Skip to content

Commit ae50a6f

Browse files
amaitlandLuca Sonntag
amaitland
authored and
Luca Sonntag
committed
Javascript Binding - Add Ability to limit origins
1 parent 6de821c commit ae50a6f

5 files changed

Lines changed: 196 additions & 41 deletions

File tree

‎CefSharp.BrowserSubprocess.Core/CefAppUnmanagedWrapper.cpp‎

Lines changed: 90 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include "Wrapper\Browser.h"
2424
#include "..\CefSharp.Core.Runtime\Internals\Messaging\Messages.h"
2525
#include "..\CefSharp.Core.Runtime\Internals\Serialization\Primitives.h"
26+
#include <include/cef_parser.h>
2627

2728
using namespace System;
2829
using namespace System::Diagnostics;
@@ -87,7 +88,7 @@ namespace CefSharp
8788
//Using LegacyBinding with multiple ChromiumWebBrowser instances that share the same
8889
//render process and using LegacyBinding will cause problems for the limited caching implementation
8990
//that exists at the moment, for now we'll remove an object if already exists, same behaviour
90-
//as the new binding method.
91+
//as the new binding method.
9192
//TODO: This should be removed when https://github.com/cefsharp/CefSharp/issues/2306
9293
//Is complete as objects will be stored at the browser level
9394
if (_javascriptObjects->ContainsKey(obj->JavascriptName))
@@ -100,6 +101,16 @@ namespace CefSharp
100101
}
101102

102103
_jsBindingApiEnabled = extraInfo->GetBool("JavascriptBindingApiEnabled");
104+
_jsBindingApiHasAllowOrigins = extraInfo->GetBool("JavascriptBindingApiHasAllowOrigins");
105+
106+
if (_jsBindingApiHasAllowOrigins)
107+
{
108+
auto allowOrigins = extraInfo->GetList("JavascriptBindingApiAllowOrigins");
109+
if (allowOrigins.get() && allowOrigins->IsValid())
110+
{
111+
_jsBindingApiAllowOrigins = allowOrigins->Copy();
112+
}
113+
}
103114

104115
if (extraInfo->HasKey("JsBindingPropertyName") || extraInfo->HasKey("JsBindingPropertyNameCamelCase"))
105116
{
@@ -149,50 +160,88 @@ namespace CefSharp
149160

150161
if (_jsBindingApiEnabled)
151162
{
152-
//TODO: Look at adding some sort of javascript mapping layer to reduce the code duplication
153-
auto global = context->GetGlobal();
154-
auto browserWrapper = FindBrowserWrapper(browser->GetIdentifier());
155-
auto processId = System::Diagnostics::Process::GetCurrentProcess()->Id;
156-
157-
//TODO: JSB: Split functions into their own classes
158-
//Browser wrapper is only used for BindObjectAsync
159-
auto bindObjAsyncFunction = CefV8Value::CreateFunction(kBindObjectAsync, new BindObjectAsyncHandler(_registerBoundObjectRegistry, _javascriptObjects, rootObject));
160-
auto unBindObjFunction = CefV8Value::CreateFunction(kDeleteBoundObject, new RegisterBoundObjectHandler(_javascriptObjects));
161-
auto removeObjectFromCacheFunction = CefV8Value::CreateFunction(kRemoveObjectFromCache, new RegisterBoundObjectHandler(_javascriptObjects));
162-
auto isObjectCachedFunction = CefV8Value::CreateFunction(kIsObjectCached, new RegisterBoundObjectHandler(_javascriptObjects));
163-
auto postMessageFunction = CefV8Value::CreateFunction(kPostMessage, new JavascriptPostMessageHandler(rootObject == nullptr ? nullptr : rootObject->CallbackRegistry));
164-
auto promiseHandlerFunction = CefV8Value::CreateFunction(kSendEvalScriptResponse, new JavascriptPromiseHandler());
165-
166-
//By default We'll support both CefSharp and cefSharp, for those who prefer the JS style
167-
auto createCefSharpObj = !_jsBindingPropertyName.empty();
168-
auto createCefSharpObjCamelCase = !_jsBindingPropertyNameCamelCase.empty();
169-
170-
if (createCefSharpObj)
163+
auto createObjects = true;
164+
165+
if (_jsBindingApiHasAllowOrigins)
171166
{
172-
auto cefSharpObj = CefV8Value::CreateObject(nullptr, nullptr);
173-
cefSharpObj->SetValue(kBindObjectAsync, bindObjAsyncFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
174-
cefSharpObj->SetValue(kDeleteBoundObject, unBindObjFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
175-
cefSharpObj->SetValue(kRemoveObjectFromCache, removeObjectFromCacheFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
176-
cefSharpObj->SetValue(kIsObjectCached, isObjectCachedFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
177-
cefSharpObj->SetValue(kPostMessage, postMessageFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
178-
cefSharpObj->SetValue(kSendEvalScriptResponse, promiseHandlerFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
179-
cefSharpObj->SetValue(kRenderProcessId, CefV8Value::CreateInt(processId), CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
180-
181-
global->SetValue(_jsBindingPropertyName, cefSharpObj, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_READONLY);
167+
createObjects = false;
168+
169+
auto frameUrl = frame->GetURL();
170+
171+
CefURLParts frameUrlParts;
172+
173+
if (CefParseURL(frameUrl, frameUrlParts))
174+
{
175+
auto frameUrlOrigin = CefString(frameUrlParts.origin.str, frameUrlParts.origin.length);
176+
auto clrframeUrlOrigin = StringUtils::ToClr(frameUrlOrigin);
177+
178+
auto size = static_cast<int>(_jsBindingApiAllowOrigins->GetSize());
179+
180+
for (int i = 0; i < size; i++)
181+
{
182+
auto origin = _jsBindingApiAllowOrigins->GetString(i);
183+
184+
auto clrOrigin = StringUtils::ToClr(origin);
185+
186+
auto originEqual = String::Compare(clrframeUrlOrigin, clrOrigin, StringComparison::InvariantCultureIgnoreCase);
187+
188+
if (originEqual == 0)
189+
{
190+
createObjects = true;
191+
192+
break;
193+
}
194+
}
195+
}
182196
}
183197

184-
if (createCefSharpObjCamelCase)
198+
if (createObjects)
185199
{
186-
auto cefSharpObjCamelCase = CefV8Value::CreateObject(nullptr, nullptr);
187-
cefSharpObjCamelCase->SetValue(kBindObjectAsyncCamelCase, bindObjAsyncFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
188-
cefSharpObjCamelCase->SetValue(kDeleteBoundObjectCamelCase, unBindObjFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
189-
cefSharpObjCamelCase->SetValue(kRemoveObjectFromCacheCamelCase, removeObjectFromCacheFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
190-
cefSharpObjCamelCase->SetValue(kIsObjectCachedCamelCase, isObjectCachedFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
191-
cefSharpObjCamelCase->SetValue(kPostMessageCamelCase, postMessageFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
192-
cefSharpObjCamelCase->SetValue(kSendEvalScriptResponseCamelCase, promiseHandlerFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
193-
cefSharpObjCamelCase->SetValue(kRenderProcessIdCamelCase, CefV8Value::CreateInt(processId), CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
194-
195-
global->SetValue(_jsBindingPropertyNameCamelCase, cefSharpObjCamelCase, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_READONLY);
200+
//TODO: Look at adding some sort of javascript mapping layer to reduce the code duplication
201+
auto global = context->GetGlobal();
202+
auto browserWrapper = FindBrowserWrapper(browser->GetIdentifier());
203+
auto processId = System::Diagnostics::Process::GetCurrentProcess()->Id;
204+
205+
//TODO: JSB: Split functions into their own classes
206+
//Browser wrapper is only used for BindObjectAsync
207+
auto bindObjAsyncFunction = CefV8Value::CreateFunction(kBindObjectAsync, new BindObjectAsyncHandler(_registerBoundObjectRegistry, _javascriptObjects, rootObject));
208+
auto unBindObjFunction = CefV8Value::CreateFunction(kDeleteBoundObject, new RegisterBoundObjectHandler(_javascriptObjects));
209+
auto removeObjectFromCacheFunction = CefV8Value::CreateFunction(kRemoveObjectFromCache, new RegisterBoundObjectHandler(_javascriptObjects));
210+
auto isObjectCachedFunction = CefV8Value::CreateFunction(kIsObjectCached, new RegisterBoundObjectHandler(_javascriptObjects));
211+
auto postMessageFunction = CefV8Value::CreateFunction(kPostMessage, new JavascriptPostMessageHandler(rootObject == nullptr ? nullptr : rootObject->CallbackRegistry));
212+
auto promiseHandlerFunction = CefV8Value::CreateFunction(kSendEvalScriptResponse, new JavascriptPromiseHandler());
213+
214+
//By default We'll support both CefSharp and cefSharp, for those who prefer the JS style
215+
auto createCefSharpObj = !_jsBindingPropertyName.empty();
216+
auto createCefSharpObjCamelCase = !_jsBindingPropertyNameCamelCase.empty();
217+
218+
if (createCefSharpObj)
219+
{
220+
auto cefSharpObj = CefV8Value::CreateObject(nullptr, nullptr);
221+
cefSharpObj->SetValue(kBindObjectAsync, bindObjAsyncFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
222+
cefSharpObj->SetValue(kDeleteBoundObject, unBindObjFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
223+
cefSharpObj->SetValue(kRemoveObjectFromCache, removeObjectFromCacheFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
224+
cefSharpObj->SetValue(kIsObjectCached, isObjectCachedFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
225+
cefSharpObj->SetValue(kPostMessage, postMessageFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
226+
cefSharpObj->SetValue(kSendEvalScriptResponse, promiseHandlerFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
227+
cefSharpObj->SetValue(kRenderProcessId, CefV8Value::CreateInt(processId), CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
228+
229+
global->SetValue(_jsBindingPropertyName, cefSharpObj, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_READONLY);
230+
}
231+
232+
if (createCefSharpObjCamelCase)
233+
{
234+
auto cefSharpObjCamelCase = CefV8Value::CreateObject(nullptr, nullptr);
235+
cefSharpObjCamelCase->SetValue(kBindObjectAsyncCamelCase, bindObjAsyncFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
236+
cefSharpObjCamelCase->SetValue(kDeleteBoundObjectCamelCase, unBindObjFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
237+
cefSharpObjCamelCase->SetValue(kRemoveObjectFromCacheCamelCase, removeObjectFromCacheFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
238+
cefSharpObjCamelCase->SetValue(kIsObjectCachedCamelCase, isObjectCachedFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
239+
cefSharpObjCamelCase->SetValue(kPostMessageCamelCase, postMessageFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
240+
cefSharpObjCamelCase->SetValue(kSendEvalScriptResponseCamelCase, promiseHandlerFunction, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
241+
cefSharpObjCamelCase->SetValue(kRenderProcessIdCamelCase, CefV8Value::CreateInt(processId), CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_NONE);
242+
243+
global->SetValue(_jsBindingPropertyNameCamelCase, cefSharpObjCamelCase, CefV8Value::PropertyAttribute::V8_PROPERTY_ATTRIBUTE_READONLY);
244+
}
196245
}
197246
}
198247

‎CefSharp.BrowserSubprocess.Core/CefAppUnmanagedWrapper.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ namespace CefSharp
3030
bool _focusedNodeChangedEnabled;
3131
bool _legacyBindingEnabled;
3232
bool _jsBindingApiEnabled = true;
33+
bool _jsBindingApiHasAllowOrigins = false;
34+
CefRefPtr<CefListValue> _jsBindingApiAllowOrigins;
3335

3436
// The property names used to call bound objects
3537
CefString _jsBindingPropertyName;
@@ -82,6 +84,8 @@ namespace CefSharp
8284

8385
delete _onBrowserCreated;
8486
delete _onBrowserDestroyed;
87+
88+
_jsBindingApiAllowOrigins = nullptr;
8589
}
8690

8791
CefBrowserWrapper^ FindBrowserWrapper(int browserId);

‎CefSharp.Core.Runtime/ManagedCefBrowserAdapter.cpp‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,22 @@ namespace CefSharp
8484

8585
extraInfo->SetBool("JavascriptBindingApiEnabled", objectRepositorySettings->JavascriptBindingApiEnabled);
8686

87+
auto hasJavascriptBindingApiAllowOrigins = objectRepositorySettings->HasJavascriptBindingApiAllowOrigins();
88+
89+
extraInfo->SetBool("JavascriptBindingApiHasAllowOrigins", hasJavascriptBindingApiAllowOrigins);
90+
91+
if (hasJavascriptBindingApiAllowOrigins)
92+
{
93+
auto allowOriginList = CefListValue::Create();
94+
95+
for (int i = 0; i < objectRepositorySettings->JavascriptBindingApiAllowOrigins->Length; i++)
96+
{
97+
allowOriginList->SetString(i, StringUtils::ToNative(objectRepositorySettings->JavascriptBindingApiAllowOrigins[i]));
98+
}
99+
100+
extraInfo->SetList("JavascriptBindingApiAllowOrigins", allowOriginList);
101+
}
102+
87103
CefRefPtr<CefRequestContext> requestCtx;
88104

89105
if (requestContext != nullptr)

‎CefSharp.Test/JavascriptBinding/JavascriptBindingTests.cs‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,60 @@ public async Task ShouldDisableJsBindingApi()
130130
}
131131
}
132132

133+
[Fact]
134+
public async Task ShouldDisableJsBindingApiForOrigin()
135+
{
136+
using (var browser = new ChromiumWebBrowser(CefExample.BindingApiCustomObjectNameTestUrl, automaticallyCreateBrowser: false))
137+
{
138+
var settings = browser.JavascriptObjectRepository.Settings;
139+
settings.JavascriptBindingApiEnabled = true;
140+
settings.JavascriptBindingApiAllowOrigins = new string[] { "notallowed" };
141+
142+
//To modify the settings we need to defer browser creation slightly
143+
browser.CreateBrowser();
144+
145+
var loadResponse = await browser.WaitForInitialLoadAsync();
146+
147+
Assert.True(loadResponse.Success);
148+
149+
var response1 = await browser.EvaluateScriptAsync("typeof window.cefSharp === 'undefined'");
150+
var response2 = await browser.EvaluateScriptAsync("typeof window.CefSharp === 'undefined'");
151+
152+
Assert.True(response1.Success);
153+
Assert.True((bool)response1.Result);
154+
155+
Assert.True(response2.Success);
156+
Assert.True((bool)response2.Result);
157+
}
158+
}
159+
160+
[Theory]
161+
[InlineData(CefExample.BaseUrl + "/")]
162+
[InlineData("someorigin", CefExample.BaseUrl + "/")]
163+
public async Task ShouldEnableJsBindingApiForOrigin(params string[] origins)
164+
{
165+
using (var browser = new ChromiumWebBrowser(CefExample.BindingApiCustomObjectNameTestUrl, automaticallyCreateBrowser: false))
166+
{
167+
var settings = browser.JavascriptObjectRepository.Settings;
168+
settings.JavascriptBindingApiEnabled = true;
169+
settings.JavascriptBindingApiAllowOrigins = origins;
170+
171+
//To modify the settings we need to defer browser creation slightly
172+
browser.CreateBrowser();
173+
174+
await browser.WaitForInitialLoadAsync();
175+
176+
var response1 = await browser.EvaluateScriptAsync("typeof window.cefSharp === 'undefined'");
177+
var response2 = await browser.EvaluateScriptAsync("typeof window.CefSharp === 'undefined'");
178+
179+
Assert.True(response1.Success);
180+
Assert.False((bool)response1.Result);
181+
182+
Assert.True(response2.Success);
183+
Assert.False((bool)response2.Result);
184+
}
185+
}
186+
133187
[Fact]
134188
public async Task ShouldEnableJsBindingApi()
135189
{

‎CefSharp/JavascriptBinding/JavascriptBindingSettings.cs‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
//
33
// Use of this source code is governed by a BSD-style license that can be found in the LICENSE file.
44

5+
using System.Collections.Generic;
56
using CefSharp.Internals;
67

78
namespace CefSharp.JavascriptBinding
@@ -15,6 +16,7 @@ public class JavascriptBindingSettings : FreezableBase
1516
private bool legacyBindingEnabled;
1617
private string jsBindingGlobalObjectName;
1718
private bool jsBindingApiEnabled = true;
19+
private string[] javascriptBindingApiAllowOrigins;
1820

1921
/// <summary>
2022
/// The Javascript methods that CefSharp provides in relation to JavaScript Binding are
@@ -33,6 +35,24 @@ public bool JavascriptBindingApiEnabled
3335
}
3436
}
3537

38+
/// <summary>
39+
/// When <see cref="JavascriptBindingApiEnabled"/> is set to true, set a collection
40+
/// of origins to limit which origins CefSharp will create it's global (window) object.
41+
/// </summary>
42+
/// <remarks>
43+
/// If you wish to create the CefSharp object for a limited set of origins then set this property
44+
/// </remarks>
45+
public string[] JavascriptBindingApiAllowOrigins
46+
{
47+
get { return javascriptBindingApiAllowOrigins; }
48+
set
49+
{
50+
ThrowIfFrozen();
51+
52+
javascriptBindingApiAllowOrigins = value;
53+
}
54+
}
55+
3656
/// <summary>
3757
/// The Javascript methods that CefSharp provides in relation to JavaScript Binding are
3858
/// created using a Global (window) Object. Settings this property allows you to customise
@@ -95,5 +115,17 @@ public bool AlwaysInterceptAsynchronously
95115
alwaysInterceptAsynchronously = value;
96116
}
97117
}
118+
119+
/// <summary>
120+
/// HasJavascriptBindingApiAllowOrigins
121+
/// </summary>
122+
/// <returns>bool true if <see cref="JavascriptBindingApiAllowOrigins"/> is non empty collection.</returns>
123+
public bool HasJavascriptBindingApiAllowOrigins()
124+
{
125+
if (javascriptBindingApiAllowOrigins == null)
126+
return false;
127+
128+
return javascriptBindingApiAllowOrigins.Length > 0;
129+
}
98130
}
99131
}

0 commit comments

Comments
 (0)