app/sandbox

6 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

app.startAccessingSecurityScopedResource(bookmarkData) method Mac App Store

The app.startAccessingSecurityScopedResource(bookmarkData) method is available only in mas (Mac App Store) builds. It accepts bookmarkData (string, base64 encoded security scoped bookmark data returned by dialog.showOpenDialog or dialog.showSaveDialog methods) and returns a Function. This function must be called once finished accessing the security scoped file. Failure to stop accessing the bookmark will leak kernel resources and the app will lose its ability to reach outside the sandbox completely until restarted. This method allows Electron applications packaged for the Mac App Store to reach outside their sandbox to access files chosen by the user.

app.startAccessingSecurityScopedResource() example with dialog

Example code showing how to use security scoped resources with dialog: const { app, dialog } = require('electron') const fs = require('node:fs') let filepath let bookmark dialog.showOpenDialog(null, { securityScopedBookmarks: true }).then(({ filePaths, bookmarks }) => { filepath = filePaths[0] bookmark = bookmarks[0] fs.readFileSync(filepath) }) // ... restart app ... const stopAccessingSecurityScopedResource = app.startAccessingSecurityScopedResource(bookmark) fs.readFileSync(filepath) stopAccessingSecurityScopedResource()

app.enableSandbox() method

Enables full sandbox mode on the app, meaning all renderers will be launched sandboxed regardless of the sandbox flag in WebPreferences. This method can only be called before the app is ready.

--no-sandbox switch

The --no-sandbox switch disables the Chromium sandbox and forces renderer process and Chromium helper processes to run un-sandboxed. Should only be used for testing.

Sandbox process APIs subset

In sandboxed renderers, the process object contains only: crash(), hang(), getCreationTime(), getHeapStatistics(), getBlinkMemoryInfo(), getProcessMemoryInfo(), getSystemMemoryInfo(), getSystemVersion(), getCPUUsage(), uptime(), argv, execPath, env, pid, arch, platform, sandboxed, contextIsolated, type, version, versions, mas, windowsStore, and contextId.

WebPreferences sandbox option

The sandbox boolean option (optional) sandboxes the renderer associated with the window when set, making it compatible with Chromium's OS-level sandbox and disabling the Node.js engine. The default is true since Electron 20. The sandbox is automatically disabled when nodeIntegration is set to true. APIs available to the preload script are more limited in sandbox mode.

Give your agent this brain