @@ namespace CefSharp | |||
| bool _focusedNodeChangedEnabled; | |||
| bool _legacyBindingEnabled; | |||
| bool _jsBindingApiEnabled = true; | |||
There was a problem hiding this comment.
Storing these on a per browser basis would provide greater flexibility, we could create a class that has a lookup by browser id.
Fixes:
#5001
Summary:
Changes:
How Has This Been Tested?
Types of changes
Checklist: