mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions 1

Fix some broken documentation links (#12794)

Browse source
This commit is contained in:
Charles Kerr 2018-05-02 10:33:07 -05:00 • committed by GitHub
parent 1957eb9429
commit c81dac774a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/development/pull-requests.md
View file

@ -12,10 +12,10 @@
* [Step 6: Rebase](#step-6-rebase) * [Step 6: Rebase](#step-6-rebase)
* [Step 7: Test](#step-7-test) * [Step 7: Test](#step-7-test)
* [Step 8: Push](#step-8-push) * [Step 8: Push](#step-8-push)
* [Step 9: Opening the Pull Request](#step-8-opening-the-pull-request) * [Step 9: Opening the Pull Request](#step-9-opening-the-pull-request)
* [Step 10: Discuss and Update](#step-9-discuss-and-update) * [Step 10: Discuss and Update](#step-10-discuss-and-update)
* [Approval and Request Changes Workflow](#approval-and-request-changes-workflow) * [Approval and Request Changes Workflow](#approval-and-request-changes-workflow)
* [Step 11: Landing](#step-10-landing) * [Step 11: Landing](#step-11-landing)
* [Continuous Integration Testing](#continuous-integration-testing) * [Continuous Integration Testing](#continuous-integration-testing)
## Setting up your local environment ## Setting up your local environment

26
docs/tutorial/security.md
View file

@ -69,18 +69,18 @@ either `process.env` or the `window` object.
This is not bulletproof, but at the least, you should follow these steps to This is not bulletproof, but at the least, you should follow these steps to
improve the security of your application. improve the security of your application.
1. [Only load secure content](#only-load-secure-content) 1. [Only load secure content](#1-only-load-secure-content)
2. [Disable the Node.js integration in all renderers that display remote content](#disable-node.js-integration-for-remote-content) 2. [Disable the Node.js integration in all renderers that display remote content](#-2-disable-nodejs-integration-for-remote-content)
3. [Enable context isolation in all renderers that display remote content](#enable-context-isolation-for-remote-content) 3. [Enable context isolation in all renderers that display remote content](#-3-enable-context-isolation-for-remote-content)
4. [Use `ses.setPermissionRequestHandler()` in all sessions that load remote content](#handle-session-permission-requests-from-remote-content) 4. [Use `ses.setPermissionRequestHandler()` in all sessions that load remote content](#-4-handle-session-permission-requests-from-remote-content)
5. [Do not disable `webSecurity`](#do-not-disable-websecurity) 5. [Do not disable `webSecurity`](#-5-do-not-disable-websecurity)
6. [Define a `Content-Security-Policy`](#define-a-content-security-policy) and use restrictive rules (i.e. `script-src 'self'`) 6. [Define a `Content-Security-Policy`](#-6-define-a-content-security-policy) and use restrictive rules (i.e. `script-src 'self'`)
7. [Override and disable `eval`](#override-and-disable-eval), which allows strings to be executed as code. 7. [Override and disable `eval`](#-7-override-and-disable-eval), which allows strings to be executed as code.
8. [Do not set `allowRunningInsecureContent` to `true`](#do-not-set-allowRunningInsecureContent-to-true) 8. [Do not set `allowRunningInsecureContent` to `true`](#-8-do-not-set-allowrunninginsecurecontent-to-true)
9. [Do not enable experimental features](#do-not-enable-experimental-features) 9. [Do not enable experimental features](#-9-do-not-enable-experimental-features)
10. [Do not use `blinkFeatures`](#do-not-use-blinkfeatures) 10. [Do not use `blinkFeatures`](#-10-do-not-use-blinkfeatures)
11. [WebViews: Do not use `allowpopups`](#do-not-use-allowpopups) 11. [WebViews: Do not use `allowpopups`](#-11-do-not-use-allowpopups)
12. [WebViews: Verify the options and params of all `<webview>` tags](#verify-webview-options-before-creation) 12. [WebViews: Verify the options and params of all `<webview>` tags](#-12-verify-webview-options-before-creation)
## 1) Only Load Secure Content ## 1) Only Load Secure Content
@ -401,7 +401,7 @@ subsequent resources via `HTTP` is also known as "mixed content".
Simply put, loading content over `HTTPS` assures the authenticity and integrity Simply put, loading content over `HTTPS` assures the authenticity and integrity
of the loaded resources while encrypting the traffic itself. See the section on of the loaded resources while encrypting the traffic itself. See the section on
[only displaying secure content](#only-display-secure-content) for more details. [only displaying secure content](#1-only-load-secure-content) for more details.
### How? ### How?