New Remote Module Not Disabled Check

doyensec / electronegativity

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.

Apache License 2.0

972 stars 66 forks source link

New Remote Module Not Disabled Check #57

Closed ikkisoft closed 4 years ago

ikkisoft commented 4 years ago

During Covalence 2020 conf, I realized that we didn't have a check for enableRemoteModule so here you have!

@phosphore can you please review and merge, thanks!

More details in the wiki page --> https://github.com/doyensec/electronegativity/wiki/REMOTE_MODULE_JS_CHECK

ikkisoft commented 4 years ago

In future, we should make a global check to remove the need of manual validation if e.g. nodeIntegration is disable / sandbox is enabled / ... since 'remote' won't even make sense in such contexts.