#53752: fix: don't expose chrome.webstorePrivate to web pages
Description of Change
Since the Chromium 152 roll (#52446), the webstorePrivate extension API lives in //extensions instead of //chrome (CL 7874276). As a result, Electron now compiles and registers every webstorePrivate.* function through the core generated registry. It also ships the core _api_features.json entry, which exposes the API to regular web pages on https://chromewebstore.google.com/*.
ElectronExtensionsAPIClient doesn't provide a WebstorePrivateAPIDelegate, and most of the browser-side functions dereference it without checking for null. If an app's webContents navigates to the Chrome Web Store, the page gets real chrome.webstorePrivate bindings in the main world, and the first call the store page makes crashes the browser process.
#52446 added fix_guard_webstoreprivateapi_factory_against_null_delegate.patch to fix the startup crash caused by the same missing delegate, but it left the API exposed. This issue only affects 44-x-y and later; 43-x-y predates the roll.
This PR restores the pre-152 behavior (the API isn't exposed anywhere) without adding a patch.
Checklist
- I have built and tested this change
- I have filled out the PR description
- I have reviewed and verified the changes
-
npm testpasses - tests are changed or added
- PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, and past tense.
Release Notes
Notes: Fixed a crash when a webContents navigated to the Chrome Web Store and the page invoked the unsupported chrome.webstorePrivate API.
Backports
Semver Impact
Semantic Versioning helps users understand the impact of updates:
- Major (X.y.z): Breaking changes that may require code modifications
- Minor (x.Y.z): New features that maintain backward compatibility
- Patch (x.y.Z): Bug fixes that don't change the API
- None: Changes that don't affect using facing parts of Electron