OSSForks/react
1
0
Fork 0
mirror of https://github.com/zebrajr/react.git synced 2026-01-15 12:15:22 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

remove ability to inject arbitrary scripts

Browse Source
This commit is contained in:
Stephanie Ding
2019-09-10 18:06:23 -07:00
parent d51f062d03
commit 8a6cd3cd12
3 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
packages/react-devtools-extensions/src/inject.js vendored
View File

@@ -2,8 +2,13 @@
export default function inject(scriptName: string, done: ?Function) {
const source = `
// the prototype stuff is in case document.createElement has been modified
(function () {
window.postMessage({ source: 'react-devtools-inject-script', scriptName: "${scriptName}" }, "*");
var script = document.constructor.prototype.createElement.call(document, 'script');
script.src = "${scriptName}";
script.charset = "utf-8";
document.documentElement.appendChild(script);
script.parentNode.removeChild(script);
})()
`;
@@ -16,4 +21,4 @@ export default function inject(scriptName: string, done: ?Function) {
done();
}
});
}
}

4
packages/react-devtools-extensions/src/injectGlobalHook.js vendored
View File

@@ -31,10 +31,10 @@ window.addEventListener('message', function(evt) {
reactBuildType: evt.data.reactBuildType,
};
chrome.runtime.sendMessage(lastDetectionResult);
} else if (evt.data.source === 'react-devtools-inject-script' && evt.data.scriptName) {
} else if (evt.data.source === 'react-devtools-inject-backend') {
//Inject the specified script
var script = document.constructor.prototype.createElement.call(document, 'script');
script.src = evt.data.scriptName;
script.src = chrome.runtime.getURL('build/backend.js');
script.charset = "utf-8";
document.documentElement.appendChild(script);
script.parentNode.removeChild(script);

13
packages/react-devtools-extensions/src/main.js vendored
View File

@@ -135,7 +135,18 @@ function createPanelIfReactLoaded() {
// Initialize the backend only once the Store has been initialized.
// Otherwise the Store may miss important initial tree op codes.
inject(chrome.runtime.getURL('build/backend.js'));
chrome.devtools.inspectedWindow.eval(
`window.postMessage({ source: 'react-devtools-inject-backend' });`,
function(response, error) {
if (error) {
console.log(error);
}
if (typeof done === 'function') {
done();
}
}
);
const viewElementSourceFunction = createViewElementSource(
bridge,