Hyper: Email renders website

Created on 3 Aug 2016 · 6Comments · Source: vercel/hyper

example

I'm not sure if this is expected behavior, but it certainly surprised me when I ran $(git config user.email).

help wanted Bug

Source

samusgray

Most helpful comment

I jumped the gun a bit on the security concern, apologies.

This feature feels a bit like a bug to me as I need to hard reload once I'm viewing the page.

Why would I want this to happen when I could just type 'open http://google.com'

MrRio on 4 Aug 2016

👍2

All 6 comments

This seems to be any web address that's entered.

MrRio on 4 Aug 2016

@MrRio the <webview> should not have access to any node APIs.

rauchg on 4 Aug 2016

@MrRio The website rendering is a feature. Your security concern was addressed in this issue: https://github.com/zeit/hyperterm/issues/77.

samusgray on 4 Aug 2016

@rauch @aaronagray I think the point about <webview> not having access to node APIs is incorrect. See the documentation here:

For security purposes, webview can only be used in BrowserWindows that have nodeIntegration enabled.

In fact, as of electron 1.1.1, the <webview> tag is disabled when nodeIntegration is turned off. See here. There was some discussion about the implication of this here.

As far as I'm aware, the only real workaround at the moment is to leave nodeIntegration enabled but run a preload script to remove the node modules. This is what browserhtml is currently doing. But as mentioned in the issue above, that doesn't fully solve the problem yet.