Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement context isolation in electron #5

Closed
grctest opened this issue Oct 19, 2023 · 1 comment
Closed

Implement context isolation in electron #5

grctest opened this issue Oct 19, 2023 · 1 comment

Comments

@grctest
Copy link
Collaborator

grctest commented Oct 19, 2023

Is your feature request related to a problem? Please describe.

We're not yet following Electron best practices fully. https://www.electronjs.org/docs/latest/tutorial/context-isolation

Describe the solution you'd like

https://github.com/beetapp/beeteos/blob/master/src/background.js#L170
https://github.com/beetapp/beeteos/blob/master/src/background.js#L251

Set nodeIntegration and enableRemoteModule to false, and contextIsolation to true.

Adapt renderer to request node/module functions/data through the ipcmain/ipcrenderer pipeline.

Describe alternatives you've considered

Exhaustively prevent XSS in the renderer.

Additional context

Latest BTS NFT Viewer has made these changes: https://github.com/BTS-CM/NFT_Viewer

So has the airdrop tool: https://github.com/BTS-CM/airdrop_tool

The background.js file is likely to significantly bloat due to inheriting code from the renderer.

This is likely a multi-thousand LOC feature request, however it's worthwhile to make the wallet follow best practices.


This is an issue inherited from the Beet repo: bitshares#261

By addressing this exclusively for EOS we will not only improve security best practices, but we will also demonstrate the proof of concept for the main Beet wallet to follow suit.

@grctest
Copy link
Collaborator Author

grctest commented Mar 10, 2024

Context isolation has been fully implemented now: https://github.com/beetapp/beeteos/releases/tag/v1.1.0

@grctest grctest closed this as completed Mar 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant