feat: add additional remote APIs filtering

docs/api/app.md

@@ -435,6 +435,52 @@ Emitted when `remote.getGlobal()` is called in the renderer process of `webConte
 Calling `event.preventDefault()` will prevent the global from being returned.
 Custom value can be returned by setting `event.returnValue`.
 
+### Event: 'remote-get-builtin'
+
+Returns:
+
+* `event` Event
+* `webContents` [WebContents](web-contents.md)
+* `moduleName` String
+
+Emitted when `remote.getBuiltin()` is called in the renderer process of `webContents`.
+Calling `event.preventDefault()` will prevent the module from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
+### Event: 'remote-get-current-window'
+
+Returns:
+
+* `event` Event
+* `webContents` [WebContents](web-contents.md)
+
+Emitted when `remote.getCurrentWindow()` is called in the renderer process of `webContents`.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
+### Event: 'remote-get-current-web-contents'
+
+Returns:
+
+* `event` Event
+* `webContents` [WebContents](web-contents.md)
+
+Emitted when `remote.getCurrentWebContents()` is called in the renderer process of `webContents`.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
+### Event: 'remote-get-guest-web-contents'
+
+Returns:
+
+* `event` Event
+* `webContents` [WebContents](web-contents.md)
+* `guestWebContents` [WebContents](web-contents.md)
+
+Emitted when `<webview>.getWebContents()` is called in the renderer process of `webContents`.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
 ## Methods
 
 The `app` object has the following methods:

docs/api/web-contents.md

@@ -694,6 +694,48 @@ Emitted when `remote.getGlobal()` is called in the renderer process.
 Calling `event.preventDefault()` will prevent the global from being returned.
 Custom value can be returned by setting `event.returnValue`.
 
+#### Event: 'remote-get-builtin'
+
+Returns:
+
+* `event` Event
+* `moduleName` String
+
+Emitted when `remote.getBuiltin()` is called in the renderer process.
+Calling `event.preventDefault()` will prevent the module from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
+#### Event: 'remote-get-current-window'
+
+Returns:
+
+* `event` Event
+
+Emitted when `remote.getCurrentWindow()` is called in the renderer process.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
+#### Event: 'remote-get-current-web-contents'
+
+Returns:
+
+* `event` Event
+
+Emitted when `remote.getCurrentWebContents()` is called in the renderer process.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
+#### Event: 'remote-get-guest-web-contents'
+
+Returns:
+
+* `event` Event
+* `guestWebContents` [WebContents](web-contents.md)
+
+Emitted when `<webview>.getWebContents()` is called in the renderer process.
+Calling `event.preventDefault()` will prevent the object from being returned.
+Custom value can be returned by setting `event.returnValue`.
+
 ### Instance Methods
 
 #### `contents.loadURL(url[, options])`

lib/browser/api/web-contents.js

@@ -377,17 +377,21 @@ WebContents.prototype._init = function () {
     })
   })
 
-  this.on('desktop-capturer-get-sources', (event, ...args) => {
-    app.emit('desktop-capturer-get-sources', event, this, ...args)
-  })
-
-  this.on('remote-require', (event, ...args) => {
-    app.emit('remote-require', event, this, ...args)
-  })
-
-  this.on('remote-get-global', (event, ...args) => {
-    app.emit('remote-get-global', event, this, ...args)
-  })
+  const forwardedEvents = [
+    'desktop-capturer-get-sources',
+    'remote-require',
+    'remote-get-global',
+    'remote-get-builtin',
+    'remote-get-current-window',
+    'remote-get-current-web-contents',
+    'remote-get-guest-web-contents'
+  ]
+
+  for (const eventName of forwardedEvents) {
+    this.on(eventName, (event, ...args) => {
+      app.emit(eventName, event, this, ...args)
+    })
+  }
 
   deprecate.event(this, 'did-get-response-details', '-did-get-response-details')
   deprecate.event(this, 'did-get-redirect-request', '-did-get-redirect-request')

lib/browser/rpc-server.js

@@ -309,8 +309,19 @@ handleRemoteCommand('ELECTRON_BROWSER_REQUIRE', function (event, contextId, modu
   return valueToMeta(event.sender, contextId, customEvent.returnValue)
 })
 
-handleRemoteCommand('ELECTRON_BROWSER_GET_BUILTIN', function (event, contextId, module) {
-  return valueToMeta(event.sender, contextId, electron[module])
+handleRemoteCommand('ELECTRON_BROWSER_GET_BUILTIN', function (event, contextId, moduleName) {
+  const customEvent = eventBinding.createWithSender(event.sender)
+  event.sender.emit('remote-get-builtin', customEvent, moduleName)
+
+  if (customEvent.defaultPrevented) {
+    if (typeof customEvent.returnValue === 'undefined') {
+      throw new Error(`Invalid electron module: ${moduleName}`)
+    }
+  } else {
+    customEvent.returnValue = electron[moduleName]
+  }
+
+  return valueToMeta(event.sender, contextId, customEvent.returnValue)
 })
 
 handleRemoteCommand('ELECTRON_BROWSER_GLOBAL', function (event, contextId, globalName) {
@@ -329,11 +340,33 @@ handleRemoteCommand('ELECTRON_BROWSER_GLOBAL', function (event, contextId, globa
 })
 
 handleRemoteCommand('ELECTRON_BROWSER_CURRENT_WINDOW', function (event, contextId) {
-  return valueToMeta(event.sender, contextId, event.sender.getOwnerBrowserWindow())
+  const customEvent = eventBinding.createWithSender(event.sender)
+  event.sender.emit('remote-get-current-window', customEvent)
+
+  if (customEvent.defaultPrevented) {
+    if (typeof customEvent.returnValue === 'undefined') {
+      throw new Error('Blocked remote.getCurrentWindow()')
+    }
+  } else {
+    customEvent.returnValue = event.sender.getOwnerBrowserWindow()
+  }
+
+  return valueToMeta(event.sender, contextId, customEvent.returnValue)
 })
 
 handleRemoteCommand('ELECTRON_BROWSER_CURRENT_WEB_CONTENTS', function (event, contextId) {
-  return valueToMeta(event.sender, contextId, event.sender)
+  const customEvent = eventBinding.createWithSender(event.sender)
+  event.sender.emit('remote-get-current-web-contents', customEvent)
+
+  if (customEvent.defaultPrevented) {
+    if (typeof customEvent.returnValue === 'undefined') {
+      throw new Error('Blocked remote.getCurrentWebContents()')
+    }
+  } else {
+    customEvent.returnValue = event.sender
+  }
+
+  return valueToMeta(event.sender, contextId, customEvent.returnValue)
 })
 
 handleRemoteCommand('ELECTRON_BROWSER_CONSTRUCTOR', function (event, contextId, id, args) {
@@ -413,7 +446,19 @@ handleRemoteCommand('ELECTRON_BROWSER_CONTEXT_RELEASE', (event, contextId) => {
 
 handleRemoteCommand('ELECTRON_BROWSER_GUEST_WEB_CONTENTS', function (event, contextId, guestInstanceId) {
   const guest = guestViewManager.getGuestForWebContents(guestInstanceId, event.sender)
-  return valueToMeta(event.sender, contextId, guest)
+
+  const customEvent = eventBinding.createWithSender(event.sender)
+  event.sender.emit('remote-get-guest-web-contents', customEvent, guest)
+
+  if (customEvent.defaultPrevented) {
+    if (typeof customEvent.returnValue === 'undefined') {
+      throw new Error('Blocked <webview>.getWebContents()')
+    }
+  } else {
+    customEvent.returnValue = guest
+  }
+
+  return valueToMeta(event.sender, contextId, customEvent.returnValue)
 })
 
 // Implements window.close()

spec/api-app-spec.js

@@ -425,6 +425,52 @@ describe('app module', () => {
       w.loadURL('about:blank')
       w.webContents.executeJavaScript(`require('electron').remote.getGlobal('test')`)
     })
+
+    it('should emit remote-get-builtin event when remote.getBuiltin() is invoked', (done) => {
+      app.once('remote-get-builtin', (event, webContents, moduleName) => {
+        expect(webContents).to.equal(w.webContents)
+        expect(moduleName).to.equal('app')
+        done()
+      })
+      w = new BrowserWindow({
+        show: false,
+        webPreferences: {
+          nodeIntegration: true
+        }
+      })
+      w.loadURL('about:blank')
+      w.webContents.executeJavaScript(`require('electron').remote.app`)
+    })
+
+    it('should emit remote-get-current-window event when remote.getCurrentWindow() is invoked', (done) => {
+      app.once('remote-get-current-window', (event, webContents) => {
+        expect(webContents).to.equal(w.webContents)
+        done()
+      })
+      w = new BrowserWindow({
+        show: false,
+        webPreferences: {
+          nodeIntegration: true
+        }
+      })
+      w.loadURL('about:blank')
+      w.webContents.executeJavaScript(`require('electron').remote.getCurrentWindow()`)
+    })
+
+    it('should emit remote-get-current-web-contents event when remote.getCurrentWebContents() is invoked', (done) => {
+      app.once('remote-get-current-web-contents', (event, webContents) => {
+        expect(webContents).to.equal(w.webContents)
+        done()
+      })
+      w = new BrowserWindow({
+        show: false,
+        webPreferences: {
+          nodeIntegration: true
+        }
+      })
+      w.loadURL('about:blank')
+      w.webContents.executeJavaScript(`require('electron').remote.getCurrentWebContents()`)
+    })
   })
 
   describe('app.setBadgeCount', () => {

spec/api-remote-spec.js

@@ -28,7 +28,7 @@ describe('remote module', () => {
 
   afterEach(() => closeWindow(w).then(() => { w = null }))
 
-  describe('remote.getGlobal', () => {
+  describe('remote.getGlobal filtering', () => {
     it('can return custom values', () => {
       ipcRenderer.send('handle-next-remote-get-global', { test: 'Hello World!' })
       expect(remote.getGlobal('test')).to.be.equal('Hello World!')
@@ -40,7 +40,19 @@ describe('remote module', () => {
     })
   })
 
-  describe('remote.require', () => {
+  describe('remote.getBuiltin filtering', () => {
+    it('can return custom values', () => {
+      ipcRenderer.send('handle-next-remote-get-builtin', { test: 'Hello World!' })
+      expect(remote.getBuiltin('test')).to.be.equal('Hello World!')
+    })
+
+    it('throws when no returnValue set', () => {
+      ipcRenderer.send('handle-next-remote-get-builtin')
+      expect(() => remote.getBuiltin('app')).to.throw('Invalid electron module: app')
+    })
+  })
+
+  describe('remote.require filtering', () => {
     it('can return custom values', () => {
       ipcRenderer.send('handle-next-remote-require', { test: 'Hello World!' })
       expect(remote.require('test')).to.be.equal('Hello World!')
@@ -50,7 +62,9 @@ describe('remote module', () => {
       ipcRenderer.send('handle-next-remote-require')
       expect(() => remote.require('electron')).to.throw('Invalid module: electron')
     })
+  })
 
+  describe('remote.require', () => {
     it('should returns same object for the same module', () => {
       const dialog1 = remote.require('electron')
       const dialog2 = remote.require('electron')
@@ -451,6 +465,30 @@ describe('remote module', () => {
     })
   })
 
+  describe('remote.getCurrentWindow filtering', () => {
+    it('can return custom value', () => {
+      ipcRenderer.send('handle-next-remote-get-current-window', 'Hello World!')
+      expect(remote.getCurrentWindow()).to.be.equal('Hello World!')
+    })
+
+    it('throws when no returnValue set', () => {
+      ipcRenderer.send('handle-next-remote-get-current-window')
+      expect(() => remote.getCurrentWindow()).to.throw('Blocked remote.getCurrentWindow()')
+    })
+  })
+
+  describe('remote.getCurrentWebContents filtering', () => {
+    it('can return custom value', () => {
+      ipcRenderer.send('handle-next-remote-get-current-web-contents', 'Hello World!')
+      expect(remote.getCurrentWebContents()).to.be.equal('Hello World!')
+    })
+
+    it('throws when no returnValue set', () => {
+      ipcRenderer.send('handle-next-remote-get-current-web-contents')
+      expect(() => remote.getCurrentWebContents()).to.throw('Blocked remote.getCurrentWebContents()')
+    })
+  })
+
   describe('remote class', () => {
     const cl = remote.require(path.join(fixtures, 'module', 'class.js'))
     const base = cl.base

spec/static/main.js

@@ -235,29 +235,34 @@ app.on('ready', function () {
   })
 })
 
-ipcMain.on('handle-next-desktop-capturer-get-sources', function (event) {
-  event.sender.once('desktop-capturer-get-sources', (event) => {
-    event.preventDefault()
-  })
-})
-
-ipcMain.on('handle-next-remote-require', function (event, modulesMap = {}) {
-  event.sender.once('remote-require', (event, moduleName) => {
-    event.preventDefault()
-    if (modulesMap.hasOwnProperty(moduleName)) {
-      event.returnValue = modulesMap[moduleName]
-    }
+for (const eventName of [
+  'remote-require',
+  'remote-get-global',
+  'remote-get-builtin'
+]) {
+  ipcMain.on(`handle-next-${eventName}`, function (event, valuesMap = {}) {
+    event.sender.once(eventName, (event, name) => {
+      event.preventDefault()
+      if (valuesMap.hasOwnProperty(name)) {
+        event.returnValue = valuesMap[name]
+      }
+    })
   })
-})
+}
 
-ipcMain.on('handle-next-remote-get-global', function (event, globalsMap = {}) {
-  event.sender.once('remote-get-global', (event, globalName) => {
-    event.preventDefault()
-    if (globalsMap.hasOwnProperty(globalName)) {
-      event.returnValue = globalsMap[globalName]
-    }
+for (const eventName of [
+  'desktop-capturer-get-sources',
+  'remote-get-current-window',
+  'remote-get-current-web-contents',
+  'remote-get-guest-web-contents'
+]) {
+  ipcMain.on(`handle-next-${eventName}`, function (event, returnValue) {
+    event.sender.once(eventName, (event) => {
+      event.preventDefault()
+      event.returnValue = returnValue
+    })
   })
-})
+}
 
 ipcMain.on('set-client-certificate-option', function (event, skip) {
   app.once('select-client-certificate', function (event, webContents, url, list, callback) {