@vixoniccom/module-packager 2.13.0 → 2.13.1-dev.0

package/dist/electron.js

@@ -28,12 +28,8 @@ function createWindow() {
         width: 1024,
         height: 768,
         webPreferences: {
-            nodeIntegrationInSubFrames: true,
-            allowRunningInsecureContent: true,
-            nodeIntegration: true,
-            contextIsolation: false,
-            webSecurity: false,
-            webviewTag: true
+            webviewTag: true,
+            preload: path.join(__dirname, 'scripts', 'preload.js'),
         }
     });
     remoteMain.enable(mainWindow.webContents);

package/dist/launcher.html

@@ -8,85 +8,6 @@
 
 <body style="width: 100%; height: 100%; margin: 0; padding: 0;">
   <div id="webview-container" style="width: 100%; height: 100%;"></div>
-
-  <script>
-    const path = require('path')
-    let ModuleController;
-    try {
-      const moduleControllerModule = require('@vixoniccom/module-controller');
-      ModuleController = moduleControllerModule.default;     
-     } catch (err) {
-      console.error('[WEBVIEW] NO se pudo cargar ModuleController', err);
-    }
-    const { ipcRenderer } = require('electron')
-    const remote = require('@electron/remote')
-
-    ipcRenderer.on('init', (event, options) => {
-      const webview = document.createElement('webview')
-      webview.id = 'webview'
-      webview.style.width = '100%'
-      webview.style.height = '100%'
-      webview.setAttribute('partition', 'persist:webview')
-      
-      webview.setAttribute('nodeintegration', '')
-      webview.setAttribute('webpreferences', 'webSecurity=false, allowRunningInsecureContent=true, nodeIntegration=yes, contextIsolation=no')
-      
-      const win = remote.getCurrentWindow()
-
-      webview.addEventListener('did-finish-load', () => {
-        win.show()
-        win.focus()
-      })
-
-      const resolvedSrc = options.mode === 'watch'
-        ? `http://localhost:${options.port}/index.html`
-        : `file://${path.join(options.build, 'index.html')}`
-
-      webview.src = resolvedSrc
-
-      document.getElementById('webview-container').appendChild(webview)
-
-      function getData() {
-        const data = {}
-
-        try {
-          data.parameters = require(path.join(options.src, 'test', 'parameters.json')).parameters
-        } catch (err) {
-          console.log('No parameters:', err.message)
-        }
-
-        let escaped = path.join(options.mode === 'watch' ? options.src : options.build, 'test', 'downloads')
-
-        if (options.mode === 'watch') escaped = `file://${escaped}`
-        escaped = escaped.replace(/\\/g, '/')
-
-        data.downloadsPath = escaped
-
-
-        try {
-          data.services = require(path.join(options.src, 'test','services.json')).services
-        } catch (err) {
-          console.log('No services:', err.message)
-        }
-
-        return data
-      }
-
-      function getSchema() {
-        try {
-          return require(path.join(options.src, '../configuration.json')).schema
-        } catch (err) {
-          console.log('No schema:', err.message)
-          return {}
-        }
-      }
-
-      const data = getData()
-      const schema = getSchema()
-
-      ModuleController.init(win, webview, data, schema, options.mode === 'watch')
-    })
-  </script>
 </body>
 
 </html>

package/dist/main.js

@@ -194,10 +194,14 @@ async function pack(callback) {
 function installExternals(callback) {
     let externals = options.externals.map((x) => {
         // Validar nombre del paquete
-        if (!/^[@a-z0-9-_./]+$/i.test(x)) {
+        if (!/^(?:@[a-z0-9-_.]+\/)?[a-z0-9-_.]+$/i.test(x)) {
             throw new Error(`Invalid package name: ${x}`);
         }
-        const packageJsonPath = sanitizePath(path.resolve(options.src, '..', 'node_modules', x, 'package.json'));
+        const nodeModulesBase = path.resolve(options.src, '..', 'node_modules');
+        const packageJsonPath = path.resolve(nodeModulesBase, x, 'package.json');
+        if (!packageJsonPath.startsWith(nodeModulesBase + path.sep)) {
+            throw new Error(`Invalid package path: path traversal detected for package ${x}`);
+        }
         return `${x}@${JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')).version}`;
     });
     if (externals.length) {

package/dist/scripts/preload.js

@@ -0,0 +1,59 @@
+// preload.ts
+import path from 'path';
+import { ipcRenderer } from 'electron';
+import remote from '@electron/remote';
+let ModuleController;
+try {
+    const m = require('@vixoniccom/module-controller');
+    ModuleController = m.default;
+}
+catch (err) {
+    console.error('[PRELOAD] No se pudo cargar ModuleController', err);
+}
+ipcRenderer.on('init', (_event, options) => {
+    const webview = document.createElement('webview');
+    webview.id = 'webview';
+    webview.style.width = '100%';
+    webview.style.height = '100%';
+    webview.setAttribute('partition', 'persist:webview');
+    webview.setAttribute('preload', `file://${path.join(__dirname, 'webview-preload.js')}`);
+    const win = remote.getCurrentWindow();
+    webview.addEventListener('did-finish-load', () => {
+        win.show();
+        win.focus();
+    });
+    const resolvedSrc = options.mode === 'watch'
+        ? `http://localhost:${options.port}/index.html`
+        : `file://${path.join(options.build, 'index.html')}`;
+    webview.src = resolvedSrc;
+    document.getElementById('webview-container')?.appendChild(webview);
+    function getData() {
+        const data = {};
+        try {
+            data.parameters = require(path.join(options.src, 'test', 'parameters.json')).parameters;
+        }
+        catch (err) {
+            console.log('No parameters:', err.message);
+        }
+        let escaped = path.join(options.mode === 'watch' ? options.src : options.build, 'test', 'downloads');
+        if (options.mode === 'watch')
+            escaped = `file://${escaped}`;
+        data.downloadsPath = escaped.replace(/\\/g, '/');
+        try {
+            data.services = require(path.join(options.src, 'test', 'services.json')).services;
+        }
+        catch (err) {
+            console.log('No services:', err.message);
+        }
+        return data;
+    }
+    function getSchema() {
+        try {
+            return require(path.join(options.src, '../configuration.json')).schema;
+        }
+        catch {
+            return {};
+        }
+    }
+    ModuleController?.init(win, webview, getData(), getSchema(), options.mode === 'watch');
+});

package/dist/scripts/webview-preload.js

@@ -0,0 +1,13 @@
+import { ipcRenderer } from 'electron';
+ipcRenderer.on('preload', (_event, data) => {
+    window.postMessage({ channel: 'preload', data }, location.origin);
+});
+ipcRenderer.on('start', (_event, data) => {
+    window.postMessage({ channel: 'start', data }, location.origin);
+});
+ipcRenderer.on('update', (_event, data) => {
+    window.postMessage({ channel: 'update', data }, location.origin);
+});
+ipcRenderer.on('finish', () => {
+    window.postMessage({ channel: 'finish', data: null }, location.origin);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vixoniccom/module-packager",
-  "version": "2.13.0",
+  "version": "2.13.1-dev.0",
   "type": "module",
   "license": "ISC",
   "bin": {