diff options
author | Kristóf Marussy <kristof@marussy.com> | 2021-09-19 00:38:19 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-09-19 00:38:19 +0200 |
commit | 40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d (patch) | |
tree | f4b1a7f0ff2bf54b7d1b7bc1e050e2786fbfd219 /src/webview/recipe.js | |
parent | chore: removed 'first-time-contributors' GH workflow since that is not workin... (diff) | |
download | ferdium-app-40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d.tar.gz ferdium-app-40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d.tar.zst ferdium-app-40e007d6a4de9b4c0be49eb5f2d4f1706eaf801d.zip |
security: do not expose electron API to services (#1964)
* security: do not expose electron API to services
Service code running the the main world should not have access to any
electron API.
This still allows recipes from webview.js accessing these APIs through
the @electron/remote module and/or the Ferdi object, but
webview-unsafe.js and the untrusted code coming from the service will
not have any access.
Currently, no recipe accesses these APIs in its webview-unsafe.js, so
the change should not break any recipes.
* Expose electron API through the Ferdi object
Instead of the unsafe window.ferdi in the main world, we should expose
functionality to recipes through the RecipeWebview class.
* Update CHANGELOG.md
Diffstat (limited to 'src/webview/recipe.js')
-rw-r--r-- | src/webview/recipe.js | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/src/webview/recipe.js b/src/webview/recipe.js index d7032da3f..32df0f756 100644 --- a/src/webview/recipe.js +++ b/src/webview/recipe.js | |||
@@ -1,7 +1,6 @@ | |||
1 | /* eslint-disable global-require */ | 1 | /* eslint-disable global-require */ |
2 | /* eslint-disable import/first */ | 2 | /* eslint-disable import/first */ |
3 | import { contextBridge, desktopCapturer, ipcRenderer } from 'electron'; | 3 | import { contextBridge, ipcRenderer } from 'electron'; |
4 | import { BrowserWindow, getCurrentWebContents } from '@electron/remote'; | ||
5 | import { join } from 'path'; | 4 | import { join } from 'path'; |
6 | import { autorun, computed, observable } from 'mobx'; | 5 | import { autorun, computed, observable } from 'mobx'; |
7 | import { pathExistsSync, readFileSync } from 'fs-extra'; | 6 | import { pathExistsSync, readFileSync } from 'fs-extra'; |
@@ -109,15 +108,8 @@ contextBridge.exposeInMainWorld('ferdi', { | |||
109 | safeParseInt: text => badgeHandler.safeParseInt(text), | 108 | safeParseInt: text => badgeHandler.safeParseInt(text), |
110 | displayNotification: (title, options) => | 109 | displayNotification: (title, options) => |
111 | notificationsHandler.displayNotification(title, options), | 110 | notificationsHandler.displayNotification(title, options), |
112 | clearStorageData: storageLocations => | ||
113 | sessionHandler.clearStorageData(storageLocations), | ||
114 | releaseServiceWorkers: () => sessionHandler.releaseServiceWorkers(), | 111 | releaseServiceWorkers: () => sessionHandler.releaseServiceWorkers(), |
115 | getDisplayMediaSelector, | 112 | getDisplayMediaSelector, |
116 | getCurrentWebContents, | ||
117 | BrowserWindow, | ||
118 | ipcRenderer, | ||
119 | // TODO: When the discord recipe is changed to use the screenshare.js, this can be removed | ||
120 | desktopCapturer, | ||
121 | }); | 113 | }); |
122 | 114 | ||
123 | ipcRenderer.sendToHost( | 115 | ipcRenderer.sendToHost( |
@@ -207,7 +199,11 @@ class RecipeController { | |||
207 | // Delete module from cache | 199 | // Delete module from cache |
208 | delete require.cache[require.resolve(modulePath)]; | 200 | delete require.cache[require.resolve(modulePath)]; |
209 | try { | 201 | try { |
210 | this.recipe = new RecipeWebview(badgeHandler, notificationsHandler); | 202 | this.recipe = new RecipeWebview( |
203 | badgeHandler, | ||
204 | notificationsHandler, | ||
205 | sessionHandler, | ||
206 | ); | ||
211 | // eslint-disable-next-line import/no-dynamic-require | 207 | // eslint-disable-next-line import/no-dynamic-require |
212 | require(modulePath)(this.recipe, { ...config, recipe }); | 208 | require(modulePath)(this.recipe, { ...config, recipe }); |
213 | debug('Initialize Recipe', config, recipe); | 209 | debug('Initialize Recipe', config, recipe); |