How can I disable input type=file?

Having problems with building or using CEF's C/C++ APIs? This forum is here to help. Please do not post bug reports or feature requests here.

How can I disable input type=file?

Postby Plinker1961 » Tue Jan 26, 2016 3:26 pm

We're trying to lock down our CEF Client from security vulnerabilities, and parts of this is proving difficult. In particular, since the user is allowed to browse freely to any URL (a requirement of our system), it is trivial to navigate to a page that contains a form which contains an input of type=file. From there, the user simply clicks the Choose File button, which will invoke the common file picker dialog from Windows. Even as a limited user, it is trivial to move/delete files or upload files to a remote server all from the file picker dialog.

Can you suggest any way to disable input type=file? I didn't see any way to do this from my browsing of the 3.2526.1368.gd94bfc5 client code base. Any suggestions are appreciated.

Thanks!
Plinker1961
Mentor
 
Posts: 65
Joined: Thu Feb 26, 2015 5:14 pm

Re: How can I disable input type=file?

Postby magreenblatt » Tue Jan 26, 2016 3:30 pm

Implement CefDialogHandler.
magreenblatt
Site Admin
 
Posts: 12382
Joined: Fri May 29, 2009 6:57 pm

Re: How can I disable input type=file?

Postby Plinker1961 » Tue Jan 26, 2016 3:41 pm

I'll give that a shot -- thanks!
Plinker1961
Mentor
 
Posts: 65
Joined: Thu Feb 26, 2015 5:14 pm

Re: How can I disable input type=file?

Postby Plinker1961 » Tue Jan 26, 2016 4:09 pm

It seems to work! To make it work, I made the following changes to client_handler.h:

1) Added public CefDialogHandler as additional base class

2) Added GetDialogHandler() handler:
Code: Select all
  CefRefPtr<CefDialogHandler> GetDialogHandler() OVERRIDE {
    return this;
  }

3) Added OnFileDialog() handler:
Code: Select all
  // CefDialogHandler methods
  bool OnFileDialog(CefRefPtr<CefBrowser> browser,
                    FileDialogMode mode,
                    const CefString& title,
                    const CefString& default_file_path,
                    const std::vector<CefString>& accept_filters,
                    int selected_accept_filter,
                    CefRefPtr<CefFileDialogCallback> callback) OVERRIDE {
      return true;
  }

Without the GetDialogHandler() OVERRIDE, the OnFileDialog() OVERRIDE will never be called.

Thank for the fast answer Marshall!
Plinker1961
Mentor
 
Posts: 65
Joined: Thu Feb 26, 2015 5:14 pm


Return to Support Forum

Who is online

Users browsing this forum: No registered users and 33 guests

cron