Support getters and setters in the context bridge API

[bpasero]

Issue Details

• Electron Version:
  • 9.x
• Operating System:
  • macOS 10.15.x

Expected Behavior

Exposing API via contextBridge.exposeInMainWorld should not have side effects.

Actual Behavior

Calling this method with an object that has a get property triggers it. This makes it impossible to lazy instantiate for example.

To Reproduce

contextBridge.exposeInMainWorld('vscode',{
   get something(): { console.log("accessed"); }
});

[MarshallOfSound]

contextBridge does not currently support getters and setters. There is a mode where it does (we use it internally for some things) but that mode toggle isnt exposed via the API.

Is there a hard requirement for this to be a getter property instead of a method. Publicly supporting getters and setters will add more API cost but wouldn't be too tricky to expose.

[bpasero]

@MarshallOfSound no I think I have a workaround now by switching to a function instead.

[pcafstockf]

I suppose when you are inventing a brand new API, it's not that hard to "workaround" the absence of getters and setters. But if you are using existing API's, it becomes very time consuming and frustrating to write a wrapper. Worse, the mental burden of remembering how to get and set a property depending on where you are running (main, preloaded, renderer) is exhausting.

Not every API is a security threat.

Please consider publicly supporting getters and setters.

[mbaer3000]

Switching from Electron 8 to Electron 18 and using contextBridge instead of a shared dynamic object in the shared window global scope – and not having the option of using getters and setters gives us some unfortunate headaches with backward-compatibility to existing apps running in webviews.

Yes, we would also be better off if getters/setters were available.

[github-actions[bot]]

This issue has been automatically marked as stale. If this issue is still affecting you, please leave any comment (for example, "bump"), and we'll keep it open. If you have any new additional information—in particular, if this is still reproducible in the latest version of Electron or in the beta—please include it with your comment!

[github-actions[bot]]

This issue has been closed due to inactivity, and will not be monitored. If this is a bug and you can reproduce this issue on a supported version of Electron please open a new issue and include instructions for reproducing the issue.

[bpasero]

I am not aware of any changes in this area that would have addressed this issue, @MarshallOfSound please reopen.

[MarshallOfSound]

@bpasero you can prevent these closing by commenting within 30 days of the first warning. I can reopen this one as I think it's supposed to be tagged as an enhancement anyway

[SReject]

I'm currently attempting to integrate a 3rd party library via preload and it leverages setters/getters extensively.

To work around it, I've had to include a hack to walk the instance which is pretty dirty:

let thing = /* ... */

contextBridge.exposeInMainWorld('thingWalker', (path: string[]) : any => {

  // sanitize/validate path

  // walk lib
  let cursor = thing;
  while (path) cursor = cursor[path.shift()];

  return cursor;
});

Other things I've tried that are no go:

• Digest function: contextBridge.expose...(name, () => thing);
• Preload-side Proxy