Skip to content
This repository was archived by the owner on Feb 23, 2021. It is now read-only.
This repository was archived by the owner on Feb 23, 2021. It is now read-only.

White list IPC calls in preload.js instead of directly exposing window.ipcRenderer #75

@kewde

Description

@kewde

Description

https://github.com/lightninglabs/lightning-app/blob/master/apps/desktop/main.dev.js#L128
NodeJS (nodeIntegration) is not disabled, this gives the JavaScript (loaded by the HTML files) in the renderer process full control over the system.

The Chromium sandbox is also disabled by default, I suggest enabling it but this may require architectural changes. I've created a comprehensive tutorial and boilerplate example on how to create a secure electron application.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions