Fix electron window.open vulnerability (#3457)

* Fix electron window.open vulnerability * Comment to remove fix when merged into Hyper3
vercel · Feb 5, 2019 · 17fcae5 · 17fcae5
1 parent 1a82866
commit 17fcae5
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/app/ui/window.js b/app/ui/window.js
@@ -226,6 +226,10 @@ module.exports = class Window {
       }
     });
 
+    // mitigate a security issue: https://electronjs.org/blog/window-open-fix
+    // TODO: remove when merged into Hyper 3 (already has the fix via electron)
+    window.webContents.on('-add-new-contents', e => e.preventDefault());
+
     // expose internals to extension authors
     window.rpc = rpc;
     window.sessions = sessions;