fix: capture the promise global to avoid userland mutation (electron#20925) (electron#20947)

MarshallOfSound · web-flow · commit 49009236d9cf · 2019-11-04T15:58:55.000-08:00
diff --git a/build/webpack/webpack.config.base.js b/build/webpack/webpack.config.base.js
@@ -74,7 +74,10 @@ module.exports = ({
           global: ['@electron/internal/renderer/webpack-provider', '_global'],
           Buffer: ['@electron/internal/renderer/webpack-provider', 'Buffer'],
         })
-      ] : [])
+      ] : []),
+      new webpack.ProvidePlugin({
+        Promise: ['@electron/internal/common/webpack-globals-provider', 'Promise'],
+      }),
     ]
   })
-}
+}
diff --git a/filenames.auto.gni b/filenames.auto.gni
@@ -141,6 +141,7 @@ auto_filenames = {
     "lib/common/error-utils.ts",
     "lib/common/is-promise.ts",
     "lib/common/web-view-methods.ts",
+    "lib/common/webpack-globals-provider.ts",
     "lib/renderer/api/context-bridge.ts",
     "lib/renderer/api/crash-reporter.js",
     "lib/renderer/api/desktop-capturer.ts",
@@ -176,6 +177,7 @@ auto_filenames = {
   isolated_bundle_deps = [
     "lib/common/electron-binding-setup.ts",
     "lib/common/error-utils.ts",
+    "lib/common/webpack-globals-provider.ts",
     "lib/isolated_renderer/init.js",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
@@ -190,6 +192,7 @@ auto_filenames = {
   content_script_bundle_deps = [
     "lib/common/electron-binding-setup.ts",
     "lib/common/error-utils.ts",
+    "lib/common/webpack-globals-provider.ts",
     "lib/content_script/init.js",
     "lib/renderer/chrome-api.ts",
     "lib/renderer/extensions/event.ts",
@@ -277,6 +280,7 @@ auto_filenames = {
     "lib/common/parse-features-string.js",
     "lib/common/reset-search-paths.ts",
     "lib/common/web-view-methods.ts",
+    "lib/common/webpack-globals-provider.ts",
     "lib/renderer/ipc-renderer-internal-utils.ts",
     "lib/renderer/ipc-renderer-internal.ts",
     "package.json",
@@ -301,6 +305,7 @@ auto_filenames = {
     "lib/common/is-promise.ts",
     "lib/common/reset-search-paths.ts",
     "lib/common/web-view-methods.ts",
+    "lib/common/webpack-globals-provider.ts",
     "lib/renderer/api/context-bridge.ts",
     "lib/renderer/api/crash-reporter.js",
     "lib/renderer/api/desktop-capturer.ts",
@@ -351,6 +356,7 @@ auto_filenames = {
     "lib/common/init.ts",
     "lib/common/is-promise.ts",
     "lib/common/reset-search-paths.ts",
+    "lib/common/webpack-globals-provider.ts",
     "lib/renderer/api/context-bridge.ts",
     "lib/renderer/api/crash-reporter.js",
     "lib/renderer/api/desktop-capturer.ts",
diff --git a/lib/common/asar.js b/lib/common/asar.js
@@ -8,6 +8,8 @@
   const path = require('path')
   const util = require('util')
 
+  const Promise = global.Promise
+
   const envNoAsar = process.env.ELECTRON_NO_ASAR &&
       process.type !== 'browser' &&
       process.type !== 'renderer'
diff --git a/lib/common/webpack-globals-provider.ts b/lib/common/webpack-globals-provider.ts
@@ -0,0 +1,8 @@
+// Captures original globals into a scope to ensure that userland modifications do
+// not impact Electron.  Note that users doing:
+//
+// global.Promise.resolve = myFn
+//
+// Will mutate this captured one as well and that is OK.
+
+export const Promise = global.Promise
diff --git a/spec/api-remote-spec.js b/spec/api-remote-spec.js
@@ -508,4 +508,22 @@ describe('remote module', () => {
       w.loadURL('about:blank')
     })
   })
+
+  describe('with an overriden global Promise constrctor', () => {
+    let original
+
+    before(() => {
+      original = Promise
+    })
+
+    it('using a promise based method  resolves correctly', async () => {
+      expect(await remote.getGlobal('returnAPromise')(123)).to.equal(123)
+      global.Promise = { resolve: () => ({}) }
+      expect(await remote.getGlobal('returnAPromise')(456)).to.equal(456)
+    })
+
+    after(() => {
+      global.Promise = original
+    })
+  })
 })
diff --git a/spec/static/main.js b/spec/static/main.js
@@ -72,6 +72,7 @@ ipcMain.on('echo', function (event, msg) {
 })
 
 global.setTimeoutPromisified = util.promisify(setTimeout)
+global.returnAPromise = (value) => new Promise((resolve) => setTimeout(() => resolve(value), 100))
 
 global.permissionChecks = {
   allow: () => electron.session.defaultSession.setPermissionCheckHandler(null),
