mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

fix: disable nodeIntegration & insecure resource warnings for localhost (#18814)

Browse source 
* fix: disable remote host nodeIntegration warning for localhost

In warnAboutNodeWithRemoteContent(), add a check to see if the hostname
is "localhost" and prevent the warning message if it is.

* fix: disable loading insecure resources warning for localhost

In warnAboutInsecureResources(), filter out resources from localhost
since they are most likely not a threat.

* test: add tests for ignoring security warnings when using localhost

Add tests for ignoring warning messages for the following scenarios:
  1. node integration with remote content from localhost
  2. loading insecure resources from localhost

* test: fix insecure resource test

* test: pass nodeIntegration with remote test on did-finish-load

* test: maybe fix node integration test (error w/ conv circular struct)

* test: update test description

* test: use "load" event to check when nodeIntegration test has finished

Instead of relying on the "did-finish-load" event, which may result in
a race condition, add an "onload" handler that logs "loaded" to the
console. This will execute _after_ the nodeIntegration check, so it
can be safely used as a signal to indicate that the test is done.

* test: rename base-page-security-load-message.html

* fix: ignore enabled remote module warning for localhost

* refactor: add isLocalhost()
This commit is contained in:
Jerry Wu 2019-07-02 03:36:50 -07:00 committed by Cheng Zhao
parent 4e2990d3aa
commit dee331519c
3 changed files with 74 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
lib/renderer/security-warnings.ts
View file

@ -58,6 +58,19 @@ const getIsRemoteProtocol = function () {
} }
} }
/**
* Checks if the current window is from localhost.
*
* @returns {boolean} - Is current window from localhost?
*/
const isLocalhost = function () {
if (!window || !window.location) {
return false
}
return window.location.hostname === 'localhost'
}
/** /**
* Tries to determine whether a CSP without `unsafe-eval` is set. * Tries to determine whether a CSP without `unsafe-eval` is set.
* *
@ -92,6 +105,7 @@ const warnAboutInsecureResources = function () {
const resources = window.performance const resources = window.performance
.getEntriesByType('resource') .getEntriesByType('resource')
.filter(({ name }) => /^(http|ftp):/gi.test(name || '')) .filter(({ name }) => /^(http|ftp):/gi.test(name || ''))
.filter(({ name }) => new URL(name).hostname !== 'localhost')
.map(({ name }) => `- ${name}`) .map(({ name }) => `- ${name}`)
.join('\n') .join('\n')
@ -115,7 +129,7 @@ const warnAboutInsecureResources = function () {
* Logs a warning message about Node integration. * Logs a warning message about Node integration.
*/ */
const warnAboutNodeWithRemoteContent = function (nodeIntegration: boolean) { const warnAboutNodeWithRemoteContent = function (nodeIntegration: boolean) {
if (!nodeIntegration) return if (!nodeIntegration || isLocalhost()) return
if (getIsRemoteProtocol()) { if (getIsRemoteProtocol()) {
const warning = `This renderer process has Node.js integration enabled const warning = `This renderer process has Node.js integration enabled
@ -254,7 +268,7 @@ const warnAboutAllowedPopups = function () {
// Logs a warning message about the remote module // Logs a warning message about the remote module
const warnAboutRemoteModuleWithRemoteContent = function (webPreferences?: Electron.WebPreferences) { const warnAboutRemoteModuleWithRemoteContent = function (webPreferences?: Electron.WebPreferences) {
if (!webPreferences || !webPreferences.enableRemoteModule) return if (!webPreferences || !webPreferences.enableRemoteModule || isLocalhost()) return
if (getIsRemoteProtocol()) { if (getIsRemoteProtocol()) {
const warning = `This renderer process has "enableRemoteModule" enabled const warning = `This renderer process has "enableRemoteModule" enabled

10
spec/fixtures/pages/base-page-security-onload-message.html vendored Normal file
View file

@ -0,0 +1,10 @@
<html>
<head>
<script type="text/javascript">
window.ELECTRON_ENABLE_SECURITY_WARNINGS = true
window.addEventListener('load', () => console.log('loaded'));
</script>
</head>
<body>
</body>
</html>

48
spec/security-warnings-spec.js
View file

@ -78,6 +78,24 @@ describe('security warnings', () => {
w.loadURL(`http://127.0.0.1:8881/base-page-security.html`) w.loadURL(`http://127.0.0.1:8881/base-page-security.html`)
}) })
it('should not warn about Node.js integration with remote content from localhost', (done) => {
w = new BrowserWindow({
show: false,
webPreferences: {
nodeIntegration: true
}
})
w.webContents.once('console-message', (e, level, message) => {
expect(message).to.not.include('Node.js Integration with Remote Content')
if (message === 'loaded') {
done()
}
})
w.loadURL(`http://localhost:8881/base-page-security-onload-message.html`)
})
const generateSpecs = (description, webPreferences) => { const generateSpecs = (description, webPreferences) => {
describe(description, () => { describe(description, () => {
it('should warn about disabled webSecurity', (done) => { it('should warn about disabled webSecurity', (done) => {
@ -189,6 +207,20 @@ describe('security warnings', () => {
w.webContents.openDevTools() w.webContents.openDevTools()
}) })
it('should not warn about loading insecure-resources.html from localhost', (done) => {
w = new BrowserWindow({
show: false,
webPreferences
})
w.webContents.once('console-message', (e, level, message) => {
expect(message).to.not.include('insecure-resources.html')
done()
})
w.loadURL(`http://localhost:8881/insecure-resources.html`)
w.webContents.openDevTools()
})
it('should warn about enabled remote module with remote content', (done) => { it('should warn about enabled remote module with remote content', (done) => {
w = new BrowserWindow({ w = new BrowserWindow({
show: false, show: false,
@ -201,6 +233,22 @@ describe('security warnings', () => {
w.loadURL(`http://127.0.0.1:8881/base-page-security.html`) w.loadURL(`http://127.0.0.1:8881/base-page-security.html`)
}) })
it('should not warn about enabled remote module with remote content from localhost', (done) => {
w = new BrowserWindow({
show: false,
webPreferences
})
w.webContents.once('console-message', (e, level, message) => {
expect(message).to.not.include('enableRemoteModule')
if (message === 'loaded') {
done()
}
})
w.loadURL(`http://localhost:8881/base-page-security-onload-message.html`)
})
}) })
} }