sandbox: true?

[mdruuu]

Hi,

I'm just wondering if there's any way to use electron-vite with sandbox: true.

It seems like in all versions sandbox is set to false by default. I understand this does introduce some security vulnerabilities.

I'm trying to figure out if I can get just the default app to load while using sandbox I've tried a few different configurations but it seems like the screen components do not load.

Thank you in advance!

[alex8088]

https://electron-vite.org/guide/dev#limitations-of-sandboxing

[goosewobbler]

I had this issue with an ESM project trying to get the app to work when sandboxing was enabled. I fixed it by switching the output format of the preload to CJS. The following works when sandbox: true is set, and with both main and renderer output formats set to 'es':

  preload: {
    build: {
      rollupOptions: {
        output: {
          format: 'cjs',
        },
      },
    },
  },

Don't forget to change the reference to your preload as it will now end with .cjs. Also don't use the externalizeDepsPlugin for the preload - it seems all deps need to be bundled even in CJS - possibly something to do with this caveat.

I think the docs section below should be changed to mention using a CJS preload in order to preserve sandboxing:

https://electron-vite.org/guide/dev#limitations

[RichySano]

@goosewobbler, do you know how to use :

preload: {
build: {
rollupOptions: {
output: {
format: 'cjs',
},
},
},
},

with nuxt-electron which use vite-plugin-electron ?

[goosewobbler]

I don't use nuxt-electron but from the README it looks like it would go somewhere in build. Look at the types.

[RichySano]

In package.json, i want to use type = module to be in esm and i want to use sandbox.

Here my configuration

export default defineNuxtConfig({
compatibilityDate: '2024-04-03',
devtools: { enabled: true },
ssr: false,
modules: ['nuxt-electron'],
electron: {
build: [
{
entry: 'electron/main.ts',
vite: {
build: {
rollupOptions: {
external: ['serialport'],
output: {
format: 'es'
}

                    }
                }
            },
        },
        {                
            entry: 'electron/preload.ts',
            vite: {         
                build: {
                    rollupOptions: {
                        output: {
                            format: 'cjs'
                        },
                    },
                },
            },                
            onstart(args) {
                args.reload();
            },
        },
    ],        
    renderer: {},
    disableDefaultOptions: false,
},
experimental: {
    appManifest: false
},    

})

But sandbox = true doesn't work.

If i had this in ouput option of preload

                            entryFileNames: `[name].mjs`,
                            chunkFileNames: `[name].mjs`,

And i delete format: 'cjs', and i put sandbox = false. It's working

Is it possible ?

any idea? Thank you for your previous response

[goosewobbler]

No idea, sorry as I said I don't use nuxt-electron.

[RichySano]

Ok, i've found. preload must continue to use require instead of use import. Not you ?