Implement context isolation in electron
- Dominant language
- JavaScript
- Stars
- 27
- Forks
- 31
- Avg merge
- 10h 47m
- Merged PRs (30d)
- 5
Description
**Is your feature request related to a problem? Please describe.**
We're not yet following Electron best practices fully. https://www.electronjs.org/docs/latest/tutorial/context-isolation
**Describe the solution you'd like**
https://github.com/bitshares/beet/blob/develop/src/background.js#L170
https://github.com/bitshares/beet/blob/develop/src/background.js#L251
Set `nodeIntegration` and `enableRemoteModule` to false, and `contextIsolation` to true.
Adapt renderer to request node/module functions/data through the ipcmain/ipcrenderer pipeline.
**Describe alternatives you've considered**
Exhaustively prevent XSS in the renderer.
**Additional context**
Latest BTS NFT Viewer has made these changes: https://github.com/BTS-CM/NFT_Viewer/releases/tag/v1.9.2
And the airdrop tool is about 98% of the way there: https://github.com/BTS-CM/airdrop_tool/tree/context_isolation
The background.js file is likely to significantly bloat due to inheriting code from the renderer.
This is likely a multi-thousand LOC feature request, however it's worthwhile to make the wallet follow best practices.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.