diff options
author | Kristóf Marussy <kristof@marussy.com> | 2021-09-19 00:38:19 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-09-19 00:38:19 +0200 |
commit | 40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d (patch) | |
tree | f4b1a7f0ff2bf54b7d1b7bc1e050e2786fbfd219 /src/webview/lib | |
parent | chore: removed 'first-time-contributors' GH workflow since that is not workin... (diff) | |
download | ferdium-app-40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d.tar.gz ferdium-app-40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d.tar.zst ferdium-app-40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d.zip |
security: do not expose electron API to services (#1964)
* security: do not expose electron API to services
Service code running the the main world should not have access to any
electron API.
This still allows recipes from webview.js accessing these APIs through
the @electron/remote module and/or the Ferdi object, but
webview-unsafe.js and the untrusted code coming from the service will
not have any access.
Currently, no recipe accesses these APIs in its webview-unsafe.js, so
the change should not break any recipes.
* Expose electron API through the Ferdi object
Instead of the unsafe window.ferdi in the main world, we should expose
functionality to recipes through the RecipeWebview class.
* Update CHANGELOG.md
Diffstat (limited to 'src/webview/lib')
-rw-r--r-- | src/webview/lib/RecipeWebview.js | 32 |
1 files changed, 31 insertions, 1 deletions
diff --git a/src/webview/lib/RecipeWebview.js b/src/webview/lib/RecipeWebview.js index 4085b925b..a4951ed69 100644 --- a/src/webview/lib/RecipeWebview.js +++ b/src/webview/lib/RecipeWebview.js | |||
@@ -1,12 +1,14 @@ | |||
1 | import { ipcRenderer } from 'electron'; | 1 | import { ipcRenderer } from 'electron'; |
2 | import { BrowserWindow, desktopCapturer, getCurrentWebContents } from '@electron/remote'; | ||
2 | import { pathExistsSync, readFileSync, existsSync } from 'fs-extra'; | 3 | import { pathExistsSync, readFileSync, existsSync } from 'fs-extra'; |
3 | 4 | ||
4 | const debug = require('debug')('Ferdi:Plugin:RecipeWebview'); | 5 | const debug = require('debug')('Ferdi:Plugin:RecipeWebview'); |
5 | 6 | ||
6 | class RecipeWebview { | 7 | class RecipeWebview { |
7 | constructor(badgeHandler, notificationsHandler) { | 8 | constructor(badgeHandler, notificationsHandler, sessionHandler) { |
8 | this.badgeHandler = badgeHandler; | 9 | this.badgeHandler = badgeHandler; |
9 | this.notificationsHandler = notificationsHandler; | 10 | this.notificationsHandler = notificationsHandler; |
11 | this.sessionHandler = sessionHandler; | ||
10 | 12 | ||
11 | ipcRenderer.on('poll', () => { | 13 | ipcRenderer.on('poll', () => { |
12 | this.loopFunc(); | 14 | this.loopFunc(); |
@@ -23,6 +25,26 @@ class RecipeWebview { | |||
23 | 25 | ||
24 | darkModeHandler = false; | 26 | darkModeHandler = false; |
25 | 27 | ||
28 | // TODO Remove this once we implement a proper wrapper. | ||
29 | get ipcRenderer() { | ||
30 | return ipcRenderer; | ||
31 | } | ||
32 | |||
33 | // TODO Remove this once we implement a proper wrapper. | ||
34 | get desktopCapturer() { | ||
35 | return desktopCapturer; | ||
36 | } | ||
37 | |||
38 | // TODO Remove this once we implement a proper wrapper. | ||
39 | get BrowserWindow() { | ||
40 | return BrowserWindow; | ||
41 | } | ||
42 | |||
43 | // TODO Remove this once we implement a proper wrapper. | ||
44 | get getCurrentWebContents() { | ||
45 | return getCurrentWebContents; | ||
46 | } | ||
47 | |||
26 | /** | 48 | /** |
27 | * Initialize the loop | 49 | * Initialize the loop |
28 | * | 50 | * |
@@ -113,6 +135,14 @@ class RecipeWebview { | |||
113 | fn(); | 135 | fn(); |
114 | } | 136 | } |
115 | } | 137 | } |
138 | |||
139 | clearStorageData(storageLocations) { | ||
140 | this.sessionHandler.clearStorageData(storageLocations); | ||
141 | } | ||
142 | |||
143 | releaseServiceWorkers() { | ||
144 | this.sessionHandler.releaseServiceWorkers(); | ||
145 | } | ||
116 | } | 146 | } |
117 | 147 | ||
118 | export default RecipeWebview; | 148 | export default RecipeWebview; |