Phase 3 pre-bump: explicit hardened webPreferences at every window

src/main/connect.ts

@@ -2,7 +2,7 @@
 // Distributed under the terms of the Modified BSD License.
 
 import { BrowserWindow, Cookie } from 'electron';
-import { clearSession } from './utils';
+import { clearSession, hardenedWebPreferences } from './utils';
 
 export let connectWindow: BrowserWindow;
 
@@ -39,21 +39,20 @@ export async function connectAndGetServerInfo(
       return;
     }
 
-    const browserOptions: Electron.BrowserWindowConstructorOptions = {
-      title: 'JupyterLab Server Connection',
-      show: options?.showDialog === true
-    };
+    let partition: string | undefined;
     if (options?.incognito) {
-      browserOptions.webPreferences = {
-        partition: `partition-${Date.now()}`
-      };
+      partition = `partition-${Date.now()}`;
     }
     if (options?.partition) {
-      browserOptions.webPreferences = {
-        partition: options.partition
-      };
+      partition = options.partition;
     }
 
+    const browserOptions: Electron.BrowserWindowConstructorOptions = {
+      title: 'JupyterLab Server Connection',
+      show: options?.showDialog === true,
+      webPreferences: hardenedWebPreferences({ partition })
+    };
+
     const window = new BrowserWindow(browserOptions);
 
     const timeout = options?.timeout || 30000;

src/main/dialog/themedview.ts

@@ -4,15 +4,19 @@
 import { BrowserView } from 'electron';
 import * as fs from 'fs';
 import * as path from 'path';
-import { DarkThemeBGColor, LightThemeBGColor } from '../utils';
+import {
+  DarkThemeBGColor,
+  hardenedWebPreferences,
+  LightThemeBGColor
+} from '../utils';
 
 export class ThemedView {
   constructor(options: ThemedView.IOptions) {
     this._isDarkTheme = options.isDarkTheme;
     this._view = new BrowserView({
-      webPreferences: {
+      webPreferences: hardenedWebPreferences({
         preload: options.preload || path.join(__dirname, './preload.js')
-      }
+      })
     });
     this._view.setBackgroundColor(
       this._isDarkTheme ? DarkThemeBGColor : LightThemeBGColor

src/main/dialog/themedwindow.ts

@@ -4,7 +4,11 @@
 import { BrowserWindow } from 'electron';
 import * as fs from 'fs';
 import * as path from 'path';
-import { DarkThemeBGColor, LightThemeBGColor } from '../utils';
+import {
+  DarkThemeBGColor,
+  hardenedWebPreferences,
+  LightThemeBGColor
+} from '../utils';
 
 export class ThemedWindow {
   constructor(options: ThemedWindow.IOptions) {
@@ -22,9 +26,9 @@ export class ThemedWindow {
       titleBarStyle: 'hidden',
       frame: process.platform === 'darwin',
       backgroundColor: this._isDarkTheme ? DarkThemeBGColor : LightThemeBGColor,
-      webPreferences: {
+      webPreferences: hardenedWebPreferences({
         preload: options.preload || path.join(__dirname, './preload.js')
-      }
+      })
     });
 
     // hide the traffic lights

src/main/labview/labview.ts

@@ -14,6 +14,7 @@ import * as fs from 'fs';
 import {
   clearSession,
   DarkThemeBGColor,
+  hardenedWebPreferences,
   isDarkTheme,
   LightThemeBGColor
 } from '../utils';
@@ -57,10 +58,10 @@ export class LabView implements IDisposable {
       }
     }
     this._view = new BrowserView({
-      webPreferences: {
+      webPreferences: hardenedWebPreferences({
         preload: path.join(__dirname, './preload.js'),
         partition
-      }
+      })
     });
 
     this._view.setBackgroundColor(

src/main/sessionwindow/sessionwindow.ts

@@ -28,6 +28,7 @@ import {
   envPathForPythonPath,
   getBundledPythonPath,
   getLogFilePath,
+  hardenedWebPreferences,
   isDarkTheme,
   LightThemeBGColor
 } from '../utils';
@@ -129,9 +130,9 @@ export class SessionWindow implements IDisposable {
       titleBarStyle: 'hidden',
       frame: process.platform === 'darwin',
       backgroundColor: this._isDarkTheme ? DarkThemeBGColor : LightThemeBGColor,
-      webPreferences: {
+      webPreferences: hardenedWebPreferences({
         devTools: false
-      }
+      })
     });
 
     this._window.setMenuBarVisibility(false);

src/main/titlebarview/titlebarview.ts

@@ -5,17 +5,21 @@ import { BrowserView } from 'electron';
 import * as path from 'path';
 import * as fs from 'fs';
 import * as ejs from 'ejs';
-import { DarkThemeBGColor, LightThemeBGColor } from '../utils';
+import {
+  DarkThemeBGColor,
+  hardenedWebPreferences,
+  LightThemeBGColor
+} from '../utils';
 import { EventTypeRenderer } from '../eventtypes';
 
 export class TitleBarView {
   constructor(options: TitleBarView.IOptions) {
     this._isDarkTheme = options.isDarkTheme;
     this._view = new BrowserView({
-      webPreferences: {
+      webPreferences: hardenedWebPreferences({
         preload: path.join(__dirname, './preload.js'),
         devTools: process.env.NODE_ENV === 'development'
-      }
+      })
     });
 
     this._view.setBackgroundColor(

src/main/utils.ts

@@ -30,6 +30,17 @@ export function isDevMode(): boolean {
   return require.main.filename.indexOf('app.asar') === -1;
 }
 
+export function hardenedWebPreferences(
+  extra?: Electron.WebPreferences
+): Electron.WebPreferences {
+  return {
+    contextIsolation: true,
+    nodeIntegration: false,
+    sandbox: true,
+    ...extra
+  };
+}
+
 export function getAppDir(): string {
   let appDir = app.getAppPath();
   if (!isDevMode()) {

src/main/welcomeview/welcomeview.ts

@@ -2,7 +2,12 @@
 // Distributed under the terms of the Modified BSD License.
 
 import { BrowserView, net } from 'electron';
-import { DarkThemeBGColor, getUserHomeDir, LightThemeBGColor } from '../utils';
+import {
+  DarkThemeBGColor,
+  getUserHomeDir,
+  hardenedWebPreferences,
+  LightThemeBGColor
+} from '../utils';
 import * as path from 'path';
 import * as fs from 'fs';
 import { XMLParser } from 'fast-xml-parser';
@@ -25,10 +30,10 @@ export class WelcomeView {
     this._registry = options.registry;
     this._isDarkTheme = options.isDarkTheme;
     this._view = new BrowserView({
-      webPreferences: {
+      webPreferences: hardenedWebPreferences({
         preload: path.join(__dirname, './preload.js'),
         devTools: process.env.NODE_ENV === 'development'
-      }
+      })
     });
 
     this._view.setBackgroundColor(