[Extensions] Don't allow gin::Define to be overridden

Use DefineOwnProperty instead of Set in for gin, including gin::Define.
Replace Set in v8_helpers as well, to avoid the same problem.
Also update callsites from JS to CHECK expected arguments, rather
than DCHECK (since receiving unexpected arguments likely means
executing untrusted code).

BUG=549986

Review URL: https://codereview.chromium.org/1433293004

Cr-Commit-Position: refs/heads/master@{#359460}

1 files changed, 12 insertions, 10 deletions

diff --git a/extensions/renderer/v8_helpers.h b/extensions/renderer/v8_helpers.h
index 2bfeee8..0c9a47c 100644
--- a/extensions/renderer/v8_helpers.h
+++ b/extensions/renderer/v8_helpers.h
@@ -7,6 +7,7 @@
 
 #include <string.h>
 
+#include "base/strings/string_number_conversions.h"
 #include "v8/include/v8.h"
 
 namespace extensions {
@@ -56,19 +57,13 @@ inline bool IsEmptyOrUndefied(v8::Local<v8::Value> value) {
   return value.IsEmpty() || value->IsUndefined();
 }
 
-// SetProperty() family wraps V8::Object::Set(). Returns true on success.
+// SetProperty() family wraps V8::Object::DefineOwnProperty().
+// Returns true on success.
 inline bool SetProperty(v8::Local<v8::Context> context,
                         v8::Local<v8::Object> object,
-                        v8::Local<v8::Value> key,
+                        v8::Local<v8::String> key,
                         v8::Local<v8::Value> value) {
-  return IsTrue(object->Set(context, key, value));
-}
-
-inline bool SetProperty(v8::Local<v8::Context> context,
-                        v8::Local<v8::Object> object,
-                        uint32_t index,
-                        v8::Local<v8::Value> value) {
-  return IsTrue(object->Set(context, index, value));
+  return IsTrue(object->DefineOwnProperty(context, key, value));
 }
 
 inline bool SetProperty(v8::Local<v8::Context> context,
@@ -81,6 +76,13 @@ inline bool SetProperty(v8::Local<v8::Context> context,
   return SetProperty(context, object, v8_key, value);
 }
 
+inline bool SetProperty(v8::Local<v8::Context> context,
+                        v8::Local<v8::Object> object,
+                        uint32_t index,
+                        v8::Local<v8::Value> value) {
+  return SetProperty(context, object, base::UintToString(index).c_str(), value);
+}
+
 // GetProperty() family calls V8::Object::Get() and extracts a value from
 // returned MaybeLocal. Returns true on success.
 template <typename Key>