Add context isolation option to windows and webview tags #8348
Conversation
|
👍 |
|
The security guide should also be updated to mention this feature. |
94317fd to
4454f49
Compare
4a74900 to
4d66f25
Compare
0af9765 to
b26428c
Compare
f3c6247 to
1d824d4
Compare
|
Bravo, @kevinsawicki! |
|
Can we now get webviews with nodeIntegration off? :) |
|
@bundyo You always disable nodeIntegration on a webview? Or do you mean use a webview from within a BrowserWindow which has |
|
The second. Our use case is that we don't want any node modules required by mistake in the renderer (and we also load some external content), so we preload them with nodeIntegration off. However, we do need a webview that has to communicate with the main process too. If we use an iframe, we should make an additional proxy from postMessage to ipc. |
|
@bundyo Your use case sounds a bit unusual, however it is still not possible to load a webview in a webContents with nodeIntegration disabled. However as a potential solution to your exact use case, have you considered simply using two WebViews? I.e. |
|
This actually sounds okay :) Thanks, I'll try it. |
This pull request adds support for running the
preloadscript and Electron APIs in a separate, isolated JavaScript context from the main JavaScript context of the loaded page.This ensures the loaded page can't tamper with any JavaScript built-ins (such as
Array.prototype.push,JSON.parse, etc.) that the preload script and Electron APIs make use of.The
preloadscript still has full access to the DOM,document, andwindowglobals via secure proxies that prevent leakage across the contexts. This is provided by reusing Chrome's built-in support for content scripts.This option is completely opt-in and no existing behavior is changed.
Example
Shown below is an application that loads a page (possibly remote/untrusted) but wants to open any clicked links in an external browser using Electron's
shellAPI.This example also shows how variables can be injected into the loaded page and how the preload script can listen for messages from the page using
window.postMessage.main.jspreload.jsindex.htmlDepends on electron/libchromiumcontent#251
/cc @electron/maintainers