{"action":"created","issue":{"url":"https://api.github.com/repos/atom/electron/issues/3943","repository_url":"https://api.github.com/repos/atom/electron","labels_url":"https://api.github.com/repos/atom/electron/issues/3943/labels{/name}","comments_url":"https://api.github.com/repos/atom/electron/issues/3943/comments","events_url":"https://api.github.com/repos/atom/electron/issues/3943/events","html_url":"https://github.com/atom/electron/issues/3943","id":124160358,"number":3943,"title":"Disable webview when node integration is off","user":{"login":"zcbenz","id":639601,"avatar_url":"https://avatars.githubusercontent.com/u/639601?v=3","gravatar_id":"","url":"https://api.github.com/users/zcbenz","html_url":"https://github.com/zcbenz","followers_url":"https://api.github.com/users/zcbenz/followers","following_url":"https://api.github.com/users/zcbenz/following{/other_user}","gists_url":"https://api.github.com/users/zcbenz/gists{/gist_id}","starred_url":"https://api.github.com/users/zcbenz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zcbenz/subscriptions","organizations_url":"https://api.github.com/users/zcbenz/orgs","repos_url":"https://api.github.com/users/zcbenz/repos","events_url":"https://api.github.com/users/zcbenz/events{/privacy}","received_events_url":"https://api.github.com/users/zcbenz/received_events","type":"User","site_admin":true},"labels":[{"url":"https://api.github.com/repos/atom/electron/labels/beginner","name":"beginner","color":"5319e7"},{"url":"https://api.github.com/repos/atom/electron/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"kevinsawicki","id":671378,"avatar_url":"https://avatars.githubusercontent.com/u/671378?v=3","gravatar_id":"","url":"https://api.github.com/users/kevinsawicki","html_url":"https://github.com/kevinsawicki","followers_url":"https://api.github.com/users/kevinsawicki/followers","following_url":"https://api.github.com/users/kevinsawicki/following{/other_user}","gists_url":"https://api.github.com/users/kevinsawicki/gists{/gist_id}","starred_url":"https://api.github.com/users/kevinsawicki/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kevinsawicki/subscriptions","organizations_url":"https://api.github.com/users/kevinsawicki/orgs","repos_url":"https://api.github.com/users/kevinsawicki/repos","events_url":"https://api.github.com/users/kevinsawicki/events{/privacy}","received_events_url":"https://api.github.com/users/kevinsawicki/received_events","type":"User","site_admin":true},"milestone":null,"comments":4,"created_at":"2015-12-29T04:03:01Z","updated_at":"2016-04-02T17:18:23Z","closed_at":"2016-04-02T10:14:58Z","body":"Currently webview tag is available even when node integration is off, this can introduce security problems since webview can be used to execute arbitrary code.\r\n\r\nRefs #3921."},"comment":{"url":"https://api.github.com/repos/atom/electron/issues/comments/204760228","html_url":"https://github.com/atom/electron/issues/3943#issuecomment-204760228","issue_url":"https://api.github.com/repos/atom/electron/issues/3943","id":204760228,"user":{"login":"xywz","id":16139904,"avatar_url":"https://avatars.githubusercontent.com/u/16139904?v=3","gravatar_id":"","url":"https://api.github.com/users/xywz","html_url":"https://github.com/xywz","followers_url":"https://api.github.com/users/xywz/followers","following_url":"https://api.github.com/users/xywz/following{/other_user}","gists_url":"https://api.github.com/users/xywz/gists{/gist_id}","starred_url":"https://api.github.com/users/xywz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xywz/subscriptions","organizations_url":"https://api.github.com/users/xywz/orgs","repos_url":"https://api.github.com/users/xywz/repos","events_url":"https://api.github.com/users/xywz/events{/privacy}","received_events_url":"https://api.github.com/users/xywz/received_events","type":"User","site_admin":false},"created_at":"2016-04-02T17:18:23Z","updated_at":"2016-04-02T17:18:23Z","body":"This is a separate issue that should remain open. Arbitrary webpages can still use webviews to bypass CSP, get access to the entire `webContents` API, and do many other potentially damaging actions."}}