mirror of
https://github.com/facebook/react.git
synced 2025-11-01 09:12:30 +00:00
1. https://github.com/bvaughn/react/commit/9fc04eaf3fb701cdc14f57d5aed48f3126af6c94#diff-2c5e1f5e80e74154e65b2813cf1c3638f85034530e99dae24809ab4ad70d0143 introduced a vulnerability: we listen to `'fetch-file-with-cache'` event from `window` to fetch sources of the file, in which we want to parse hook names. We send this event via `window`, which means any page can also use this and manipulate the extension to perform some `fetch()` calls. With these changes, instead of transporting message via `window`, we have a distinct content script, which is responsible for fetching sources. It is notified via `chrome.runtime.sendMessage` api, so it can't be manipulated. 2. Consistent structure of messages `{source: string, payload: object}` in different parts of the extension 3. Added some wrappers around `chrome.scripting.executeScript` API in `packages/react-devtools-extensions/src/background/executeScript.js`, which support custom flow for Firefox, to simulate support of `ExecutionWorld.MAIN`.
105 lines
2.6 KiB
JavaScript
105 lines
2.6 KiB
JavaScript
/* global chrome */
|
|
|
|
'use strict';
|
|
|
|
window.addEventListener('pageshow', function ({target}) {
|
|
// Firefox's behaviour for injecting this content script can be unpredictable
|
|
// While navigating the history, some content scripts might not be re-injected and still be alive
|
|
if (!window.__REACT_DEVTOOLS_PROXY_INJECTED__) {
|
|
window.__REACT_DEVTOOLS_PROXY_INJECTED__ = true;
|
|
|
|
connectPort();
|
|
sayHelloToBackendManager();
|
|
|
|
// The backend waits to install the global hook until notified by the content script.
|
|
// In the event of a page reload, the content script might be loaded before the backend manager is injected.
|
|
// Because of this we need to poll the backend manager until it has been initialized.
|
|
const intervalID = setInterval(() => {
|
|
if (backendInitialized) {
|
|
clearInterval(intervalID);
|
|
} else {
|
|
sayHelloToBackendManager();
|
|
}
|
|
}, 500);
|
|
}
|
|
});
|
|
|
|
window.addEventListener('pagehide', function ({target}) {
|
|
if (target !== window.document) {
|
|
return;
|
|
}
|
|
|
|
delete window.__REACT_DEVTOOLS_PROXY_INJECTED__;
|
|
});
|
|
|
|
let port = null;
|
|
let backendInitialized: boolean = false;
|
|
|
|
function sayHelloToBackendManager() {
|
|
window.postMessage(
|
|
{
|
|
source: 'react-devtools-content-script',
|
|
hello: true,
|
|
},
|
|
'*',
|
|
);
|
|
}
|
|
|
|
function handleMessageFromDevtools(message) {
|
|
window.postMessage(
|
|
{
|
|
source: 'react-devtools-content-script',
|
|
payload: message,
|
|
},
|
|
'*',
|
|
);
|
|
}
|
|
|
|
function handleMessageFromPage(event) {
|
|
if (event.source !== window || !event.data) {
|
|
return;
|
|
}
|
|
|
|
switch (event.data.source) {
|
|
// This is a message from a bridge (initialized by a devtools backend)
|
|
case 'react-devtools-bridge': {
|
|
backendInitialized = true;
|
|
|
|
port.postMessage(event.data.payload);
|
|
break;
|
|
}
|
|
|
|
// This is a message from the backend manager, which runs in ExecutionWorld.MAIN
|
|
// and can't use `chrome.runtime.sendMessage`
|
|
case 'react-devtools-backend-manager': {
|
|
const {source, payload} = event.data;
|
|
|
|
chrome.runtime.sendMessage({
|
|
source,
|
|
payload,
|
|
});
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
function handleDisconnect() {
|
|
window.removeEventListener('message', handleMessageFromPage);
|
|
port = null;
|
|
|
|
connectPort();
|
|
}
|
|
|
|
// Creates port from application page to the React DevTools' service worker
|
|
// Which then connects it with extension port
|
|
function connectPort() {
|
|
port = chrome.runtime.connect({
|
|
name: 'proxy',
|
|
});
|
|
|
|
window.addEventListener('message', handleMessageFromPage);
|
|
|
|
port.onMessage.addListener(handleMessageFromDevtools);
|
|
port.onDisconnect.addListener(handleDisconnect);
|
|
}
|