From cdf93bfa4a2a8f3f67f20177e4a03ea217ea24de Mon Sep 17 00:00:00 2001 From: Mark Skelton Date: Sat, 22 Aug 2026 01:18:52 -0500 Subject: [PATCH] docs: avoid exposing ipcRenderer in navigation history fiddle (#52882) Passing the renderer callback directly to ipcRenderer.on leaks IpcRendererEvent.sender, which violates security guideline 20. Assisted-By: Cursor Grok 4.6 --- docs/fiddles/features/navigation-history/preload.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/fiddles/features/navigation-history/preload.js b/docs/fiddles/features/navigation-history/preload.js index 6d5c38976c..4fbd98fdb3 100644 --- a/docs/fiddles/features/navigation-history/preload.js +++ b/docs/fiddles/features/navigation-history/preload.js @@ -8,5 +8,5 @@ contextBridge.exposeInMainWorld('electronAPI', { loadURL: (url) => ipcRenderer.invoke('nav:loadURL', url), getCurrentURL: () => ipcRenderer.invoke('nav:getCurrentURL'), getHistory: () => ipcRenderer.invoke('nav:getHistory'), - onNavigationUpdate: (callback) => ipcRenderer.on('nav:updated', callback) + onNavigationUpdate: (callback) => ipcRenderer.on('nav:updated', () => callback()) })