Prohibit Object methods being called through IPC
#6780
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Your PR description should specify why you want to do this. |
Updated description. |
…ttps://github.com/imodeljs/imodeljs into gytis/prohibit-calling-Object-methods-through-IPC
aruniverse
approved these changes
Jun 3, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
IPC expects only methods defined in a custom IPC interface to be called, but it does not account for all other methods defined in an IPC handler. For this reason, it is possible to execute methods that exist in the IPC handler but are not intended to be called from the frontend. This includes all methods inherited from the
Objectand any methods defined asprivatein TypeScript code.This could be exploited by malicious party to weaken security (work item for more details).
Changes
Changes in this PR prevent methods inherited from
Objectclass (e.g.:toString,__defineSetter__) from being called through IPC.It would be great to also prohibit
privatemethods in custom IPC handlers from being callable, but it's not possible, since, if they are definedprivatein TypeScript, this information is not available during runtime. Added a recommendation to the documentation to either remove private methods from IPC handlers or define them as JavaScript private properties.