Join GitHub today
GitHub is home to over 31 million developers working together to host and review code, manage projects, and build software together.
Sign upDANGEROUS_FUNCTIONS_JS_CHECK
DANGEROUS_FUNCTIONS_JS_CHECK - Do not use dangerous functions with user-supplied data
insertCSS, executeJavaScript functions allow to inject respectively CSS and JavaScript from the main process to the renderer process. Also, eval allows JavaScript execution in the context of a BrowserWindowProxy. If the arguments are user-supplied, they can be leveraged to execute arbitrary content and modify the application behavior. This check detects the use of dangerous functions with dynamic arguments, and delegates the review to the user.
Risk
In a vulnerable application, a remote page could leverage these functions to subvert the flow of the application by injecting malicious CSS or JavaScript.
Auditing
Search for occurrences of insertCSS, executeJavaScript and eval with user-supplied input in both BrowserWindow, webview tag and all other JavaScript resources.