Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement context isolation in electron #261

Open
grctest opened this issue Aug 29, 2023 · 1 comment
Open

Implement context isolation in electron #261

grctest opened this issue Aug 29, 2023 · 1 comment

Comments

@grctest
Copy link
Contributor

grctest commented Aug 29, 2023

Is your feature request related to a problem? Please describe.

We're not yet following Electron best practices fully. https://www.electronjs.org/docs/latest/tutorial/context-isolation

Describe the solution you'd like

https://github.com/bitshares/beet/blob/develop/src/background.js#L170
https://github.com/bitshares/beet/blob/develop/src/background.js#L251

Set nodeIntegration and enableRemoteModule to false, and contextIsolation to true.

Adapt renderer to request node/module functions/data through the ipcmain/ipcrenderer pipeline.

Describe alternatives you've considered

Exhaustively prevent XSS in the renderer.

Additional context

Latest BTS NFT Viewer has made these changes: https://github.com/BTS-CM/NFT_Viewer/releases/tag/v1.9.2

And the airdrop tool is about 98% of the way there: https://github.com/BTS-CM/airdrop_tool/tree/context_isolation

The background.js file is likely to significantly bloat due to inheriting code from the renderer.

This is likely a multi-thousand LOC feature request, however it's worthwhile to make the wallet follow best practices.

@grctest
Copy link
Contributor Author

grctest commented Mar 10, 2024

Fully implemented in: https://github.com/beetapp/beeteos

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant