Revert "sec: deprecate some webPreference defaults to be secure-by-default (#14284)" (#14380)

This reverts commit 66d6ba8689.

atom/browser/web_contents_preferences.cc

@@ -8,7 +8,6 @@
 #include <string>
 #include <vector>
 
-#include "atom/browser/api/atom_api_web_contents.h"
 #include "atom/browser/native_window.h"
 #include "atom/browser/web_view_manager.h"
 #include "atom/common/native_mate_converters/value_converter.h"
@@ -100,14 +99,12 @@ WebContentsPreferences::WebContentsPreferences(
   // Set WebPreferences defaults onto the JS object
   SetDefaultBoolIfUndefined(options::kPlugins, false);
   SetDefaultBoolIfUndefined(options::kExperimentalFeatures, false);
-  bool node = SetDefaultBoolIfUndefined(options::kNodeIntegration, true,
+  bool node = SetDefaultBoolIfUndefined(options::kNodeIntegration, true);
-                                        Status::Deprecated);
   SetDefaultBoolIfUndefined(options::kNodeIntegrationInWorker, false);
-  SetDefaultBoolIfUndefined(options::kWebviewTag, node, Status::Deprecated);
+  SetDefaultBoolIfUndefined(options::kWebviewTag, node);
   SetDefaultBoolIfUndefined(options::kSandbox, false);
   SetDefaultBoolIfUndefined(options::kNativeWindowOpen, false);
-  SetDefaultBoolIfUndefined(options::kContextIsolation, false,
+  SetDefaultBoolIfUndefined(options::kContextIsolation, false);
-                            Status::Deprecated);
   SetDefaultBoolIfUndefined("javascript", true);
   SetDefaultBoolIfUndefined("images", true);
   SetDefaultBoolIfUndefined("textAreasAreResizable", true);
@@ -137,25 +134,16 @@ WebContentsPreferences::~WebContentsPreferences() {
 
 bool WebContentsPreferences::SetDefaultBoolIfUndefined(
     const base::StringPiece& key,
-    bool val,
+    bool val) {
-    Status status) {
   auto* current_value =
       preference_.FindKeyOfType(key, base::Value::Type::BOOLEAN);
   if (current_value) {
     return current_value->GetBool();
   } else {
     preference_.SetKey(key, base::Value(val));
-
-    if (status == Status::Deprecated && web_contents_) {
-      auto internal_contents = atom::api::WebContents::CreateFrom(
-          v8::Isolate::GetCurrent(), web_contents_);
-      internal_contents->Emit("-deprecated-default",
-                              std::string("webPreferences.") + key.data(),
-                              /* oldDefault */ val, /* newDefault */ !val);
-    }
-  }
     return val;
   }
+}
 
 bool WebContentsPreferences::IsEnabled(const base::StringPiece& name,
                                        bool default_value) const {

atom/browser/web_contents_preferences.h

@@ -66,15 +66,11 @@ class WebContentsPreferences
   friend class content::WebContentsUserData<WebContentsPreferences>;
   friend class AtomBrowserClient;
 
-  enum class Status { Deprecated, Stable };
-
   // Get WebContents according to process ID.
   static content::WebContents* GetWebContentsFromProcessID(int process_id);
 
   // Set preference value to given bool if user did not provide value
-  bool SetDefaultBoolIfUndefined(const base::StringPiece& key,
+  bool SetDefaultBoolIfUndefined(const base::StringPiece& key, bool val);
-                                 bool val,
-                                 Status status = Status::Stable);
 
   static std::vector<WebContentsPreferences*> instances_;
 

default_app/default_app.js

@@ -16,10 +16,7 @@ exports.load = (appUrl) => {
       autoHideMenuBar: true,
       backgroundColor: '#FFFFFF',
       webPreferences: {
-        nodeIntegration: false,
+        nodeIntegrationInWorker: true
-        webviewTag: false,
-        contextIsolation: true,
-        preload: path.resolve(__dirname, 'renderer.js')
       },
       useContentSize: true,
       show: false

default_app/index.html

@@ -83,6 +83,8 @@
       </div>
     </div>
   </nav>
+
+  <script src="./renderer.js"></script>
 </body>
 
 </html>

default_app/renderer.js

@@ -4,7 +4,6 @@ const path = require('path')
 const URL = require('url')
 const electronPath = path.relative(process.cwd(), remote.process.execPath)
 
-function initialize () {
 Array.from(document.querySelectorAll('a[href]')).forEach(link => {
   // safely add `?utm_source=default_app
   let url = URL.parse(link.getAttribute('href'), true)
@@ -51,13 +50,3 @@ function initialize () {
 for (const element of document.querySelectorAll('.octicon')) {
   loadSVG(element)
 }
-}
-
-function onReadyStateChange () {
-  if (document.readyState === 'complete') {
-    document.removeEventListener('readystatechange', onReadyStateChange)
-    initialize()
-  }
-}
-
-document.addEventListener('readystatechange', onReadyStateChange)

docs/api/breaking-changes.md

@@ -34,18 +34,6 @@ app.releaseSingleInstance()
 app.releaseSingleInstanceLock()
 ```
 
-## `new BrowserWindow({ webPreferences: { ... }})`
-
-```js
-// Deprecated defaults
-const webPreferences = {}
-new BrowserWindow({ webPreferences })
-
-// webPreferences.contextIsolation - Default was false, will be true
-// webPreferences.nodeIntegration - Default was true, will be false
-// webPreferences.webviewTag - Default was true, will be false
-```
-
 
 # Breaking API Changes (3.0)
 

lib/browser/api/web-contents.js

@@ -293,10 +293,6 @@ WebContents.prototype._init = function () {
     ipcMain.emit(channel, event, ...args)
   })
 
-  this.on('-deprecated-default', function (event, key, oldDefault, newDefault) {
-    deprecate.warnDefault(key, oldDefault, newDefault)
-  })
-
   // Handle context menu action request from pepper plugin.
   this.on('pepper-context-menu', function (event, params, callback) {
     // Access Menu via electron.Menu to prevent circular require.

lib/common/api/deprecate.js

@@ -31,12 +31,6 @@ deprecate.warn = (oldName, newName) => {
   return deprecate.log(`'${oldName}' is deprecated. Use '${newName}' instead.`)
 }
 
-deprecate.warnDefault = (propName, oldDefault, newDefault) => {
-  return deprecate.log(`The default value of '${propName}' is changing from \
-'${oldDefault}' to '${newDefault}' in a future release. If you want to keep \
-the current value, please explicitly declare the property.`)
-}
-
 let deprecationHandler = null
 
 // Print deprecation message.

lib/renderer/security-warnings.js

@@ -61,13 +61,6 @@ const getIsRemoteProtocol = function () {
  * @returns {boolean} Is a CSP with `unsafe-eval` set?
  */
 const isUnsafeEvalEnabled = function () {
-  // FIXME(MarshallOfSound): Although not exactly true, this warning is incorrect
-  // when contextIsolation is enabled
-  // FIXME(MarshallOfSound): Once remote issues have gone away we can remove
-  // the falsey check
-  const prefs = getWebPreferences()
-  if (prefs && prefs.contextIsolation) return false
-
   try {
     //eslint-disable-next-line
     new Function('');