mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

feat: only allow bundled preload scripts (#17308)

Browse source
This commit is contained in:
Milan Burda 2019-03-28 11:38:51 +01:00 • committed by Alexey Kuzmin
parent 3d307e5610
commit 8cf15cc931
11 changed files with 79 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
lib/renderer/init.ts
View file

@ -1,4 +1,5 @@
import { EventEmitter } from 'events'
import * as fs from 'fs'
import * as path from 'path'
const Module = require('module')
@ -160,10 +161,22 @@ if (nodeIntegration) {
}
const errorUtils = require('@electron/internal/common/error-utils')
const { isParentDir } = require('@electron/internal/common/path-utils')
let absoluteAppPath: string
const getAppPath = function () {
if (absoluteAppPath === undefined) {
absoluteAppPath = fs.realpathSync(appPath!)
}
return absoluteAppPath
}
// Load the preload scripts.
for (const preloadScript of preloadScripts) {
try {
if (!isParentDir(getAppPath(), fs.realpathSync(preloadScript))) {
throw new Error('Preload scripts outside of app path are not allowed')
}
require(preloadScript)
} catch (error) {
console.error(`Unable to load preload script: ${preloadScript}`)