scratchfoundation / scratchfoundation/scratch-desktop
We should disable Node integration in browser windows
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 426
- Forks
- 268
- Avg merge
- 16h 6m
- Merged PRs (30d)
- 25
Description
Expected Behavior
Node integration should be disabled for all browser windows. Code which needs to use Node features can do so through a preload script. This isn't critical since Scratch Desktop generally doesn't display any remote content, but it wouldn't hurt to be extra careful.
Actual Behavior
Node integration is enabled on all browser windows.
See also
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating where Scratch Desktop creates its browser windows and configures Node integration, then inspect the preload scripts used by those windows. Done means every browser window has Node integration disabled while code that needs Node features continues to work through preload scripts; review the Electron security guidance linked in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, javascript
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100