* build: check the formatting of docs code blocks with oxfmt
lint-roller 4 splits the old `lint-roller-markdown-standard` into an
oxlint half and an oxfmt half. This wires up the second one:
`lint:fmt-in-markdown` runs `lint-roller-markdown-oxfmt` over docs/ as
part of `lint:docs`, using docs/.oxfmtrc.json, which matches the repo's
.oxfmtrc.json except that docs snippets keep their semicolon-free style.
`--fix` writes the formatted blocks back, and a block can opt out with
`@noformat` in its info string.
* docs: format code blocks with oxfmt
Result of `lint-roller-markdown-oxfmt --fix` with docs/.oxfmtrc.json, plus
the @ts-expect-error line anchors (and one Docusaurus highlight marker)
that moved with the reformat. The Babel output sample in the ESM guide and
the two excerpts of repo source in creating-api.md are marked @noformat,
and the contentTracing example passes an async callback instead of
wrapping an IIFE so that it does not need a leading semicolon.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix: check the sending frame for internal guest, window and reply IPCs
* guest-view IPCs (attach/detach/call/property get/set) are honoured only
from the frame that created the <webview>, not from any frame in the
embedder WebContents
* window.close() via the internal IPC is honoured only from the top-level
document, and the renderer override is installed for the main frame only
* replies to webContents.executeJavaScript()/insertCSS() and friends are
accepted only from the main frame they were sent to
* webContents.sendToFrame() only addresses frames that belong to that
WebContents
* the <webview> `ipc-message` event carries `frameOrigin` / `frameUrl` of the
frame in the guest that sent it
* process.getProcessMemoryInfo() reports the calling frame's own process
* docs: validateSender example checks senderFrame.origin
* docs: add API history PR reference
* refactor: drop frameOrigin/frameUrl from the webview ipc-message event
* docs: security.md mark 'Enable process sandboxing' as active by default since electron 20
* Adjusted according to feedback
* Updated according to feedback - adjusted sandbox.md
* formatting
* Fixed broken markup
* Implemented docs linting suggestions
* docs: docs/tutorial/sandbox.md - fixed typo
Co-authored-by: Erick Zhao <erick@hotmail.ca>
* docs: web-preferences.md - sandbox: mention default value and relation to nodeIntegration
---------
Co-authored-by: Erick Zhao <erick@hotmail.ca>
* Add note about fuses to our security documentation
Additionally, add the missing #18 to the ToC.
* lint issues for security.md
* Update docs/tutorial/security.md
Co-authored-by: Felix Rieseberg <fr@makenotion.com>
* move reference links to bottom of security.md
---------
Co-authored-by: Felix Rieseberg <fr@makenotion.com>
* build(deps): update @electron/lint-roller
* chore: type check JS in docs
* docs: add @ts-check and @ts-expect-error to code blocks
* chore: fix type check errors in docs
* chore: add ts-type to blocks
Update security.md
Under "4. Process Sandboxing", it said "For mor information on what `contextIsolation` is..." which was the previous section (copied from there). This updates it to say "For more information on what Process Sandboxing is..."
Rule 13 recommends using Node's URL parser for handling url inputs. At
the moment, this is not being followed in the code example for rule 5,
which falls back on checking that the url ends with a '/'. If this was
forgotten when a user copies this code it could introduce security
vulnerabilities if an attacker uses an URL in the following way:
"https://example.com.attacker.com"
Using Node's URL parser fixes this potential missuse and enables the
'/' to be omited from the code example.
Co-authored-by: Baitinq <you@example.com>
* docs: Update CI Badge Branch Name
The CI badges were still pointing at builds for the master branch, which
are stale since the rename to main.
* docs: Update electron/electron Branch Name
Update electron/electron branch name from master to main.
* docs: Update electron/governance Branch Name
Update electron/governance branch name from master to main.
* docs: Update to the use of arrow functions in line with the style guide
* docs: Fixed unmatched bracket typo in previous commit 9ebe3e58f7948c6636d77f3c58a2693683b69691
* fix linting
Co-authored-by: Cheng Zhao <zcbenz@gmail.com>
