From 5a877ccab0163399ae2f6f80f4c6882b225ffcff Mon Sep 17 00:00:00 2001
From: Amaury Martiny <amaury.martiny@protonmail.com>
Date: Fri, 22 Jun 2018 15:43:10 +0200
Subject: [PATCH 1/2] Remove ui-dev

---
 packages/fether-electron/package.json          |  2 +-
 packages/fether-electron/src/main/cli/index.js |  4 ----
 packages/fether-electron/src/main/index.js     | 15 +++++----------
 yarn.lock                                      |  8 ++++----
 4 files changed, 10 insertions(+), 19 deletions(-)

diff --git a/packages/fether-electron/package.json b/packages/fether-electron/package.json
index c1371b5e..f45e526e 100644
--- a/packages/fether-electron/package.json
+++ b/packages/fether-electron/package.json
@@ -34,7 +34,7 @@
     "lint": "semistandard 'src/**/*.js' --parser babel-eslint",
     "package": "electron-builder",
     "release": "electron-builder",
-    "start": "electron-webpack dev --ui-dev --light --ws-origins all",
+    "start": "cross-env ELECTRON_START_URL=http://localhost:3000 electron-webpack dev --light --ws-origins all",
     "test": "echo Skipped."
   },
   "dependencies": {
diff --git a/packages/fether-electron/src/main/cli/index.js b/packages/fether-electron/src/main/cli/index.js
index ff27b4f0..27d2ef5d 100644
--- a/packages/fether-electron/src/main/cli/index.js
+++ b/packages/fether-electron/src/main/cli/index.js
@@ -26,10 +26,6 @@ cli
     '--no-run-parity',
     `${productName} will not attempt to run the locally installed parity.`
   )
-  .option(
-    '--ui-dev',
-    `${productName} will load http://localhost:3000. WARNING: Only use this is you plan on developing on ${productName}.`
-  )
   .option(
     '--ws-interface <ip>',
     `Specify the hostname portion of the WebSockets server ${productName} will connect to. IP should be an interface's IP address. (default: 127.0.0.1)`
diff --git a/packages/fether-electron/src/main/index.js b/packages/fether-electron/src/main/index.js
index 56582ec9..24624ee0 100644
--- a/packages/fether-electron/src/main/index.js
+++ b/packages/fether-electron/src/main/index.js
@@ -10,7 +10,6 @@ import path from 'path';
 import url from 'url';
 
 import addMenu from './menu';
-import { cli } from './cli';
 import { doesParityExist } from './operations/doesParityExist';
 import fetchParity from './operations/fetchParity';
 import handleError from './operations/handleError';
@@ -35,20 +34,16 @@ function createWindow () {
     .then(() => runParity(mainWindow))
     .catch(handleError); // Errors should be handled before, this is really just in case
 
-  if (cli.uiDev === true) {
-    // Opens http://127.0.0.1:3000 in --ui-dev mode
-    mainWindow.loadURL('http://127.0.0.1:3000');
-    mainWindow.webContents.openDevTools();
-  } else {
-    // Opens file:///path/to/.build/index.html in prod mode
-    mainWindow.loadURL(
+  // Opens file:///path/to/build/index.html in prod mode, or whatever is
+  // passed to ELECTRON_START_URL
+  mainWindow.loadURL(
+    process.env.ELECTRON_START_URL ||
       url.format({
         pathname: path.join(__static, 'build', 'index.html'),
         protocol: 'file:',
         slashes: true
       })
-    );
-  }
+  );
 
   // Listen to messages from renderer process
   ipcMain.on('asynchronous-message', messages);
diff --git a/yarn.lock b/yarn.lock
index 4cb38944..d13c1d28 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3629,11 +3629,11 @@ crocket@^0.9.11:
   dependencies:
     xpipe "*"
 
-cross-env@^5.1.4:
-  version "5.1.6"
-  resolved "https://registry.yarnpkg.com/cross-env/-/cross-env-5.1.6.tgz#0dc05caf945b24e4b9e3b12871fe0e858d08b38d"
+cross-env@^5.2.0:
+  version "5.2.0"
+  resolved "https://registry.yarnpkg.com/cross-env/-/cross-env-5.2.0.tgz#6ecd4c015d5773e614039ee529076669b9d126f2"
   dependencies:
-    cross-spawn "^5.1.0"
+    cross-spawn "^6.0.5"
     is-windows "^1.0.0"
 
 cross-spawn@5.1.0, cross-spawn@^5.0.1, cross-spawn@^5.1.0:
-- 
GitLab


From f3331f0317acf0b821fd10c0218279867bd28685 Mon Sep 17 00:00:00 2001
From: Amaury Martiny <amaury.martiny@protonmail.com>
Date: Fri, 22 Jun 2018 16:29:25 +0200
Subject: [PATCH 2/2] Add CSP

---
 packages/fether-react/public/index.html | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/fether-react/public/index.html b/packages/fether-react/public/index.html
index bd4382f1..43917cd7 100644
--- a/packages/fether-react/public/index.html
+++ b/packages/fether-react/public/index.html
@@ -4,6 +4,7 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self';connect-src http: https: ws: wss:;img-src 'self' 'unsafe-inline' file: data: blob: http: https:;style-src 'unsafe-inline' file:;">
   <meta name="theme-color" content="#000000">
   <!--
       manifest.json provides metadata used when your web app is added to the
-- 
GitLab