Skip to content

[Bug]: Unsanboxed preload running after page with content is loaded (ESM) #40777

Open
@Arkellys

Description

@Arkellys

Preflight Checklist

Electron Version

28.0.0

What operating system are you using?

Windows

Operating System Version

Windows 10 Family

What arch are you using?

x64

Last Known Working Electron version

No response

Expected Behavior

Electron 28 added support for ESM, the new doc states that:

Unsandboxed ESM preload scripts will run after page load on pages with no content

If the response body for a renderer's loaded page is completely empty (i.e. Content-Length: 0), its preload script will not block the page load, which may result in race conditions.

If this impacts you, change your response body to have something in it (e.g. an empty html tag (<html></html>)) or swap back to using a CommonJS preload script (.js or .cjs), which will block the page load.

So for an HTML with content, I expect the preload to be run before the page loads:

image

Actual Behavior

For the following HTML:

<!DOCTYPE html>
<html>
  <head>
    <meta charset="utf-8">
    <meta http-equiv="Content-Security-Policy" content="script-src 'self';">
  </head>
	
  <body>
    <main>
      <p>
        There is nothing interesting to see here...
      </p>
    </main>
  </body>
</html>

Loaded as:

new BrowserWindow({
  webPreferences: {
    nodeIntegration: false,
    contextIsolation: true,
    sandbox: false,
    preload: /*preload path */,
  }
});

With in package.json:

"type": "module"

The JS file linked to my HTML shows the page is loaded before the preload.

image

For context, listen is a function exposed on the preload with contextBridge.

Testcase Gist URL

No response

Additional Information

I can't see the Content-Length header in the response headers:

image

The file is loaded from http://localhost:3000/worker.html

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions