fix: ensure no node globals passively leak when nodeIntegration is disabled (electron#21342)

MarshallOfSound · web-flow · commit ee58d6061282 · 2019-12-02T10:09:47.000-08:00
diff --git a/lib/renderer/init.ts b/lib/renderer/init.ts
@@ -192,6 +192,8 @@ if (nodeIntegration) {
       delete global.setImmediate
       delete global.clearImmediate
       delete global.global
+      delete global.root
+      delete global.GLOBAL
     })
   }
 }
diff --git a/spec-main/api-browser-window-spec.ts b/spec-main/api-browser-window-spec.ts
@@ -1543,6 +1543,37 @@ describe('BrowserWindow module', () => {
         sandbox: true,
         contextIsolation: true
       })
+      it('does not leak any node globals on the window object with nodeIntegration is disabled', async () => {
+        let w = new BrowserWindow({
+          webPreferences: {
+            contextIsolation: false,
+            nodeIntegration: false,
+            preload: path.resolve(fixtures, 'module', 'empty.js')
+          },
+          show: false
+        })
+        w.loadFile(path.join(fixtures, 'api', 'globals.html'))
+        const [, notIsolated] = await emittedOnce(ipcMain, 'leak-result')
+        expect(notIsolated).to.have.property('globals')
+
+        w.destroy()
+        w = new BrowserWindow({
+          webPreferences: {
+            contextIsolation: true,
+            nodeIntegration: false,
+            preload: path.resolve(fixtures, 'module', 'empty.js')
+          },
+          show: false
+        })
+        w.loadFile(path.join(fixtures, 'api', 'globals.html'))
+        const [, isolated] = await emittedOnce(ipcMain, 'leak-result')
+        expect(isolated).to.have.property('globals')
+        const notIsolatedGlobals = new Set(notIsolated.globals)
+        for (const isolatedGlobal of isolated.globals) {
+          notIsolatedGlobals.delete(isolatedGlobal)
+        }
+        expect([...notIsolatedGlobals]).to.deep.equal([], 'non-isoalted renderer should have no additional globals')
+      })
 
       it('loads the script before other scripts in window', async () => {
         const preload = path.join(fixtures, 'module', 'set-global.js')
diff --git a/spec/fixtures/api/globals.html b/spec/fixtures/api/globals.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <title>Document</title>
+</head>
+<body>
+  <script>
+  window.postMessage({
+    globals: Object.keys(Object.getOwnPropertyDescriptors(window))
+  })
+  </script>
+</body>
+</html>

Original file line number	Diff line number	Diff line change
`@@ -192,6 +192,8 @@ if (nodeIntegration) {`
`192`	`192`	`delete global.setImmediate`
`193`	`193`	`delete global.clearImmediate`
`194`	`194`	`delete global.global`
	`195`	`+ delete global.root`
	`196`	`+ delete global.GLOBAL`
`195`	`197`	`})`
`196`	`198`	`}`
`197`	`199`	`}`