<p dir="auto">I am looking a way to lock down windows/webviews and I was testing the inheritance of nodeintegration settings from parents to child.  According to PR <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="143115015" data-permission-text="Title is private" data-url="https://github.com/electron/electron/issues/4897" data-hovercard-type="pull_request" data-hovercard-url="/electron/electron/pull/4897/hovercard" href="https://github.com/electron/electron/pull/4897">#4897</a> this was fixed.  But after testing it on my test app, i can still create a webview with nodeintegration enabled, even if the parent has Nodeintegration disabled.</p>
<p dir="auto">I need this because my app receive data from users (IM's) and XSS could happen.</p>
<p dir="auto">main.js:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="
function createWindow () {
  // Create the browser window.
  mainWindow = new BrowserWindow({
    webPreferences: { nodeIntegration: false }
});"><pre class="notranslate"><code class="notranslate">
function createWindow () {
  // Create the browser window.
  mainWindow = new BrowserWindow({
    webPreferences: { nodeIntegration: false }
});
</code></pre></div>
<p dir="auto">index.html:</p>
<p dir="auto"><code class="notranslate">&lt;webview nodeIntegration  src="data:text/html,&lt;script&gt;require('child_process').exec('notepad.exe',function(){})&lt;/script&gt;"&gt;&lt;/webview&gt; </code></p>
<p dir="auto">If I am not wrong there is a typo in the file spec/webview-spec.js line 100:</p>
<p dir="auto">app.<strong>once</strong>('browser-window-created', function (event, window) {</p>
<p dir="auto">I am expecting the Webview to have nodeintegration disabled.</p>
<ul dir="auto">
<li>Electron version: 0.37.5</li>
<li>Operating system: Windows 10</li>
</ul>
<p dir="auto">Currently webview tag is available even when node integration is off, this can introduce security problems since webview can be used to execute arbitrary code.</p>
<p dir="auto">Refs <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="123867656" data-permission-text="Title is private" data-url="https://github.com/electron/electron/issues/3921" data-hovercard-type="issue" data-hovercard-url="/electron/electron/issues/3921/hovercard" href="https://github.com/electron/electron/issues/3921">#3921</a>.</p>