Merge pull request ytmdesktop#344 from MarshallOfSound/context-isolate

🔒 enable security settings for the main window
atcq · Aug 27, 2020 · 2d82db9 · 2d82db9
2 parents c0cd1ac + cbe3c97
commit 2d82db9
Show file tree

Hide file tree

Showing 4 changed files with 562 additions and 378 deletions.
diff --git a/main.js b/main.js
@@ -239,9 +239,12 @@ function createWindow() {
 
     view = new BrowserView({
         webPreferences: {
-            nodeIntegration: true,
-            webviewTag: true,
-            enableRemoteModule: true,
+            nodeIntegration: false,
+            webviewTag: false,
+            enableRemoteModule: false,
+            contextIsolation: true,
+            sandbox: true,
+            nativeWindowOpen: true,
             preload: path.join(
                 app.getAppPath(),
                 '/src/utils/injectControls.js'
@@ -1582,9 +1585,7 @@ function createWindow() {
 
         if (settingsProvider.get('settings-custom-css-app')) {
             if (fileSystem.checkIfExists(customThemeFile)) {
-                if (customCSSAppKey) {
-                    removeCustomCssApp()
-                }
+                removeCustomCssApp()
                 view.webContents
                     .insertCSS(fileSystem.readFile(customThemeFile).toString())
                     .then((key) => {
@@ -1595,7 +1596,7 @@ function createWindow() {
     }
 
     function removeCustomCSSApp() {
-        view.webContents.removeInsertedCSS(customCSSAppKey)
+        if (customCSSAppKey) view.webContents.removeInsertedCSS(customCSSAppKey)
     }
 
     function loadCustomCSSPage() {

diff --git a/src/providers/settingsProvider.js b/src/providers/settingsProvider.js
@@ -1,3 +1,4 @@
+const { ipcMain, webContents } = require('electron')
 const electronStore = require('electron-store')
 const store = new electronStore({ watch: true })
 
@@ -30,8 +31,45 @@ function setInitialValue(settingName, initialValue) {
 }
 
 function onDidChange(key, callback) {
-    store.onDidChange(key, (newValue, oldValue) => {
-        callback({ newValue: newValue, oldValue: oldValue })
+    return store.onDidChange(key, (newValue, oldValue) => {
+        callback({ newValue, oldValue })
+    })
+}
+
+function proxyCallbackToSender(id, key) {
+    return ({ newValue, oldValue }) => {
+        const sender = webContents.fromId(id)
+        if (!sender) return
+        sender.send(`SETTINGS_NOTIFY_${key}`, newValue, oldValue)
+    }
+}
+
+// In the browser process
+if (ipcMain) {
+    ipcMain.on('SETTINGS_GET', (e, settingName) => {
+        e.returnValue = get(settingName)
+    })
+
+    const subscriptions = new Map()
+
+    // TODO: Support unsubscribing over IPC, would need to decrement counter
+    // no use case yet so left unimplemented
+    ipcMain.on('SETTINGS_SUBSCRIBE', (e, settingName) => {
+        let existingSubs = subscriptions.get(e.sender.id)
+        if (!existingSubs) {
+            existingSubs = {}
+            subscriptions.set(e.sender.id, existingSubs)
+        }
+        if (existingSubs[settingName]) {
+            existingSubs[settingName]++
+        } else {
+            existingSubs[settingName] = 1
+            const unsub = onDidChange(
+                settingName,
+                proxyCallbackToSender(e.sender.id, settingName)
+            )
+            e.sender.on('destroyed', unsub)
+        }
     })
 }
 

diff --git a/src/providers/translateProvider.js b/src/providers/translateProvider.js
@@ -1,3 +1,4 @@
+const { ipcMain } = require('electron')
 const i18n = require('i18n')
 const settingsProvider = require('./settingsProvider')
 
@@ -52,6 +53,12 @@ function loadi18n() {
     })
 }
 
+if (ipcMain) {
+    ipcMain.on('I18N_TRANSLATE', (e, id, params) => {
+        e.returnValue = trans(id, params)
+    })
+}
+
 module.exports = {
     setLocale: setLocale,
     trans: trans,