feat: add webPreferences.enableRemoteModule option (#13028)

spec/api-browser-window-spec.js

@@ -1396,6 +1396,46 @@ describe('BrowserWindow module', () => {
       })
     })
 
+    describe('"enableRemoteModule" option', () => {
+      const generateSpecs = (description, sandbox) => {
+        describe(description, () => {
+          const preload = path.join(fixtures, 'module', 'preload-remote.js')
+
+          it('enables the remote module by default', async () => {
+            const w = await openTheWindow({
+              show: false,
+              webPreferences: {
+                nodeIntegration: false,
+                preload,
+                sandbox
+              }
+            })
+            w.loadFile(path.join(fixtures, 'api', 'blank.html'))
+            const [, remote] = await emittedOnce(ipcMain, 'remote')
+            expect(remote).to.equal('object')
+          })
+
+          it('disables the remote module when false', async () => {
+            const w = await openTheWindow({
+              show: false,
+              webPreferences: {
+                nodeIntegration: false,
+                preload,
+                sandbox,
+                enableRemoteModule: false
+              }
+            })
+            w.loadFile(path.join(fixtures, 'api', 'blank.html'))
+            const [, remote] = await emittedOnce(ipcMain, 'remote')
+            expect(remote).to.equal('undefined')
+          })
+        })
+      }
+
+      generateSpecs('without sandbox', false)
+      generateSpecs('with sandbox', true)
+    })
+
     describe('"sandbox" option', () => {
       function waitForEvents (emitter, events, callback) {
         let count = events.length

spec/api-crash-reporter-spec.js

@@ -195,6 +195,11 @@ describe('crashReporter module', () => {
       preload: path.join(fixtures, 'module', 'preload-sandbox.js')
     }
   })
+  generateSpecs('with remote module disabled', {
+    webPreferences: {
+      enableRemoteModule: false
+    }
+  })
 
   describe('getProductName', () => {
     it('returns the product name if one is specified', () => {

spec/fixtures/module/preload-disable-remote.js

@@ -0,0 +1,8 @@
+setImmediate(function () {
+  try {
+    const { remote } = require('electron')
+    console.log(JSON.stringify(typeof remote))
+  } catch (e) {
+    console.log(e.message)
+  }
+})

spec/fixtures/module/preload-remote.js

@@ -0,0 +1,5 @@
+const { ipcRenderer, remote } = require('electron')
+
+window.onload = function () {
+  ipcRenderer.send('remote', typeof remote)
+}

spec/security-warnings-spec.js

@@ -68,7 +68,7 @@ describe('security warnings', () => {
     w.loadURL(`http://127.0.0.1:8881/base-page-security.html`)
   })
 
-  const generateSpecs = (description, sandbox) => {
+  const generateSpecs = (description, webPreferences) => {
     describe(description, () => {
       it('should warn about disabled webSecurity', (done) => {
         w = new BrowserWindow({
@@ -76,7 +76,7 @@ describe('security warnings', () => {
           webPreferences: {
             webSecurity: false,
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
         w.webContents.once('console-message', (e, level, message) => {
@@ -92,7 +92,7 @@ describe('security warnings', () => {
           show: false,
           webPreferences: {
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
 
@@ -111,7 +111,7 @@ describe('security warnings', () => {
           webPreferences: {
             allowRunningInsecureContent: true,
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
         w.webContents.once('console-message', (e, level, message) => {
@@ -128,7 +128,7 @@ describe('security warnings', () => {
           webPreferences: {
             experimentalFeatures: true,
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
         w.webContents.once('console-message', (e, level, message) => {
@@ -145,7 +145,7 @@ describe('security warnings', () => {
           webPreferences: {
             enableBlinkFeatures: ['my-cool-feature'],
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
         w.webContents.once('console-message', (e, level, message) => {
@@ -161,7 +161,7 @@ describe('security warnings', () => {
           show: false,
           webPreferences: {
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
         w.webContents.once('console-message', (e, level, message) => {
@@ -177,7 +177,7 @@ describe('security warnings', () => {
           show: false,
           webPreferences: {
             nodeIntegration: false,
-            sandbox
+            ...webPreferences
           }
         })
         w.webContents.once('console-message', (e, level, message) => {
@@ -191,6 +191,7 @@ describe('security warnings', () => {
     })
   }
 
-  generateSpecs('without sandbox', false)
-  generateSpecs('with sandbox', true)
+  generateSpecs('without sandbox', {})
+  generateSpecs('with sandbox', { sandbox: true })
+  generateSpecs('with remote module disabled', { enableRemoteModule: false })
 })

spec/webview-spec.js

@@ -219,6 +219,41 @@ describe('<webview> tag', function () {
     })
   })
 
+  describe('enableremotemodule attribute', () => {
+    const generateSpecs = (description, sandbox) => {
+      describe(description, () => {
+        const preload = `${fixtures}/module/preload-disable-remote.js`
+        const src = `file://${fixtures}/api/blank.html`
+
+        it('enables the remote module by default', async () => {
+          const message = await startLoadingWebViewAndWaitForMessage(webview, {
+            preload,
+            src,
+            sandbox
+          })
+
+          const typeOfRemote = JSON.parse(message)
+          expect(typeOfRemote).to.equal('object')
+        })
+
+        it('disables the remote module when false', async () => {
+          const message = await startLoadingWebViewAndWaitForMessage(webview, {
+            preload,
+            src,
+            sandbox,
+            enableremotemodule: false
+          })
+
+          const typeOfRemote = JSON.parse(message)
+          expect(typeOfRemote).to.equal('undefined')
+        })
+      })
+    }
+
+    generateSpecs('without sandbox', false)
+    generateSpecs('with sandbox', true)
+  })
+
   describe('preload attribute', () => {
     it('loads the script before other scripts in window', async () => {
       const message = await startLoadingWebViewAndWaitForMessage(webview, {
@@ -506,6 +541,17 @@ describe('<webview> tag', function () {
       })
     })
 
+    it('can disable the remote module', async () => {
+      const message = await startLoadingWebViewAndWaitForMessage(webview, {
+        preload: `${fixtures}/module/preload-disable-remote.js`,
+        src: `file://${fixtures}/api/blank.html`,
+        webpreferences: 'enableRemoteModule=no'
+      })
+
+      const typeOfRemote = JSON.parse(message)
+      expect(typeOfRemote).to.equal('undefined')
+    })
+
     it('can disables web security and enable nodeintegration', async () => {
       const jqueryPath = path.join(__dirname, '/static/jquery-2.0.3.min.js')
       const src = `<script src='file://${jqueryPath}'></script> <script>console.log(typeof require);</script>`