{"action":"opened","number":79,"pull_request":{"url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/79","id":312958859,"node_id":"MDExOlB1bGxSZXF1ZXN0MzEyOTU4ODU5","html_url":"https://github.com/jschr/electron-react-redux-boilerplate/pull/79","diff_url":"https://github.com/jschr/electron-react-redux-boilerplate/pull/79.diff","patch_url":"https://github.com/jschr/electron-react-redux-boilerplate/pull/79.patch","issue_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/79","number":79,"state":"open","locked":false,"title":"Fix security issues","user":{"login":"pronebird","id":704044,"node_id":"MDQ6VXNlcjcwNDA0NA==","avatar_url":"https://avatars2.githubusercontent.com/u/704044?v=4","gravatar_id":"","url":"https://api.github.com/users/pronebird","html_url":"https://github.com/pronebird","followers_url":"https://api.github.com/users/pronebird/followers","following_url":"https://api.github.com/users/pronebird/following{/other_user}","gists_url":"https://api.github.com/users/pronebird/gists{/gist_id}","starred_url":"https://api.github.com/users/pronebird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pronebird/subscriptions","organizations_url":"https://api.github.com/users/pronebird/orgs","repos_url":"https://api.github.com/users/pronebird/repos","events_url":"https://api.github.com/users/pronebird/events{/privacy}","received_events_url":"https://api.github.com/users/pronebird/received_events","type":"User","site_admin":false},"body":"This PR adds gulp to account for some rough edges in the configuration relying on `package.json` scripts only. I kept the complexity to minimum to make sure we keep following the idea of having a boilerplate that's easy to pick up and get going with.\r\n\r\n1. Add `Content-Security-Policy`, this fixes #66 and hardens security.\r\n1. Inject `process.env.BROWSER_SYNC_CLIENT_URL` dynamically in development builds. The problem with permanently having a code relying on environment variables is because it's easy to trick the app into loading a malicious script in production builds by simply setting `BROWSER_SYNC_CLIENT_URL` to anything you want.\r\n1. Replace all occurrences of `process.env.NODE_ENV` with a string literal (`\"production\"`) in production builds. Users could trick the app into loading dev tools by simply setting the `NODE_ENV` to `development`. This is not desired in production builds. \r\n1. `electron-builder` is executed using the task runner instead of CLI. The reason for that is because we will need to add a few hooks to support Electron v5.0 or 6.0 in the future, because of `chrome-sandbox` executable that needs the proper file system permissions on Linux.","created_at":"2019-08-31T14:16:37Z","updated_at":"2019-08-31T14:16:37Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[{"login":"jschr","id":1163252,"node_id":"MDQ6VXNlcjExNjMyNTI=","avatar_url":"https://avatars2.githubusercontent.com/u/1163252?v=4","gravatar_id":"","url":"https://api.github.com/users/jschr","html_url":"https://github.com/jschr","followers_url":"https://api.github.com/users/jschr/followers","following_url":"https://api.github.com/users/jschr/following{/other_user}","gists_url":"https://api.github.com/users/jschr/gists{/gist_id}","starred_url":"https://api.github.com/users/jschr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschr/subscriptions","organizations_url":"https://api.github.com/users/jschr/orgs","repos_url":"https://api.github.com/users/jschr/repos","events_url":"https://api.github.com/users/jschr/events{/privacy}","received_events_url":"https://api.github.com/users/jschr/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/79/commits","review_comments_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/79/comments","review_comment_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/79/comments","statuses_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/statuses/b2e943eb279843c55ce2c671be8b35e65147732a","head":{"label":"jschr:add-gulp","ref":"add-gulp","sha":"b2e943eb279843c55ce2c671be8b35e65147732a","user":{"login":"jschr","id":1163252,"node_id":"MDQ6VXNlcjExNjMyNTI=","avatar_url":"https://avatars2.githubusercontent.com/u/1163252?v=4","gravatar_id":"","url":"https://api.github.com/users/jschr","html_url":"https://github.com/jschr","followers_url":"https://api.github.com/users/jschr/followers","following_url":"https://api.github.com/users/jschr/following{/other_user}","gists_url":"https://api.github.com/users/jschr/gists{/gist_id}","starred_url":"https://api.github.com/users/jschr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschr/subscriptions","organizations_url":"https://api.github.com/users/jschr/orgs","repos_url":"https://api.github.com/users/jschr/repos","events_url":"https://api.github.com/users/jschr/events{/privacy}","received_events_url":"https://api.github.com/users/jschr/received_events","type":"User","site_admin":false},"repo":{"id":42462339,"node_id":"MDEwOlJlcG9zaXRvcnk0MjQ2MjMzOQ==","name":"electron-react-redux-boilerplate","full_name":"jschr/electron-react-redux-boilerplate","private":false,"owner":{"login":"jschr","id":1163252,"node_id":"MDQ6VXNlcjExNjMyNTI=","avatar_url":"https://avatars2.githubusercontent.com/u/1163252?v=4","gravatar_id":"","url":"https://api.github.com/users/jschr","html_url":"https://github.com/jschr","followers_url":"https://api.github.com/users/jschr/followers","following_url":"https://api.github.com/users/jschr/following{/other_user}","gists_url":"https://api.github.com/users/jschr/gists{/gist_id}","starred_url":"https://api.github.com/users/jschr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschr/subscriptions","organizations_url":"https://api.github.com/users/jschr/orgs","repos_url":"https://api.github.com/users/jschr/repos","events_url":"https://api.github.com/users/jschr/events{/privacy}","received_events_url":"https://api.github.com/users/jschr/received_events","type":"User","site_admin":false},"html_url":"https://github.com/jschr/electron-react-redux-boilerplate","description":"A minimal boilerplate to get started with Electron, React and Redux.","fork":false,"url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate","forks_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/forks","keys_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/teams","hooks_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/hooks","issue_events_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/events{/number}","events_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/events","assignees_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/assignees{/user}","branches_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/branches{/branch}","tags_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/tags","blobs_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/refs{/sha}","trees_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/statuses/{sha}","languages_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/languages","stargazers_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/stargazers","contributors_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/contributors","subscribers_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/subscribers","subscription_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/subscription","commits_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/commits{/sha}","git_commits_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/commits{/sha}","comments_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/comments{/number}","issue_comment_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/comments{/number}","contents_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/contents/{+path}","compare_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/merges","archive_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/downloads","issues_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues{/number}","pulls_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls{/number}","milestones_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/milestones{/number}","notifications_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/labels{/name}","releases_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/releases{/id}","deployments_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/deployments","created_at":"2015-09-14T16:44:57Z","updated_at":"2019-08-27T21:43:14Z","pushed_at":"2019-08-31T14:13:35Z","git_url":"git://github.com/jschr/electron-react-redux-boilerplate.git","ssh_url":"git@github.com:jschr/electron-react-redux-boilerplate.git","clone_url":"https://github.com/jschr/electron-react-redux-boilerplate.git","svn_url":"https://github.com/jschr/electron-react-redux-boilerplate","homepage":"","size":217,"stargazers_count":396,"watchers_count":396,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":87,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":2,"license":null,"forks":87,"open_issues":2,"watchers":396,"default_branch":"master"}},"base":{"label":"jschr:master","ref":"master","sha":"56c8a0936e17b136944ed5692377b66811f1ce11","user":{"login":"jschr","id":1163252,"node_id":"MDQ6VXNlcjExNjMyNTI=","avatar_url":"https://avatars2.githubusercontent.com/u/1163252?v=4","gravatar_id":"","url":"https://api.github.com/users/jschr","html_url":"https://github.com/jschr","followers_url":"https://api.github.com/users/jschr/followers","following_url":"https://api.github.com/users/jschr/following{/other_user}","gists_url":"https://api.github.com/users/jschr/gists{/gist_id}","starred_url":"https://api.github.com/users/jschr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschr/subscriptions","organizations_url":"https://api.github.com/users/jschr/orgs","repos_url":"https://api.github.com/users/jschr/repos","events_url":"https://api.github.com/users/jschr/events{/privacy}","received_events_url":"https://api.github.com/users/jschr/received_events","type":"User","site_admin":false},"repo":{"id":42462339,"node_id":"MDEwOlJlcG9zaXRvcnk0MjQ2MjMzOQ==","name":"electron-react-redux-boilerplate","full_name":"jschr/electron-react-redux-boilerplate","private":false,"owner":{"login":"jschr","id":1163252,"node_id":"MDQ6VXNlcjExNjMyNTI=","avatar_url":"https://avatars2.githubusercontent.com/u/1163252?v=4","gravatar_id":"","url":"https://api.github.com/users/jschr","html_url":"https://github.com/jschr","followers_url":"https://api.github.com/users/jschr/followers","following_url":"https://api.github.com/users/jschr/following{/other_user}","gists_url":"https://api.github.com/users/jschr/gists{/gist_id}","starred_url":"https://api.github.com/users/jschr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jschr/subscriptions","organizations_url":"https://api.github.com/users/jschr/orgs","repos_url":"https://api.github.com/users/jschr/repos","events_url":"https://api.github.com/users/jschr/events{/privacy}","received_events_url":"https://api.github.com/users/jschr/received_events","type":"User","site_admin":false},"html_url":"https://github.com/jschr/electron-react-redux-boilerplate","description":"A minimal boilerplate to get started with Electron, React and Redux.","fork":false,"url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate","forks_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/forks","keys_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/teams","hooks_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/hooks","issue_events_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/events{/number}","events_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/events","assignees_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/assignees{/user}","branches_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/branches{/branch}","tags_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/tags","blobs_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/refs{/sha}","trees_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/statuses/{sha}","languages_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/languages","stargazers_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/stargazers","contributors_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/contributors","subscribers_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/subscribers","subscription_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/subscription","commits_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/commits{/sha}","git_commits_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/git/commits{/sha}","comments_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/comments{/number}","issue_comment_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/comments{/number}","contents_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/contents/{+path}","compare_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/merges","archive_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/downloads","issues_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues{/number}","pulls_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls{/number}","milestones_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/milestones{/number}","notifications_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/labels{/name}","releases_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/releases{/id}","deployments_url":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/deployments","created_at":"2015-09-14T16:44:57Z","updated_at":"2019-08-27T21:43:14Z","pushed_at":"2019-08-31T14:13:35Z","git_url":"git://github.com/jschr/electron-react-redux-boilerplate.git","ssh_url":"git@github.com:jschr/electron-react-redux-boilerplate.git","clone_url":"https://github.com/jschr/electron-react-redux-boilerplate.git","svn_url":"https://github.com/jschr/electron-react-redux-boilerplate","homepage":"","size":217,"stargazers_count":396,"watchers_count":396,"language":"JavaScript","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":87,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":2,"license":null,"forks":87,"open_issues":2,"watchers":396,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/79"},"html":{"href":"https://github.com/jschr/electron-react-redux-boilerplate/pull/79"},"issue":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/79"},"comments":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/issues/79/comments"},"review_comments":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/79/comments"},"review_comment":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/pulls/79/commits"},"statuses":{"href":"https://api.github.com/repos/jschr/electron-react-redux-boilerplate/statuses/b2e943eb279843c55ce2c671be8b35e65147732a"}},"author_association":"COLLABORATOR","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":10171,"deletions":98,"changed_files":11}}
{"actor":{"display_login":"pronebird"}}