plug a few electron-remote-related security holes.

Author: dbadb

_todo.md

@@ -27,6 +27,11 @@
 
 #### logging
 
+#### filesystem
+
+* eliminate dependency on electron remote module.
+* migrate filebrowser to html File, etc..
+
 #### drawing/rendering
 
 * custom mouse cursors

src/app/app.js

@@ -24,8 +24,6 @@ export default class ImguiApp
         this.runtime = (window.process && window.process.type) ? "electron" 
                         : (window.cordova) ? "cordova" : "browser";
         this.filesystem = new FileSystem(this.runtime);
-        this.fs = this.filesystem.fs;
-        this.path = this.filesystem.path;
         this.canvas = document.getElementById("AppCanvas");
         if(!this.canvas)
         {

src/app/filesystem.js

@@ -48,9 +48,15 @@ export class FileSystem
         if(runtime == "electron")
         {
             // we use window.require to trick webpack for electron
+            /* we don't want to use remote package since it's 
+             * deprecated.
+             */
+
+            /*
             let remote = window.require("electron").remote;
             this.fs = remote.require("fs");
             this.path = window.require("path"); 
+            */
             this.isWindows = navigator && 
                             (navigator.platform.indexOf("Win32") != -1);
         }