From 5aebb5da1ead1a1eb9eeb125e6cadff2b6a3aec3 Mon Sep 17 00:00:00 2001 From: Ben Gotow Date: Mon, 15 Feb 2021 01:28:23 -0600 Subject: [PATCH] =?UTF-8?q?Lock=20down=20the=20app=E2=80=99s=20content=20s?= =?UTF-8?q?ecurity=20policy=20a=20bit=20more?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- app/src/browser/main.js | 8 +++++--- app/src/components/webview.tsx | 3 +-- app/static/db-migration.html | 2 +- app/static/db-vacuum.html | 2 +- app/static/index.html | 2 +- 5 files changed, 9 insertions(+), 8 deletions(-) diff --git a/app/src/browser/main.js b/app/src/browser/main.js index ffef401cd..f762b80a8 100644 --- a/app/src/browser/main.js +++ b/app/src/browser/main.js @@ -8,7 +8,9 @@ const fs = require('fs'); fs.statSyncNoException = function(...args) { try { return fs.statSync.apply(fs, args); - } catch (e) {} + } catch (e) { + //pass + } return false; }; @@ -16,7 +18,7 @@ console.inspect = function consoleInspect(val) { console.log(util.inspect(val, true, 7, true)); }; -const app = require('electron').app; +const { app, session } = require('electron'); const path = require('path'); const mkdirp = require('mkdirp'); @@ -323,7 +325,7 @@ const start = () => { // Block remote JS execution in a second way in case our tag approach // is compromised somehow https://www.electronjs.org/docs/tutorial/security // This CSP string should match the one in app/static/index.html - require('electron').session.defaultSession.webRequest.onHeadersReceived((details, callback) => { + session.defaultSession.webRequest.onHeadersReceived((details, callback) => { if (details.url.startsWith('devtools://')) { return callback(details); } diff --git a/app/src/components/webview.tsx b/app/src/components/webview.tsx index 21617fd2a..a98316b7b 100644 --- a/app/src/components/webview.tsx +++ b/app/src/components/webview.tsx @@ -1,6 +1,5 @@ import url from 'url'; import React from 'react'; -import PropTypes from 'prop-types'; import { shell } from 'electron'; import ReactDOM from 'react-dom'; import classnames from 'classnames'; @@ -233,7 +232,7 @@ export default class Webview extends React.Component render() { return (
- +
Updating Mailspring Database... - +