{"action":"created","issue":{"url":"https://api.github.com/repos/atom/electron/issues/3921","labels_url":"https://api.github.com/repos/atom/electron/issues/3921/labels{/name}","comments_url":"https://api.github.com/repos/atom/electron/issues/3921/comments","events_url":"https://api.github.com/repos/atom/electron/issues/3921/events","html_url":"https://github.com/atom/electron/issues/3921","id":123867656,"number":3921,"title":"CSP doesn't work for scripts inside inline `<webview>` tags?","user":{"login":"seanchas116","id":1025246,"avatar_url":"https://avatars.githubusercontent.com/u/1025246?v=3","gravatar_id":"","url":"https://api.github.com/users/seanchas116","html_url":"https://github.com/seanchas116","followers_url":"https://api.github.com/users/seanchas116/followers","following_url":"https://api.github.com/users/seanchas116/following{/other_user}","gists_url":"https://api.github.com/users/seanchas116/gists{/gist_id}","starred_url":"https://api.github.com/users/seanchas116/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seanchas116/subscriptions","organizations_url":"https://api.github.com/users/seanchas116/orgs","repos_url":"https://api.github.com/users/seanchas116/repos","events_url":"https://api.github.com/users/seanchas116/events{/privacy}","received_events_url":"https://api.github.com/users/seanchas116/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-12-25T09:23:04Z","updated_at":"2015-12-28T12:40:09Z","closed_at":"2015-12-28T11:44:32Z","body":"Reference: [Electronでアプリを書く場合は、気合いと根性でXSSを発生させないようにしなければならない。 - 葉っぱ日記](http://d.hatena.ne.jp/hasegawayosuke/20151225/p1) (Japanese)\r\n\r\nContent Security Policy doesn't work for scripts inside `<webview>` tags?\r\n\r\nI think it's dangerous because CSP cannot prevent XSS attacks using `<webview>` tags and allows access to any Node APIs.\r\n\r\n## Example\r\n\r\n* Inline script inside `<script>` doesn't run\r\n* Script in `<webview>`'s `src` attribute runs (and any Node APIs can be used in it even if outer BrowserWindows is nodeIntegration disabled)\r\n\r\n```html\r\n<!DOCTYPE html>\r\n<html>\r\n  <head>\r\n    <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'self';\">\r\n  </head>\r\n  <body>\r\n    <script>\r\n      alert(\"hoge\");\r\n    </script>\r\n    <webview nodeintegration src=\"data:text/html,<script>require('child_process').exec('atom package.json')</script>\"></webview>\r\n  </body>\r\n</html>\r\n```\r\n\r\n```js\r\nnew BrowserWindow({width: 600, height: 400, webPreferences: {nodeIntegration: false}});\r\n```\r\n\r\nEnvironment: Electron 0.36.1 and OS X 10.11.2"},"comment":{"url":"https://api.github.com/repos/atom/electron/issues/comments/167562747","html_url":"https://github.com/atom/electron/issues/3921#issuecomment-167562747","issue_url":"https://api.github.com/repos/atom/electron/issues/3921","id":167562747,"user":{"login":"zcbenz","id":639601,"avatar_url":"https://avatars.githubusercontent.com/u/639601?v=3","gravatar_id":"","url":"https://api.github.com/users/zcbenz","html_url":"https://github.com/zcbenz","followers_url":"https://api.github.com/users/zcbenz/followers","following_url":"https://api.github.com/users/zcbenz/following{/other_user}","gists_url":"https://api.github.com/users/zcbenz/gists{/gist_id}","starred_url":"https://api.github.com/users/zcbenz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zcbenz/subscriptions","organizations_url":"https://api.github.com/users/zcbenz/orgs","repos_url":"https://api.github.com/users/zcbenz/repos","events_url":"https://api.github.com/users/zcbenz/events{/privacy}","received_events_url":"https://api.github.com/users/zcbenz/received_events","type":"User","site_admin":true},"created_at":"2015-12-28T12:40:09Z","updated_at":"2015-12-28T12:40:09Z","body":"If users can inject a webview tag then it won't be safe anyway, they would be able to load arbitrary content and run arbitrary code. There is a similar discussion: https://github.com/atom/electron/issues/1753."}}