From a55e08f5169b198a0928f1889b24f782b6e9e542 Mon Sep 17 00:00:00 2001 From: Amaury Martiny Date: Mon, 2 Sep 2019 16:40:40 +0200 Subject: [PATCH 1/2] fix: Disable Electron remote module --- packages/fether-electron/src/main/app/options/config/index.js | 4 ++++ packages/fether-electron/static/preload.js | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/packages/fether-electron/src/main/app/options/config/index.js b/packages/fether-electron/src/main/app/options/config/index.js index 115aa8405..9666b09f9 100644 --- a/packages/fether-electron/src/main/app/options/config/index.js +++ b/packages/fether-electron/src/main/app/options/config/index.js @@ -143,6 +143,10 @@ const SECURITY_OPTIONS = { * Reference: https://electronjs.org/docs/tutorial/security */ devTools: !IS_PROD, + /** + * Disable Electron's remote module. + */ + enableRemoteModule: false, /** * `nodeIntegration` when enabled allows the software to use Electron's APIs * and gain access to Node.js. It must be disabled to restricting access to diff --git a/packages/fether-electron/static/preload.js b/packages/fether-electron/static/preload.js index e2c616365..389aa1ea3 100644 --- a/packages/fether-electron/static/preload.js +++ b/packages/fether-electron/static/preload.js @@ -17,10 +17,10 @@ * https://github.com/electron/electron/issues/13130 */ -const { ipcRenderer, remote } = require('electron'); +const { ipcRenderer } = require('electron'); const RENDERER_ORIGIN = - remote.getGlobal('IS_PROD') === true ? 'file://' : 'http://localhost:3000'; + process.env.NODE_ENV === 'development' ? 'http://localhost:3000' : 'file://'; /** * Handler that receives an IPC message from the main process, and passes it From 7adb60e42cb7b4fcf1aaf9fec33321d4f2175b91 Mon Sep 17 00:00:00 2001 From: Amaury Martiny Date: Mon, 2 Sep 2019 17:21:07 +0200 Subject: [PATCH 2/2] Remove duplicate --- packages/fether-electron/src/main/app/options/config/index.js | 1 - 1 file changed, 1 deletion(-) diff --git a/packages/fether-electron/src/main/app/options/config/index.js b/packages/fether-electron/src/main/app/options/config/index.js index 9666b09f9..975cdaa71 100644 --- a/packages/fether-electron/src/main/app/options/config/index.js +++ b/packages/fether-electron/src/main/app/options/config/index.js @@ -177,7 +177,6 @@ const SECURITY_OPTIONS = { * Reference: https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security-wp.pdf */ sandbox: true, // Do not set to false. Run electron with `electron --enable-sandbox` to sandbox all BrowserWindow instances - enableRemoteModule: true, // Remote is required in fether-react parityStore.js // Enables same origin policy to prevent execution of insecure code. Do not set to false webSecurity: true, allowRunningInsecureContent: false, // Do not set to true