Allow enabling <webview> tag with node integration disabled #9397

juturu · 2017-05-07T05:15:36Z

No description provided.

… and raising events - Enabling creation on webview with node-integration disabled and raising events Conflicts: lib/browser/guest-view-manager.js

MarshallOfSound · 2017-05-07T05:46:17Z

@juturu Can you explain the reasoning behind this, it seems very unsafe to me to have this option.

juturu · 2017-05-07T12:54:20Z

@MarshallOfSound it is to enable the scenarios explained in #2749 (comment) &
#2749 (comment)

Added events which can help clear the preload scripts in webview. By default electron having this security feature enabled. If developer is willing to override it and knows the risk then i feel adding this flexibility will make it easier for folks doing workarounds to achieve similar result.

@chandrachivukula @laramies to pitch in (if required).

MarshallOfSound · 2017-05-07T22:16:02Z

@juturu I have concerns that this is making doing a bad thing far too easy.

If developer is willing to override it and knows the risk

These two are not necessarily mutually inclusive, lot's of people don't read the security guidelines for Electron (I see so many people loading remote content with nodeIntegration enabled for instance) and giving people a simple boolean option to do this makes it way to easy for them to expose their users to a multitude of exploits.

There is already a way to achieve what this option does but it requires a much greater understanding from the developer as to what they are actually doing.

Enable nodeIntegration
Delete all node globals in a preload script

Now you have the WebView element and no node environment, but it's a much more definitive as to what you are actually doing.

Interested in feedback from others RE the user safety issues raised above @electron/maintainers

juturu · 2017-05-08T17:16:29Z

@MarshallOfSound good point on the security concerns you raised. Here are couple of things i think we can do to make this flag more secure.

giving people a simple boolean option to do this makes it way to easy

Does making the boolean something like overrideWebViewSecurityFeature make your concern less worrysome?
Also, to reduce the security concern further, how about removing preload scripts from webView if nodeIntegration on the parent is turned off by electron.

kevinsawicki · 2017-05-08T21:35:47Z

docs/api/web-contents.md

@@ -218,6 +218,17 @@ When in-page navigation happens, the page URL changes but does not cause
 navigation outside of the page. Examples of this occurring are when anchor links
 are clicked or when the DOM `hashchange` event is triggered.

+#### Event: 'will-create-webview'


We already have will-attach-webview, could that be used instead?

https://electron.atom.io/docs/api/web-contents/#event-will-attach-webview

Yes, that works!

MarshallOfSound · 2017-05-08T22:29:39Z

Does making the boolean something like overrideWebViewSecurityFeature make your concern less worrysome?

That would make it a lot more clear yes 👍

Also, to reduce the security concern further, how about removing preload scripts from webView if nodeIntegration on the parent is turned off by electron.

Not sure what the use case is for a webview without nodeInegration in the parent but IMO if the parent doesn't have nodeIntegration then the webview shouldn't have a preload script OR the option to enable nodeIntegration. It should have no way to access node API's if the parent can't

kevinsawicki · 2017-05-09T16:54:28Z

atom/browser/api/atom_api_web_contents.cc

@@ -406,6 +406,9 @@ void WebContents::InitWithSessionAndOptions(v8::Isolate* isolate,

  Init(isolate);
  AttachAsUserData(web_contents);
+
+  if (IsGuest())
+    Emit("did-create-webview");


Do we still need this? We have web-contents-created that is emitted for each webContents and webContents.getType() to know which type was created.

kevinsawicki · 2017-05-09T16:55:27Z

docs/api/browser-window.md

+    * `overrideWebViewSecurity` Boolean (optional) - Whether to enable [webview-tag](webview-tag.md)
+      ignoring the security restriction based on `nodeIntegration`. Enabling this option will
+      have security implication on creating `webview` with `nodeIntegration` disabled. To avoid the
+      security risk, listen to `will-create-webview` event on [web-contents](web-contents.md) and 


will-create-webview is no longer here so this line needs to be updated.

kevinsawicki · 2017-05-17T21:16:48Z

Does making the boolean something like overrideWebViewSecurityFeature make your concern less worrysome?

I've updated this pull request to switch it to be called webviewTag that defaults to the value of the nodeIntegration option for now but we could make it default to false in Electron 2.0 so that apps always explicitly have to opt-in to the <webview> tag since it isn't a well-known concept/tag and would seem safer to have off by default eventually to prevent any unexpected behavior.

I've also made it so opened windows will have the <webview> tag disabled if it is disabled on the parent window to mirror the other inherited security options like nodeIntegration, contextIsolation, and javascript.

Also, to reduce the security concern further, how about removing preload scripts from webView if nodeIntegration on the parent is turned off by electron.

I've updated the security guide and other docs to mention how will-attach-webview should be used to validate things and strip preload scripts.

I'm open to going further and preventing them completely in this case but for remote content that runs a bit of local content, they seem easier to use than having the window do a webContents.executeJavaScript to inject things into the webview.

kevinsawicki · 2017-05-17T21:22:33Z

Does making the boolean something like overrideWebViewSecurityFeature make your concern less worrysome?

So if we go with an option that simply enables or disables it, like webviewTag, then apps that don't use the <webview> tag at all can set it to false and Electron will require two less files at startup and set less globals which seems nice.

kevinsawicki · 2017-05-19T17:58:19Z

Thanks for this @juturu 👍

juturu · 2017-05-19T18:05:24Z

Thanks @kevinsawicki 🙇

juturu added 3 commits May 6, 2017 20:50

PR 44648: Enabling creation on webview with node-integration disabled…

b4a8ed0

… and raising events - Enabling creation on webview with node-integration disabled and raising events Conflicts: lib/browser/guest-view-manager.js

Add option to override webview security

94d054c

Remove .only on spec

939885b

juturu requested a review from kevinsawicki May 7, 2017 05:15

fixing spec

357caf8

kevinsawicki reviewed May 8, 2017

View reviewed changes

juturu and others added 2 commits May 8, 2017 17:27

Changing command line option name

3321f7d

Fixing missed variable name

a05eb90

kevinsawicki reviewed May 9, 2017

View reviewed changes

juturu and others added 10 commits May 9, 2017 10:12

use will-create-webview event

277c315

Merge remote-tracking branch 'origin/master' into enable-webview

837ea88

Rename option to webviewTag and default to nodeIntegration value

bde1335

Add failing spec for webviewTag inheritance

e817dbf

Inherit webviewTag setting from parent window

9e88d33

Add explicit spec for removing preload from webview

fd78270

Add will-attach-webview advice to security.md

27a4522

Mention preloadURL is in webPreferences

6fccb75

Default webviewTag to false

a285a3e

kevinsawicki changed the title ~~Add option to override webview creation with node integration disabled~~ Allow enabling <webview> tag with node integration disabled May 17, 2017

kevinsawicki self-assigned this May 17, 2017

Merge origin/master into enable-webview

74b7afb

Tweak webviewTag option description

6a3f2e9

kevinsawicki merged commit 8404bdd into master May 19, 2017

kevinsawicki deleted the enable-webview branch May 19, 2017 17:58

tonyganch mentioned this pull request May 26, 2017

Update webview tag docs to reflect changes made in electron/electron#9397 electron/electronjs.org-old#738

Closed

tejohnso mentioned this pull request Jun 1, 2017

Documentation for webview and nodeIntegration suggests an insecure option #9186

Closed

pfrazee mentioned this pull request Jun 22, 2017

Look into disabling node integration in the shell window beakerbrowser/beaker#562

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow enabling <webview> tag with node integration disabled #9397

Allow enabling <webview> tag with node integration disabled #9397

juturu commented May 7, 2017

MarshallOfSound commented May 7, 2017

juturu commented May 7, 2017

MarshallOfSound commented May 7, 2017

juturu commented May 8, 2017

kevinsawicki May 8, 2017

juturu May 9, 2017

MarshallOfSound commented May 8, 2017

kevinsawicki May 9, 2017

kevinsawicki May 9, 2017

kevinsawicki commented May 17, 2017 •

edited

Loading

kevinsawicki commented May 17, 2017

kevinsawicki commented May 19, 2017

juturu commented May 19, 2017

Allow enabling <webview> tag with node integration disabled #9397

Allow enabling <webview> tag with node integration disabled #9397

Conversation

juturu commented May 7, 2017

MarshallOfSound commented May 7, 2017

juturu commented May 7, 2017

MarshallOfSound commented May 7, 2017

juturu commented May 8, 2017

kevinsawicki May 8, 2017

Choose a reason for hiding this comment

juturu May 9, 2017

Choose a reason for hiding this comment

MarshallOfSound commented May 8, 2017

kevinsawicki May 9, 2017

Choose a reason for hiding this comment

kevinsawicki May 9, 2017

Choose a reason for hiding this comment

kevinsawicki commented May 17, 2017 • edited Loading

kevinsawicki commented May 17, 2017

kevinsawicki commented May 19, 2017

juturu commented May 19, 2017

kevinsawicki commented May 17, 2017 •

edited

Loading