Open new window with disabled node.js?

[Nikola Jokic]

How would one go with opening a new window with disabled node.js functionality, something like:

window.open('my.html', '_blank', 'screenX=0,screenY=0,width=100,height=100','nodejs:false');

I would like to allow users of my app to open new windows with their (or other users) custom html code, but i don't want newly opened windows to have access to node.js stuff.

This is mainly a security concern for me, because if i cannot disable node in a new window, some user might use access to fs module to wipe out whole disk, or etc.(Am i wrong? is this actually an issue?)

So, to be more clear: main window should have access to the node.js modules, but other windows it "spawns" should have node.js disabled...

Thanks in advance for any help,

Cheers!  

[Roger WANG]

Nikola Jokic <nikol...@gmail.com> writes:

> How would one go with opening a new window with disabled
> node.js functionality, something like:
>

> window.open('my.html', '_blank', 'screenX=0,screenY=0,width=100,height=100',*'nodejs:false'*);

>
>
> I would like to allow users of my app to open new windows with their (or
> other users) custom html code, but i don't want newly opened windows to
> have access to node.js stuff.
>
> This is mainly a security concern for me, because if i cannot disable node
> in a new window, some user might use access to fs module to wipe out whole
> disk, or etc.(Am i wrong? is this actually an issue?)
>
> So, to be more clear: main window should have access to the node.js
> modules, but other windows it "spawns" should have node.js disabled...

It's just implemented in this commit¹ and documented here². Will be
included in the next release.

Does it fulfill your need?

¹ https://github.com/rogerwang/node-webkit/commit/6b4e9d8f2bb9b495945ac8d53f912be8643cab02

² https://github.com/rogerwang/node-webkit/wiki/Window/_compare/c881270%5E...c881270

--
Roger WANG Intel Open Source Technology Center

[Roger WANG]

Forgot to say that you'll need to specify 'nodejs' to false in the
option.

[Nikola Jokic]

Ok, it looks like that's exactly what my app needs! 

Just to be clear, the syntax to spawn a new window with node.js disabled will be:

var win = gui.Window.open('http://someurl', {
  new-instance: true,
  nodejs: false
});

Is this correct?

Thanks for the beautiful software, and a great effort to help the community to learn more about it!

Cheers!

Edit: Sorry, didn't click replay to all!

2013/1/15 Roger WANG <roger...@intel.com>

[Roger WANG]

Nikola Jokic <nikol...@gmail.com> writes:

> Ok, it looks like that's exactly what my app needs!
>
> Just to be clear, the syntax to spawn a new window with node.js disabled
> will be:
>
> var win = gui.Window.open('http://someurl', {
> new-instance: true,
> nodejs: false});
>
> Is this correct?

Correct. except 'new-instance' should be quoted.