Browserify preload script and enable sandbox

3 files changed, 37 insertions, 9 deletions

diff --git a/gui/src/main/index.ts b/gui/src/main/index.ts
index 56027141ec..00a93bf3c0 100644
--- a/gui/src/main/index.ts
+++ b/gui/src/main/index.ts
@@ -209,6 +209,10 @@ class ApplicationMain {
       app.commandLine.appendSwitch('wm-window-animations-disabled');
     }
 
+    if (process.platform !== 'linux') {
+      app.enableSandbox();
+    }
+
     this.overrideAppPaths();
 
     if (this.ensureSingleInstance()) {
@@ -1442,14 +1446,14 @@ class ApplicationMain {
       transparent: !this.guiSettings.unpinnedWindow,
       useContentSize: true,
       webPreferences: {
-        preload: path.join(__dirname, '../renderer/preload.js'),
+        preload: path.join(__dirname, '../renderer/preloadBundle.js'),
         nodeIntegration: false,
         nodeIntegrationInWorker: false,
         nodeIntegrationInSubFrames: false,
-        devTools: process.env.NODE_ENV === 'development',
-        // TODO: Remove use of remote
-        enableRemoteModule: true,
+        enableRemoteModule: false,
+        sandbox: process.platform !== 'linux',
         spellcheck: false,
+        devTools: process.env.NODE_ENV === 'development',
       },
     };
 
diff --git a/gui/tasks/scripts.js b/gui/tasks/scripts.js
index a04df01310..120dd892e2 100644
--- a/gui/tasks/scripts.js
+++ b/gui/tasks/scripts.js
@@ -1,5 +1,5 @@
 const { exec } = require('child_process');
-const { src, dest, series } = require('gulp');
+const { dest, series, parallel } = require('gulp');
 const ts = require('gulp-typescript');
 const inject = require('gulp-inject-string');
 const TscWatchClient = require('tsc-watch/client');
@@ -8,10 +8,21 @@ const buffer = require('vinyl-buffer');
 const source = require('vinyl-source-stream');
 
 function makeWatchCompiler(onFirstSuccess) {
+  let firstBuild = true;
+
   const compileScripts = function () {
     const watch = new TscWatchClient();
-    watch.on('first_success', onFirstSuccess);
-    watch.on('success', browserifyRenderer);
+    watch.on('success', () =>
+      parallel(
+        browserifyRenderer,
+        browserifyPreload,
+      )(() => {
+        if (firstBuild) {
+          firstBuild = false;
+          onFirstSuccess();
+        }
+      }),
+    );
     watch.start('--noClear', '--inlineSourceMap', '--incremental', '--project', '.');
     return watch.tsc;
   };
@@ -38,14 +49,27 @@ function browserifyRenderer() {
     .pipe(dest('./build/src/renderer/'));
 }
 
+function browserifyPreload() {
+  return browserify({
+    entries: './build/src/renderer/preload.js',
+  })
+    .exclude('fs')
+    .exclude('electron')
+    .bundle()
+    .pipe(source('preloadBundle.js'))
+    .pipe(buffer())
+    .pipe(dest('./build/src/renderer/'));
+}
+
 function buildProto(callback) {
   exec('bash ./scripts/build-proto.sh', (err) => callback(err));
 }
 
 compileScripts.displayName = 'compile-scripts';
 browserifyRenderer.displayName = 'browserify-renderer';
+browserifyPreload.displayName = 'browserify-preload';
 buildProto.displayName = 'build-proto';
 
-exports.build = series(compileScripts, browserifyRenderer);
+exports.build = series(compileScripts, parallel(browserifyPreload, browserifyRenderer));
 exports.buildProto = buildProto;
 exports.makeWatchCompiler = makeWatchCompiler;
diff --git a/gui/tasks/watch.js b/gui/tasks/watch.js
index 24771b90e3..dca4debe68 100644
--- a/gui/tasks/watch.js
+++ b/gui/tasks/watch.js
@@ -10,7 +10,7 @@ function watchMainScripts() {
 }
 
 function watchRendererScripts() {
-  return watch(['build/src/renderer/bundle.js'], series(hotreload.reload));
+  return watch(['build/src/renderer/(bundle|preloadBundle).js'], series(hotreload.reload));
 }
 
 function watchCss() {