ajinabraham.njsscan.security_electron.electron_nodejs_integration

rules:
  - id: electron_nodejs_integration
    patterns:
      - pattern-either:
          - pattern: |
              new BrowserWindow({webPreferences: {nodeIntegration: true}})
          - pattern: |
              var $X = {webPreferences: {nodeIntegration: true}};
    message: Node integration exposes node.js APIs to the electron app and this can
      introduce remote code execution vulnerabilities to the application if the
      app is vulnerable to Cross Site Scripting (XSS).
    languages:
      - javascript
    severity: WARNING
    metadata:
      owasp-web: a6
      cwe: cwe-272
      license: LGPL-3.0-or-later