feature: Hot security tips #11810
Merged
feature: Hot security tips #11810
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
🔥 |
|
I ❤️ this. I would want to wrap this into a major version bump, even though you've taken a lot of care to be non-disruptive. If we can get this into 2.0-beta I am 👍 but I would 👎 delaying the beta for this change. Since we're doing major bumps every chromium release a 3.0 isn't really far off anyways. |
|
I don't know what timeline @felixrieseberg has in mind for this, eg tracking down the CI issue, but FWIW I'd be happy to merge this whenever it's ready, either in a 2.0 beta next week, or in 3.0 🔥 |
felixrieseberg
force-pushed
the
security-hot-tips
branch
from
2bd2224
to
532c2a2
Compare
|
@ckerr Alright! Feeling pretty good about this now. I believe that the test failure on Linux x64 is unrelated, EDIT: Restarted the build for Linux 64. |
ckerr
approved these changes
Feb 3, 2018
This was referenced Feb 20, 2018
sethlu
pushed a commit
to sethlu/electron
that referenced
this pull request
May 3, 2018
* 🔧 Add security issue detection (and logs) * 🔧 Check for it on load * 👷 Add some tests * 👷 Make the linter happy * 🔧 Allow them to be enabled by force * 📝 Make message slightly prettier * 🔧 Fix a typo in the code comment * 🔧 Classic mistake * 🚀 Optimize things a bit more * 👷 Add tests, fix tests * 📝 Document things * 🔧 Make linter happy * 🔧 One more piece of cleanup
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Now that we have this fancy security checklist, we need to make sure that developers know that it's there.
This PR generalizes the one
Electron Security Warningthat we already have and adds new warnings for all of the checklist items that are easy to detect. The warnings are only emitted if the binary's name iselectron, indicating strongly that a developer is looking at the console.The detection and subsequent logs can be force-set with the environment variables
ELECTRON_DISABLE_SECURITY_WARNINGSandELECTRON_ENABLE_SECURITY_WARNINGS. One can also set those properties on thewindowobject to enable or disable them per-renderer.If you mess up greatly, you'd see something like this: