Guarded ensureScrollValueMonitoring against some malicious script on …

…the Internet overriding native document.createEvent (fixes #6887) (#7621)
facebook · Aug 31, 2016 · 51476de · 51476de
1 parent 7d7defe
commit 51476de
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 2 deletions.
diff --git a/src/renderers/dom/client/ReactBrowserEventEmitter.js b/src/renderers/dom/client/ReactBrowserEventEmitter.js
@@ -344,6 +344,19 @@ var ReactBrowserEventEmitter = Object.assign({}, ReactEventEmitterMixin, {
     );
   },
 
+  /**
+   * Protect against document.createEvent() returning null
+   * Some popup blocker extensions appear to do this:
+   * https://github.com/facebook/react/issues/6887
+   */
+  supportsEventPageXY: function() {
+    if (!document.createEvent) {
+      return false;
+    }
+    var ev = document.createEvent('MouseEvent');
+    return ev != null && 'pageX' in ev;
+  },
+
   /**
    * Listens to window scroll and resize events. We cache scroll values so that
    * application code can access them without triggering reflows.
@@ -357,8 +370,7 @@ var ReactBrowserEventEmitter = Object.assign({}, ReactEventEmitterMixin, {
    */
   ensureScrollValueMonitoring: function() {
     if (hasEventPageXY === undefined) {
-      hasEventPageXY =
-        document.createEvent && 'pageX' in document.createEvent('MouseEvent');
+      hasEventPageXY = ReactBrowserEventEmitter.supportsEventPageXY();
     }
     if (!hasEventPageXY && !isMonitoringScrollValue) {
       var refresh = ViewportMetrics.refreshScrollValues;

diff --git a/src/renderers/dom/client/__tests__/ReactBrowserEventEmitter-test.js b/src/renderers/dom/client/__tests__/ReactBrowserEventEmitter-test.js
@@ -452,4 +452,20 @@ describe('ReactBrowserEventEmitter', function() {
     expect(idCallOrder[2]).toBe(getInternal(GRANDPARENT));
   });
 
+  it('should not crash ensureScrollValueMonitoring when createEvent returns null', function() {
+    var originalCreateEvent = document.createEvent;
+    document.createEvent = function() {
+      return null;
+    };
+    spyOn(document, 'createEvent');
+
+    try {
+      var hasEventPageXY = ReactBrowserEventEmitter.supportsEventPageXY();
+      expect(document.createEvent.calls.count()).toBe(1);
+      expect(hasEventPageXY).toBe(false);
+    } finally {
+      document.createEvent = originalCreateEvent;
+    }
+  });
+
 });