PR 44648: Enabling creation on webview with node-integration disabled and raising events

- Enabling creation on webview with node-integration disabled and raising events

Conflicts:
	lib/browser/guest-view-manager.js

atom/browser/api/atom_api_web_contents.cc

@@ -406,6 +406,9 @@ void WebContents::InitWithSessionAndOptions(v8::Isolate* isolate,
 
   Init(isolate);
   AttachAsUserData(web_contents);
+
+  if (IsGuest())
+    Emit("did-create-webview");
 }
 
 WebContents::~WebContents() {

docs/api/web-contents.md

@@ -218,6 +218,17 @@ When in-page navigation happens, the page URL changes but does not cause
 navigation outside of the page. Examples of this occurring are when anchor links
 are clicked or when the DOM `hashchange` event is triggered.
 
+#### Event: 'will-create-webview'
+
+Returns:
+
+* `event` Event
+* `params` Object
+
+Emitted when web-view will be created.
+
+Use this event to remove preload scripts or stop creating webviews.
+
 #### Event: 'crashed'
 
 Returns:

docs/api/webview-tag.md

@@ -15,9 +15,6 @@ between your app and embedded content will be asynchronous. This keeps your app
 safe from the embedded content. **Note:** Most methods called on the
 webview from the host page require a syncronous call to the main process.
 
-For security purposes, `webview` can only be used in `BrowserWindow`s that have
-`nodeIntegration` enabled.
-
 ## Example
 
 To embed a web page in your app, add the `webview` tag to your app's embedder

lib/browser/guest-view-manager.js

@@ -297,7 +297,10 @@ ipcMain.on('ELECTRON_GUEST_VIEW_MANAGER_CREATE_GUEST', function (event, params,
 })
 
 ipcMain.on('ELECTRON_GUEST_VIEW_MANAGER_ATTACH_GUEST', function (event, elementInstanceId, guestInstanceId, params) {
-  attachGuest(event, elementInstanceId, guestInstanceId, params)
+  event.sender.emit('will-create-webview', event, params)
+  if (!event.defaultPrevented) {
+    attachGuest(event, elementInstanceId, guestInstanceId, params)
+  }
 })
 
 ipcMain.on('ELECTRON_GUEST_VIEW_MANAGER_DESTROY_GUEST', function (event, guestInstanceId) {

lib/renderer/init.js

@@ -94,7 +94,7 @@ if (window.location.protocol === 'chrome-devtools:') {
   require('./content-scripts-injector')
 
   // Load webview tag implementation.
-  if (nodeIntegration === 'true' && process.guestInstanceId == null) {
+  if (process.guestInstanceId == null) {
     require('./web-view/web-view')
     require('./web-view/web-view-attributes')
   }

spec/webview-spec.js

@@ -36,24 +36,6 @@ describe('<webview> tag', function () {
     w.loadURL('file://' + fixtures + '/pages/webview-no-script.html')
   })
 
-  it('is disabled when nodeIntegration is disabled', function (done) {
-    w = new BrowserWindow({
-      show: false,
-      webPreferences: {
-        nodeIntegration: false,
-        preload: path.join(fixtures, 'module', 'preload-webview.js')
-      }
-    })
-    ipcMain.once('webview', function (event, type) {
-      if (type === 'undefined') {
-        done()
-      } else {
-        done('WebView still exists')
-      }
-    })
-    w.loadURL('file://' + fixtures + '/pages/webview-no-script.html')
-  })
-
   describe('src attribute', function () {
     it('specifies the page to load', function (done) {
       webview.addEventListener('console-message', function (e) {
@@ -64,6 +46,38 @@ describe('<webview> tag', function () {
       document.body.appendChild(webview)
     })
 
+    it('disables node integration when disabled on the parent BrowserWindow', function (done) {
+      ipcMain.once('answer', function (event, typeofProcess) {
+        try {
+          assert.equal(typeofProcess, 'undefined')
+          done()
+        } finally {
+          b.close()
+        }
+      })
+
+      var windowUrl = require('url').format({
+        pathname: `${fixtures}/pages/webview-no-node-integration-on-window.html`,
+        protocol: 'file',
+        query: {
+          p: `${fixtures}/pages/web-view-log-process.html`
+        },
+        slashes: true
+      })
+      var preload = path.join(fixtures, 'module', 'answer.js')
+
+      var b = new BrowserWindow({
+        height: 400,
+        width: 400,
+        show: false,
+        webPreferences: {
+          preload: preload,
+          nodeIntegration: false
+        }
+      })
+      b.loadURL(windowUrl)
+    })
+
     it('navigates to new page when changed', function (done) {
       var listener = function () {
         webview.src = 'file://' + fixtures + '/pages/b.html'