Further lock down navigation

src-main/index.js

@@ -85,9 +85,9 @@ app.on('session-created', (session) => {
 
 app.on('web-contents-created', (event, webContents) => {
   webContents.on('will-navigate', (event, url) => {
-    // Only allow windows to refresh
-    // TODO: this probably isnt secure if the window can pushstate popstate etc.
-    if (webContents.getURL() !== url) {
+    // Only allow windows to refresh, not navigate anywhere.
+    const window = BaseWindow.getWindowByWebContents(webContents);
+    if (!window || url !== window.initialURL) {
       event.preventDefault();
       openExternal(url);
     }

src-main/windows/about.js

@@ -22,7 +22,7 @@ class AboutWindow extends BaseWindow {
       };
     });
 
-    this.window.loadURL('tw-about://./about.html');
+    this.loadURL('tw-about://./about.html');
   }
 
   getDimensions () {

src-main/windows/addons.js

@@ -41,7 +41,7 @@ class AddonsWindow extends BaseWindow {
       await writeFileAtomic(result.filePath, settings);
     });
 
-    this.window.loadURL(`tw-editor://./addons/addons.html`);
+    this.loadURL(`tw-editor://./addons/addons.html`);
   }
 
   getDimensions () {

src-main/windows/base.js

@@ -12,6 +12,8 @@ class BaseWindow {
     this.window.webContents.on('before-input-event', this.handleInput.bind(this));
     this.applySettings();
 
+    this.initialURL = 'about:blank';
+
     const cls = this.constructor;
     if (!windowsByClass.has(cls)) {
       windowsByClass.set(cls, []);
@@ -129,6 +131,11 @@ class BaseWindow {
     return options;
   }
 
+  loadURL (url) {
+    this.initialURL = url;
+    return this.window.loadURL(url);
+  }
+
   show () {
     this.window.show();
     this.window.focus();
@@ -208,14 +215,10 @@ class BaseWindow {
         }
       }
 
-      // Ctrl+R and Ctrl+Shift+R to reload
+      // Ctrl+R to reload
       if (input.control && input.key.toLowerCase() === 'r') {
         event.preventDefault();
-        if (input.shift) {
-          webContents.reloadIgnoringCache();
-        } else {
-          webContents.reload();
-        }
+        webContents.loadURL(this.initialURL);
       }
     }
   }

src-main/windows/desktop-settings.js

@@ -67,7 +67,7 @@ class DesktopSettingsWindow extends BaseWindow {
       shell.showItemInFolder(app.getPath('userData'));
     });
 
-    this.window.loadURL('tw-desktop-settings://./desktop-settings.html');
+    this.loadURL('tw-desktop-settings://./desktop-settings.html');
   }
 
   getDimensions () {

src-main/windows/editor.js

@@ -363,7 +363,7 @@ class EditorWindow extends BaseWindow {
       };
     });
 
-    this.window.loadURL('tw-editor://./gui/gui.html');
+    this.loadURL('tw-editor://./gui/gui.html');
     this.show();
   }
 

src-main/windows/packager.js

@@ -60,7 +60,7 @@ class PackagerWindow extends BaseWindow {
       });
     });
 
-    this.window.loadURL('tw-packager://./standalone.html');
+    this.loadURL('tw-packager://./standalone.html');
     this.show();
   }
 

src-main/windows/privacy.js

@@ -5,10 +5,10 @@ const {APP_NAME} = require('../brand');
 class PrivacyWindow extends BaseWindow {
   constructor () {
     super();
-    this.window.loadURL('tw-privacy://./privacy.html');
     this.window.setTitle(`${translate('privacy-policy')} - ${APP_NAME}`);
     this.window.setMinimizable(false);
     this.window.setMaximizable(false);
+    this.loadURL('tw-privacy://./privacy.html');
   }
 
   getDimensions () {

src-main/windows/update.js

@@ -71,7 +71,7 @@ class UpdateWindow extends BaseWindow {
       this.show();
     });
 
-    this.window.loadURL('tw-update://./update.html');
+    this.loadURL('tw-update://./update.html');
   }
 
   getDimensions () {