diff --git a/lib/browser/guest-window-manager.js b/lib/browser/guest-window-manager.js index 305da92f9e6..156e5bc708d 100644 --- a/lib/browser/guest-window-manager.js +++ b/lib/browser/guest-window-manager.js @@ -7,6 +7,14 @@ const parseFeaturesString = require('../common/parse-features-string') const hasProp = {}.hasOwnProperty const frameToGuest = new Map() +// Security options that child windows will always inherit from parent windows +const inheritedWebPreferences = new Map([ + ['contextIsolation', true], + ['javascript', false], + ['nodeIntegration', false], + ['webviewTag', false] +]) + // Copy attribute of |parent| to |child| if it is not defined in |child|. const mergeOptions = function (child, parent, visited) { // Check for circular reference. @@ -43,19 +51,11 @@ const mergeBrowserWindowOptions = function (embedder, options) { mergeOptions(options.webPreferences, embedder.getWebPreferences()) } - // Disable node integration on child window if disabled on parent window - if (embedder.getWebPreferences().nodeIntegration === false) { - options.webPreferences.nodeIntegration = false - } - - // Enable context isolation on child window if enabled on parent window - if (embedder.getWebPreferences().contextIsolation === true) { - options.webPreferences.contextIsolation = true - } - - // Disable JavaScript on child window if disabled on parent window - if (embedder.getWebPreferences().javascript === false) { - options.webPreferences.javascript = false + // Inherit certain option values from parent window + for (const [name, value] of inheritedWebPreferences) { + if (embedder.getWebPreferences()[name] === value) { + options.webPreferences[name] = value + } } // Sets correct openerId here to give correct options to 'new-window' event handler @@ -191,7 +191,7 @@ ipcMain.on('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_OPEN', (event, url, frameName, const options = {} const ints = ['x', 'y', 'width', 'height', 'minWidth', 'maxWidth', 'minHeight', 'maxHeight', 'zoomFactor'] - const webPreferences = ['zoomFactor', 'nodeIntegration', 'preload', 'javascript', 'contextIsolation'] + const webPreferences = ['zoomFactor', 'nodeIntegration', 'preload', 'javascript', 'contextIsolation', 'webviewTag'] const disposition = 'new-window' // Used to store additional features