You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The background.js file is likely to significantly bloat due to inheriting code from the renderer.
This is likely a multi-thousand LOC feature request, however it's worthwhile to make the wallet follow best practices.
This is an issue inherited from the Beet repo: bitshares#261
By addressing this exclusively for EOS we will not only improve security best practices, but we will also demonstrate the proof of concept for the main Beet wallet to follow suit.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
We're not yet following Electron best practices fully. https://www.electronjs.org/docs/latest/tutorial/context-isolation
Describe the solution you'd like
https://github.com/beetapp/beeteos/blob/master/src/background.js#L170
https://github.com/beetapp/beeteos/blob/master/src/background.js#L251
Set
nodeIntegration
andenableRemoteModule
to false, andcontextIsolation
to true.Adapt renderer to request node/module functions/data through the ipcmain/ipcrenderer pipeline.
Describe alternatives you've considered
Exhaustively prevent XSS in the renderer.
Additional context
Latest BTS NFT Viewer has made these changes: https://github.com/BTS-CM/NFT_Viewer
So has the airdrop tool: https://github.com/BTS-CM/airdrop_tool
The background.js file is likely to significantly bloat due to inheriting code from the renderer.
This is likely a multi-thousand LOC feature request, however it's worthwhile to make the wallet follow best practices.
This is an issue inherited from the Beet repo: bitshares#261
By addressing this exclusively for EOS we will not only improve security best practices, but we will also demonstrate the proof of concept for the main Beet wallet to follow suit.
The text was updated successfully, but these errors were encountered: