Doesn't work with sandbox option enabled (via win_options)

[vladimiry]

About window doesn't show a window content. Not sure about all the platforms but it certainly doesn't work on Linux with Electron v5. I guess because Electron v5 goes with enhanced sandboxing enabled by default.

The reason is that require is forbidden to use in the web page scope.

Workaround is in loading the renderer.js as a preload script, so you add similar win_options option calling the function:

aboutWindow({
    win_options: {
        webPreferences: {
            preload: path.join(__dirname, "./node_modules/about-window/src/renderer.js"),
            // nodeIntegration: false,
            // webSecurity: true,
            // sandbox: true,
        },
    },
});

What can be done in order to fix the issue:

• The module should set the default webPreferences options in order to enhance the security:

  nodeIntegration: false,
  webSecurity: true,
  sandbox: true,

  This might involve supporting thorough/deep win_options.webPreferences merging.

• renderer.js needs to be loaded as a preload script instead of loading it on the page here: https://github.com/rhysd/electron-about-window/blob/6aa4803125a151a54ac9efd21b00bc2b1a2567be/about.html#L24
• Access to the process should happen via remote proxy as remote.process.versions but not directly like here: https://github.com/rhysd/electron-about-window/blob/6aa4803125a151a54ac9efd21b00bc2b1a2567be/src/renderer.ts#L67

[rhysd]

Thanks for catching this. Yes, as you described, this package does not work without node integration. As you pointed, we need to move preload script to avoid using electron module after loading HTML. I know how to do that but I currently cannot allocate enough time to address this. PR is welcome.

webSecurity: true,

I believe webSecurity: true should work with the current version because it is true by default.