Commit graph

12 commits

Author SHA1 Message Date
Jerry Wu
dee331519c fix: disable nodeIntegration & insecure resource warnings for localhost (#18814)
* fix: disable remote host nodeIntegration warning for localhost

In warnAboutNodeWithRemoteContent(), add a check to see if the hostname
is "localhost" and prevent the warning message if it is.

* fix: disable loading insecure resources warning for localhost

In warnAboutInsecureResources(), filter out resources from localhost
since they are most likely not a threat.

* test: add tests for ignoring security warnings when using localhost

Add tests for ignoring warning messages for the following scenarios:
  1. node integration with remote content from localhost
  2. loading insecure resources from localhost

* test: fix insecure resource test

* test: pass nodeIntegration with remote test on did-finish-load

* test: maybe fix node integration test (error w/ conv circular struct)

* test: update test description

* test: use "load" event to check when nodeIntegration test has finished

Instead of relying on the "did-finish-load" event, which may result in
a race condition, add an "onload" handler that logs "loaded" to the
console. This will execute _after_ the nodeIntegration check, so it
can be safely used as a signal to indicate that the test is done.

* test: rename base-page-security-load-message.html

* fix: ignore enabled remote module warning for localhost

* refactor: add isLocalhost()
2019-07-02 19:36:50 +09:00
Milan Burda
0af3548b55 feat: add security warning for remote module with remote content (#18822) 2019-06-17 14:21:30 -07:00
Milan Burda
5a7b56b042 chore: finish replacing assert with expect in tests (#18215)
* spec: replace assert with expect in api-browser-view-spec.js

* spec: replace assert with expect in api-touch-bar-spec.js

* spec: replace assert with expect in api-web-frame-spec.js

* spec: replace assert with expect in api-web-contents-view-spec.js

* spec: replace assert with expect in security-warnings-spec.js

* spec: replace assert with expect in api-menu-item-spec.js

* spec: replace assert with expect in api-web-request-spec.js

* spec: replace assert with expect in api-remote-spec.js

* spec: replace assert with expect in api-session-spec.js

* spec: replace assert with expect in api-system-preferences-spec.js

* spec: replace assert with expect in api-browser-window-spec.js

* spec: replace assert with expect in webview-spec.js

* spec: replace assert with expect in api-net-spec.js

* spec: replace assert with expect in api-protocol-spec.js

* spec: replace assert with expect api-web-contents-spec.js

* spec: replace assert with expect in api-shell-spec.js

* spec: replace assert with expect in modules-spec.js

* spec: replace assert with expect in chromium-spec.js

* spec: replace assert with expect in api-crash-reporter-spec.js

* spec: replace assert with expect in asar-spec.js

* spec: rename assert-helpers to expect-helpers

* address PR feedback
2019-05-20 12:04:18 -05:00
Milan Burda
fade3eb679 chore: make "nodeIntegration" and "webviewTag" default to false (#16235) 2019-01-07 22:19:27 +03:00
Milan Burda
d3efc52745 feat: add webPreferences.enableRemoteModule option (#13028) 2018-10-13 20:50:07 +03:00
Milan Burda
ae8c0f71b1 chore: remove duplicate code in spec/security-warnings-spec.js (#14967) 2018-10-05 00:24:14 +02:00
Milan Burda
5efb0fdff1 feat: add security warnings to sandboxed renderers (#14869)
Also refactor not to use the remote module.
2018-10-03 21:36:12 +02:00
Samuel Attard
558fff69e7
chore: update to standard 12 2018-09-14 14:57:01 +10:00
Shelley Vohr
2660859434
update signature for setCertificateVerifyProc in session spec 2018-05-29 10:54:27 -04:00
Cheng Zhao
d46aa92f0b
make security-warnings tests more robust (#12757) 2018-05-01 14:28:55 +09:00
Cheng Zhao
e00b128a50
fix flaky security-warnings test (#12749) 2018-05-01 09:49:45 +09:00
Felix Rieseberg
d586ef2f39 feature: Hot security tips (#11810)
* 🔧 Add security issue detection (and logs)

* 🔧 Check for it on load

* 👷 Add some tests

* 👷 Make the linter happy

* 🔧 Allow them to be enabled by force

* 📝 Make message slightly prettier

* 🔧 Fix a typo in the code comment

* 🔧 Classic mistake

* 🚀 Optimize things a bit more

* 👷 Add tests, fix tests

* 📝 Document things

* 🔧 Make linter happy

* 🔧 One more piece of cleanup
2018-02-03 07:50:12 -07:00