[Extensions] Don't allow gin::Define to be overridden
Use DefineOwnProperty instead of Set in for gin, including gin::Define.
Replace Set in v8_helpers as well, to avoid the same problem.
Also update callsites from JS to CHECK expected arguments, rather
than DCHECK (since receiving unexpected arguments likely means
executing untrusted code).
BUG=549986
Review URL: https://codereview.chromium.org/1433293004
Cr-Commit-Position: refs/heads/master@{#359460}
diff --git a/extensions/renderer/blob_native_handler.cc b/extensions/renderer/blob_native_handler.cc
index d6e757a3..12068c3 100644
--- a/extensions/renderer/blob_native_handler.cc
+++ b/extensions/renderer/blob_native_handler.cc
@@ -14,7 +14,7 @@
// Expects a single Blob argument. Returns the Blob's UUID.
void GetBlobUuid(const v8::FunctionCallbackInfo<v8::Value>& args) {
- DCHECK_EQ(1, args.Length());
+ CHECK_EQ(1, args.Length());
blink::WebBlob blob = blink::WebBlob::fromV8Value(args[0]);
args.GetReturnValue().Set(
v8::String::NewFromUtf8(args.GetIsolate(), blob.uuid().utf8().data()));
@@ -38,10 +38,10 @@
// a separate flow to avoid leaking Blobs if the script context is destroyed.
void BlobNativeHandler::TakeBrowserProcessBlob(
const v8::FunctionCallbackInfo<v8::Value>& args) {
- DCHECK_EQ(3, args.Length());
- DCHECK(args[0]->IsString());
- DCHECK(args[1]->IsString());
- DCHECK(args[2]->IsInt32());
+ CHECK_EQ(3, args.Length());
+ CHECK(args[0]->IsString());
+ CHECK(args[1]->IsString());
+ CHECK(args[2]->IsInt32());
std::string uuid(*v8::String::Utf8Value(args[0]));
std::string type(*v8::String::Utf8Value(args[1]));
blink::WebBlob blob =
