Skip to content

Commit

Permalink
[iOS] Make JS injection validation code robust to unexpected types
Browse files Browse the repository at this point in the history
The result object returned by |WKWebView evaluateJavaScript
completionHandler:| may have an unexpected type. The check to determine
if the windowID has been injected should not crash if the result object
has an unexpected type.

Fixed: 1050940
Change-Id: I326d474e461286ed02b90191ab2868d15afe957d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2073059
Commit-Queue: Mike Dougherty <michaeldo@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Auto-Submit: Mike Dougherty <michaeldo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#744547}
  • Loading branch information
michaeldo1 authored and Commit Bot committed Feb 26, 2020
1 parent e6bd38d commit bf850ac
Showing 1 changed file with 9 additions and 2 deletions.
11 changes: 9 additions & 2 deletions ios/web/js_messaging/crw_js_window_id_manager.mm
Original file line number Diff line number Diff line change
Expand Up @@ -65,8 +65,15 @@ - (void)inject {
return;
}

DCHECK_EQ(CFBooleanGetTypeID(),
CFGetTypeID((__bridge CFTypeRef)result));
// If |result| is an incorrect type, do not check its value.
// Also do not attempt to re-inject scripts as it may lead to
// endless recursion attempting to inject the scripts correctly.
if (result && CFBooleanGetTypeID() !=
CFGetTypeID((__bridge CFTypeRef)result)) {
NOTREACHED();
return;
}

if (![result boolValue]) {
// WKUserScript has not been injected yet. Retry window id
// injection, because it is critical for the system to
Expand Down

0 comments on commit bf850ac

Please sign in to comment.