ELECTRON-648 (Prevent drag and drop of files) (#464)

- Prevent drag and drop of files
- Prevent drag and drop of files for about app window

js/aboutApp/renderer.js

@@ -30,4 +30,21 @@ ipcRenderer.on('register-crash-reporter', (event, arg) => {
     if (arg && typeof arg === 'object') {
         crashReporter.start(arg);
     }
+});
+
+// note: this is a workaround until
+// https://github.com/electron/electron/issues/8841
+// is fixed on the electron. where 'will-navigate'
+// is never fired in sandbox mode
+//
+// This is required in order to prevent from loading
+// dropped content
+window.addEventListener('drop', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
+});
+
+window.addEventListener('dragover', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
 });

js/desktopCapturer/renderer.js

@@ -289,4 +289,22 @@ ipcRenderer.on('i18n-screen-picker', (event, content) => {
             }
         }
     }
+});
+
+
+// note: this is a workaround until
+// https://github.com/electron/electron/issues/8841
+// is fixed on the electron. where 'will-navigate'
+// is never fired in sandbox mode
+//
+// This is required in order to prevent from loading
+// dropped content
+window.addEventListener('drop', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
+});
+
+window.addEventListener('dragover', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
 });

js/notify/electron-notify-preload.js

@@ -231,3 +231,20 @@ function reset() {
 ipc.on('electron-notify-set-contents', setContents);
 ipc.on('electron-notify-load-config', loadConfig);
 ipc.on('electron-notify-reset', reset);
+
+// note: this is a workaround until
+// https://github.com/electron/electron/issues/8841
+// is fixed on the electron. where 'will-navigate'
+// is never fired in sandbox mode
+//
+// This is required in order to prevent from loading
+// dropped content
+window.addEventListener('drop', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
+});
+
+window.addEventListener('dragover', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
+});

js/notify/settings/configure-notification-position-preload.js

@@ -97,4 +97,21 @@ ipc.on('i18n-notification-settings', (event, content) => {
             }
         }
     }
+});
+
+// note: this is a workaround until
+// https://github.com/electron/electron/issues/8841
+// is fixed on the electron. where 'will-navigate'
+// is never fired in sandbox mode
+//
+// This is required in order to prevent from loading
+// dropped content
+window.addEventListener('drop', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
+});
+
+window.addEventListener('dragover', function(e) {
+    e.preventDefault();
+    e.stopPropagation();
 });

js/windowMgr.js

@@ -496,6 +496,11 @@ function doCreateMainWindow(initialUrl, initialBounds, isCustomTitleBar) {
                             };
 
                             browserWin.webContents.on('crashed', handleChildWindowCrashEvent);
+                            browserWin.webContents.on('will-navigate', (e, navigatedURL) => {
+                                if (!navigatedURL.startsWith('http' || 'https')) {
+                                    e.preventDefault();
+                                }
+                            });
 
                             // In case we navigate to an external link from inside a pop-out,
                             // we open that link in an external browser rather than creating
@@ -575,6 +580,12 @@ function doCreateMainWindow(initialUrl, initialBounds, isCustomTitleBar) {
 
     // whenever the main window is navigated for ex: window.location.href or url redirect
     mainWindow.webContents.on('will-navigate', function (event, navigatedURL) {
+
+        if (!navigatedURL.startsWith('http' || 'https')) {
+            event.preventDefault();
+            return;
+        }
+
         isWhitelisted(navigatedURL)
             .catch(() => {
                 event.preventDefault();