Skip to content

Commit

Permalink
Turn on new worldSafeExecuteJavaScript webPreference.
Browse files Browse the repository at this point in the history
<electron/electron#24114>
"Previously the return values of webFrame.executeJavaScript crossed the world boundary when context isolation was enabled. This allows apps to makes themselves insecure by accidentally sending objects from the isolated world back to the main world. To help devs avoid this we're adding this new flag, and this flag will be turned on by default in Electron 12 (and removed) ensuring that this kind of issue can't become a thing again.

This PR is also requesting new minors of 8 and 9 😄

Notes: Added new worldSafeExecuteJavaScript webPreference to ensure that the return values from webFrame.executeJavaScript are world safe when context isolation is enabled"
  • Loading branch information
Paul Delhanty committed Aug 14, 2020
1 parent d0e9234 commit a05e434
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions src/main.ts
Expand Up @@ -7,6 +7,10 @@ function createWindow() {
height: 600,
webPreferences: {
preload: path.join(__dirname, "preload.js"),
// Need `contextIslation` and `worldSafeExecuteJavaScript` both set
// to silence recent `webFrame.executeJavaScript` warnings.
contextIsolation: true,
worldSafeExecuteJavaScript: true
},
width: 800,
});
Expand Down

0 comments on commit a05e434

Please sign in to comment.