Upgrade Electron

main.js

@@ -3,6 +3,7 @@ const url = require('url');
 const request = require('request');
 const qrcode = require('qrcode');
 const { base32, base64 } = require('rfc4648');
+const path = require("node:path");
 
 let win
 let client_id='g2c2pjLUThOaBumECqbf'
@@ -166,9 +167,18 @@ function createWindow () {
         if (error) console.error('Failed to register protocol')
     })
 
-    win = new BrowserWindow({ width: 800, height: 600 })
+    win = new BrowserWindow({
+        width: 800,
+        height: 600,
+        webPreferences: {
+            nodeIntegration: false,
+            contextIsolation: true,
+            enableRemoteModule: false,
+            preload: path.join(__dirname, "preload.js")
+        }
+    })
 
-    win.loadURL(`file://${__dirname}/instructions.html`)
+    win.loadFile(path.join(__dirname, "instructions.html"));
 
     ipcMain.on('code', (event, arg) => {
         verifyCode(arg);

package.json

@@ -12,7 +12,7 @@
     "start": "electron ."
   },
   "devDependencies": {
-    "electron": "^4.1.4",
+    "electron": "^23.2.1",
     "qrcode": "^1.3.3",
     "request": "^2.88.0",
     "rfc4648": "^1.2.0"

preload.js

@@ -0,0 +1,25 @@
+const {
+    contextBridge,
+    ipcRenderer
+} = require("electron");
+
+// Expose protected methods that allow the renderer process to use
+// the ipcRenderer without exposing the entire object
+contextBridge.exposeInMainWorld(
+    "api", {
+        send: (channel, data) => {
+            // whitelist channels
+            let validChannels = ["toMain"];
+            if (validChannels.includes(channel)) {
+                ipcRenderer.send(channel, data);
+            }
+        },
+        receive: (channel, func) => {
+            let validChannels = ["fromMain"];
+            if (validChannels.includes(channel)) {
+                // Deliberately strip event as it includes `sender` 
+                ipcRenderer.on(channel, (event, ...args) => func(...args));
+            }
+        }
+    }
+);