bitshares / bitshares/beet

Implement context isolation in electron

Open
#261 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
27
Forks
31
Avg merge
10h 47m
Merged PRs (30d)
5

Description

**Is your feature request related to a problem? Please describe.**

We're not yet following Electron best practices fully. https://www.electronjs.org/docs/latest/tutorial/context-isolation

**Describe the solution you'd like**

https://github.com/bitshares/beet/blob/develop/src/background.js#L170
https://github.com/bitshares/beet/blob/develop/src/background.js#L251

Set `nodeIntegration` and `enableRemoteModule` to false, and `contextIsolation` to true.

Adapt renderer to request node/module functions/data through the ipcmain/ipcrenderer pipeline.

**Describe alternatives you've considered**

Exhaustively prevent XSS in the renderer.

**Additional context**

Latest BTS NFT Viewer has made these changes: https://github.com/BTS-CM/NFT_Viewer/releases/tag/v1.9.2

And the airdrop tool is about 98% of the way there: https://github.com/BTS-CM/airdrop_tool/tree/context_isolation

The background.js file is likely to significantly bloat due to inheriting code from the renderer.

This is likely a multi-thousand LOC feature request, however it's worthwhile to make the wallet follow best practices.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.