From 4ace1d4b327b1bb416b2486fe9fe48feed82e54d Mon Sep 17 00:00:00 2001
From: "Mr. Stallion" <mrstallion@nobody.nowhere.fauxdomain.ext>
Date: Sun, 28 Jun 2020 17:12:32 -0500
Subject: [PATCH] Spelled out more limitations to the webview

---
 CHANGELOG.md                  | 2 ++
 chat/preview/ImagePreview.vue | 2 +-
 electron/main.ts              | 1 +
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 216a0b9..f6820d4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,9 @@
 Reviewed security with:
 * [Electron Security](https://www.electronjs.org/docs/tutorial/security)
 * [Doyensec Electron Security Checklist](https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security-wp.pdf)
+* [Doyensec Electronegativity](https://github.com/doyensec/electronegativity)
 * [Quasar Electron Security Concerns](https://quasar.dev/quasar-cli/developing-electron-apps/electron-security-concerns)
+* [Reasonably Secure Electron](https://know.bishopfox.com/research/reasonably-secure-electron)
 * [SNYK.io](https://snyk.io/) vulnerability scan [![Known Vulnerabilities](https://snyk.io/test/github/mrstallion/fchat-rising/badge.svg)](https://snyk.io/test/github/mrstallion/fchat-rising)
 
 
diff --git a/chat/preview/ImagePreview.vue b/chat/preview/ImagePreview.vue
index adf54f9..125ac5c 100644
--- a/chat/preview/ImagePreview.vue
+++ b/chat/preview/ImagePreview.vue
@@ -13,7 +13,7 @@
         <webview
             preload="./preview/assets/browser.pre.js"
             src="about:blank"
-            webpreferences="autoplayPolicy=no-user-gesture-required,contextIsolation,sandbox,disableDialogs,disableHtmlFullScreenWindowResize,enableWebSQL=no,nodeIntegration=no"
+            webpreferences="autoplayPolicy=no-user-gesture-required,contextIsolation,sandbox,disableDialogs,disableHtmlFullScreenWindowResize,webSecurity,enableWebSQL=no,nodeIntegration=no,nativeWindowOpen=no,nodeIntegrationInWorker=no,nodeIntegrationInSubFrames=no,webviewTag=no"
             enableremotemodule="false"
             allowpopups="false"
             nodeIntegration="false"
diff --git a/electron/main.ts b/electron/main.ts
index 299be30..9910c93 100644
--- a/electron/main.ts
+++ b/electron/main.ts
@@ -290,6 +290,7 @@ function showPatchNotes(): void {
     electron.shell.openExternal('https://github.com/mrstallion/fchat-rising/blob/master/CHANGELOG.md'); //tslint:disable-line:no-floating-promises
 }
 
+
 function onReady(): void {
     log.transports.file.level = 'debug';
     log.transports.console.level = 'debug';