Enable the process-level sandbox and move the shell window code into …

…the preload (WIP)

app/background-process/protocols/beaker.js

@@ -18,7 +18,7 @@ import ICO from 'icojs'
 const BEAKER_CSP = `
   default-src 'self' beaker:;
   img-src beaker-favicon: beaker: data: dat: http: https;
-  script-src 'self' beaker:;
+  script-src 'self' beaker: 'unsafe-eval';
   media-src 'self' beaker: dat:;
   style-src 'self' 'unsafe-inline' beaker:;
   child-src 'self';

app/background-process/ui/windows.js

@@ -22,6 +22,7 @@ let sessionWatcher = null
 let focusedDevtoolsHost
 const BROWSING_SESSION_PATH = './shell-window-state.json'
 const ICON_PATH = path.join(__dirname, (process.platform === 'win32') ? './assets/img/logo.ico' : './assets/img/logo.png')
+const PRELOAD_PATH = path.join(__dirname, 'shell-window.build.js')
 
 // exported methods
 // =
@@ -133,6 +134,8 @@ export function createShellWindow (windowState) {
     backgroundColor: '#ddd',
     defaultEncoding: 'UTF-8',
     webPreferences: {
+      sandbox: true,
+      preload: PRELOAD_PATH,
       webSecurity: false, // disable same-origin-policy in the shell window, webviews have it restored
       allowRunningInsecureContent: false,
       nativeWindowOpen: true

app/shell-window.html

@@ -48,6 +48,5 @@
       </defs>
     </svg>
   </div>
-  <script src="beaker://shell-window/main.js"></script>
 </body>
 </html>

app/shell-window.js

@@ -1,3 +1,7 @@
+// TODO - this is a hack to get things working, remove
+import os from 'os' // removeme
+window.process = {platform: os.platform()} // removeme
+
 import * as rpcAPI from 'pauls-electron-rpc'
 const beakerCoreWebview = require ('@beaker/core/webview')
 import { ipcRenderer } from 'electron'
@@ -11,6 +15,8 @@ window.navbar = navbar
 
 // setup
 beakerCoreWebview.setup({rpcAPI})
-setupUI(() => {
-  ipcRenderer.send('shell-window:ready')
+document.addEventListener('DOMContentLoaded', () => {
+  setupUI(() => {
+    ipcRenderer.send('shell-window:ready')
+  })
 })

app/shell-window/pages.js

@@ -38,7 +38,7 @@ export const APP_PATH = remote.app.getAppPath() // NOTE: this is a sync op
 var pages = []
 var activePage = null
 var events = new EventEmitter()
-var webviewsDiv = document.getElementById('webviews')
+var webviewsDiv
 var closedURLs = []
 var cachedMarkdownRendererScript
 var cachedJSONRendererScript
@@ -63,6 +63,8 @@ export function getPinned () {
 }
 
 export function setup () {
+  webviewsDiv = document.getElementById('webviews')
+
   beaker.archives.addEventListener('network-changed', ({details}) => {
     // check if any of the active pages matches this url
     pages.forEach(page => {

app/shell-window/swipe-handlers.js

@@ -2,7 +2,7 @@ import { ipcRenderer } from 'electron'
 import * as pages from './pages'
 import * as zoom from './pages/zoom'
 
-const isDarwin = window.process.platform === 'darwin'
+const isDarwin = true// TODO window.process.platform === 'darwin'
 
 const SWIPE_TRIGGER_DIST = 400 // how far do you need to travel to trigger the navigation
 const ARROW_OFF_DIST = 80 // how far off-screen are the arrows

app/shell-window/ui/modal.js

@@ -6,12 +6,13 @@ import ModalClasses from './modals/index'
 // globals
 // =
 
-var modalsDiv = document.querySelector('#modals')
+var modalsDiv
 
 // exported functions
 // =
 
 export function setup () {
+  modalsDiv = document.querySelector('#modals')
   document.body.addEventListener('keydown', onGlobalKeydown)
 }
 

app/shell-window/ui/navbar.js

@@ -31,7 +31,7 @@ const isIPAddressRegex = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
 // globals
 // =
 
-var toolbarNavDiv = document.getElementById('toolbar-nav')
+var toolbarNavDiv
 var updatesNavbarBtn = null
 var browserMenuNavbarBtn = null
 var bookmarkMenuNavbarBtn = null
@@ -51,6 +51,8 @@ var autocompleteResults = null // if set to an array, will render dropdown
 // =
 
 export function setup () {
+  toolbarNavDiv = document.getElementById('toolbar-nav')
+
   // create the button managers
   updatesNavbarBtn = new UpdatesNavbarBtn()
   // appsMenuNavbarBtn = new AppsMenuNavbarBtn() TODO(apps) restore when we bring back apps -prf

app/shell-window/ui/prompt.js

@@ -1,18 +1,13 @@
 import * as yo from 'yo-yo'
 import * as pages from '../pages'
 
-// globals
-// =
-
-var promptsDiv = document.querySelector('#prompts')
-
 // exported functions
 // =
 
 export function createContainer (id) {
   // render
   var el = render(id, null)
-  promptsDiv.append(el)
+  document.querySelector('#prompts').append(el)
   return el
 }
 

tasks/build/build.js

@@ -49,7 +49,7 @@ var bundleApplication = function () {
   return Q.all([
     bundle(srcDir.path('background-process.js'),       srcDir.path('background-process.build.js')),
     bundle(srcDir.path('webview-preload.js'),          srcDir.path('webview-preload.build.js'), { browserify: true, basedir: srcDir.cwd(), browserifyBuiltins: false }),
-    bundle(srcDir.path('shell-window.js'),             srcDir.path('shell-window.build.js'), { browserify: true, basedir: srcDir.cwd(), excludeNodeModules: true, browserifyBuiltins: false }),
+    bundle(srcDir.path('shell-window.js'),             srcDir.path('shell-window.build.js'), { browserify: true, basedir: srcDir.cwd(), browserifyBuiltins: true }),
     bundle(srcDir.path('json-renderer.js'),            srcDir.path('json-renderer.build.js'), { browserify: true, basedir: srcDir.cwd(), excludeNodeModules: true }),
     bundle(srcDir.path('markdown-renderer.js'),        srcDir.path('markdown-renderer.build.js'), { browserify: true, basedir: srcDir.cwd(), excludeNodeModules: true }),
     bundle(bpViewsDir.path('downloads.js'),            bpBuildDir.path('downloads.build.js'), { browserify: true, basedir: bpViewsDir.cwd() }),