no-electron-webview-node-integration

Disallow Electron <webview> configurations that enable node integration.

Targeted pattern scope

Electron <webview> configurations enabling node integration flags.

What this rule reports

webview nodeintegration/nodeintegrationinsubframes/webpreferences node-integration flags.

Why this rule exists

Node integration in untrusted renderer contexts can break isolation and enable code-execution paths.

❌ Incorrect

const view = <webview nodeintegration src="https://example.com" />;

✅ Correct

const view = <webview src="https://example.com" webpreferences="sandbox=yes" />;

ESLint flat config example

import sdl from "eslint-plugin-sdl-2";

export default [
 {
  plugins: { sdl },

  rules: {
   "sdl/no-electron-webview-node-integration": "error",
  },
 },
];

When not to use it

Disable only for legacy webview flows with documented trust guarantees and compensating isolation controls.

Package documentation

Rule source

Targeted pattern scope​

What this rule reports​

Why this rule exists​

❌ Incorrect​

✅ Correct​

ESLint flat config example​

When not to use it​

Package documentation​

Further reading​