[ZTE ZMAX Guides, News, & Discussion] rkey1000:
OK here is the code de-obfuscated:....i think

(function(define, require, requireNative, requireAsync, exports, console, privates,$Array, $Function, $JSON, $Object, $RegExp, $String, $Error) {'use strict';// Copyright 2014 The Chromium Authors. All rights reserved.

// Use of this source code is governed by a BSD-style license that can be

// found in the LICENSE file.

// chrome.runtime.messaging API implementation.

// TODO(kalman): factor requiring chrome out of here.

var chrome = requireNative('chrome').GetChrome();

var Event = require('event_bindings').Event;

var lastError = require('lastError');

var logActivity = requireNative('activityLogger');

var logging = requireNative('logging');

var messagingNatives = requireNative('messaging_natives');

var processNatives = requireNative('process');

var unloadEvent = require('unload_event');

var utils = require('utils');

var messagingUtils = require('messaging_utils');

// The reserved channel name for the sendRequest/send(Native)Message APIs.

// Note: sendRequest is deprecated.

var kRequestChannel = "chrome.extension.sendRequest";

var kMessageChannel = "chrome.runtime.sendMessage";

var kNativeMessageChannel = "chrome.runtime.sendNativeMessage";

// Map of port IDs to port object.

var ports = {};

// Map of port IDs to unloadEvent listeners. Keep track of these to free the

// unloadEvent listeners when ports are closed.

var portReleasers = {};

// Change even to odd and vice versa, to get the other side of a given

// channel.

function getOppositePortId(portId) { return portId ^ 1; }

// Port object. Represents a connection to another script context through

// which messages can be passed.

function PortImpl(portId, opt_name) {

this.portId_ = portId;

this.name = opt_name;

var portSchema = {name: 'port', $ref: 'runtime.Port'};

var options = {unmanaged: true};

this.onDisconnect = new Event(null, [portSchema], options);

this.onMessage = new Event(

null,

[{name: 'message', type: 'any', optional: true}, portSchema],

options);

this.onDestroy_ = null;

}

// Sends a message asynchronously to the context on the other end of this

// port.

PortImpl.prototype.postMessage = function(msg) {

// JSON.stringify doesn't support a root object which is undefined.

if (msg === undefined)

msg = null;

msg = $JSON.stringify(msg);

if (msg === undefined) {

// JSON.stringify can fail with unserializable objects. Log an error and

// drop the message.

//

// TODO(kalman/mpcomplete): it would be better to do the same validation

// here that we do for runtime.sendMessage (and variants), i.e. throw an

// schema validation Error, but just maintain the old behaviour until

// there's a good reason not to (http://crbug.com/263077).

console.error('Illegal argument to Port.postMessage');

return;

}

messagingNatives.PostMessage(this.portId_, msg);

};

// Disconnects the port from the other end.

PortImpl.prototype.disconnect = function() {

messagingNatives.CloseChannel(this.portId_, true);

this.destroy_();

};

PortImpl.prototype.destroy_ = function() {

var portId = this.portId_;

if (this.onDestroy_)

this.onDestroy_();

privates(this.onDisconnect).impl.destroy_();

privates(this.onMessage).impl.destroy_();

messagingNatives.PortRelease(portId);

unloadEvent.removeListener(portReleasers[portId]);

delete ports[portId];

delete portReleasers[portId];

};

// Returns true if the specified port id is in this context. This is used by

// the C++ to avoid creating the javascript message for all the contexts that

// don't care about a particular message.

function hasPort(portId) {

return portId in ports;

};

// Hidden port creation function. We don't want to expose an API that lets

// people add arbitrary port IDs to the port list.

function createPort(portId, opt_name) {

if (ports[portId])

throw new Error("Port '" + portId + "' already exists.");

var port = new Port(portId, opt_name);

ports[portId] = port;

portReleasers[portId] = $Function.bind(messagingNatives.PortRelease,

this,

portId);

unloadEvent.addListener(portReleasers[portId]);

messagingNatives.PortAddRef(portId);

return port;

};

// Helper function for dispatchOnRequest.

function handleSendRequestError(isSendMessage,

responseCallbackPreserved,

sourceExtensionId,

targetExtensionId,

sourceUrl) {

var errorMsg = [];

var eventName = isSendMessage ? "runtime.onMessage" : "extension.onRequest";

if (isSendMessage && !responseCallbackPreserved) {

$Array.push(errorMsg,

"The chrome." + eventName + " listener must return true if you " +

"want to send a response after the listener returns");

} else {

$Array.push(errorMsg,

"Cannot send a response more than once per chrome." + eventName +

" listener per document");

}

$Array.push(errorMsg, "(message was sent by extension" + sourceExtensionId);

if (sourceExtensionId != "" && sourceExtensionId != targetExtensionId)

---------- Post added at 10:33 PM ---------- Previous post was at 10:30 PM ----------

also there was this link..... Maybe an exploit

https://code.google.com/p/chromium/issues/detail?id=263077

---------- Post added at 10:38 PM ---------- Previous post was at 10:33 PM ----------

I'm think this is it. Exploit? This quoted from url.

What steps will reproduce the problem?

1. create a new port (either chrome.tabs.connect, chrome.runtime.connect, or chrome.runtime.connectNative)

2. call postMessage on that port with an unserializable message (e.g. function(){})

What is the expected output? What do you see instead?

The call should fail with a validation error (e.g. "illegal arguments to Port.postMessage"). Instead there's a silent failure (or until 256765 is fixed, a renderer crash).

The sendMessage variants of the messaging APIs (chrome.runtime.sendMessage, chrome.tabs.sendMessage) do validation, we should be consistent (and useful) and do the same for Port.postMessage.

We need to be careful not to break existing extensions.