Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Jeremy Rose <jeremya@chromium.org>
  • Loading branch information
MarshallOfSound and nornagon committed Jun 24, 2020
1 parent d300a3f commit 49f8c7c
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
6 changes: 3 additions & 3 deletions docs/api/browser-window.md
Expand Up @@ -348,9 +348,9 @@ It creates a new `BrowserWindow` with native properties as set by the `options`.
You can access this context in the dev tools by selecting the
'Electron Isolated Context' entry in the combo box at the top of the
Console tab.
* `worldSafeExecuteJavaScript` Boolean (optional) - Whether to ensure JS values
can't unsafely cross worlds when using `webFrame.executeJavaScript`. The default
is `false` though this will be irreversibly be changing to `true` in Electron 12.
* `worldSafeExecuteJavaScript` Boolean (optional) - If true, values returned from `webFrame.executeJavaScript` will be sanitized to ensure JS values
can't unsafely cross between worlds when using `contextIsolation`. The default
is `false`. In Electron 12, the default will be changed to `true`. _Deprecated_
* `nativeWindowOpen` Boolean (optional) - Whether to use native
`window.open()`. Defaults to `false`. Child windows will always have node
integration disabled unless `nodeIntegrationInSubFrames` is true. **Note:** This option is currently
Expand Down
2 changes: 1 addition & 1 deletion lib/renderer/api/web-frame.ts
Expand Up @@ -58,7 +58,7 @@ for (const name in binding) {
// use a neat `keyof` here
(WebFrame as any).prototype[name] = function (...args: Array<any>) {
if (!worldSafeJS && name.startsWith('executeJavaScript')) {
deprecate.log(`Security Warning: webFrame.${name} was called without worldSafeExecuteJavaScript set to true. This is considered unsafe and the default of worldSafeExecuteJavaScript will be changing to true in Electron 12.`);
deprecate.log(`Security Warning: webFrame.${name} was called without worldSafeExecuteJavaScript enabled. This is considered unsafe. worldSafeExecuteJavaScript will be enabled by default in Electron 12.`);
}
return binding[name](this.context, ...args);
};
Expand Down

0 comments on commit 49f8c7c

Please sign in to comment.