Resolves:
i. Only display secure (https) content
ii. Enable context isolation in all renderers that display remote
content
v. Override and disable eval, which allows strings to be executed as
code (…maybe. need someone to verify this work.)
Also resolves:
1. allowRunningInsecureContent was set to true in WebView.js, against
the recommendations of
https://github.com/electron/electron/blob/master/docs/tutorial/security.
md
Most users will use the default values and will therefore have an insecure setup.
The result can be Man-in-the-Middle or other attacks on rambox users when using default settings!
failathon
madblobfish
Ramiro Saenz
Michael Weimann