title: Would it be safe to enable nodeIntegration in Electron on a local page that is packaged with the app?
body: <p>I am stuck when creating custom window controls like close, min/max and restore with nodeIntegration turned off. I created the buttons in my renderer's local html file</p>
  
  <blockquote>
    <p>main.js</p>
  </blockquote>
  
  <pre><code>mainWindow = new BrowserWindow({
      x, y, width, height,
      frame: false,
      show: false,
      webPreferences: { devTools: true }
  });
  
  mainWindow.loadURL(url.format({
      protocol: 'file:',
      slashes: true,
      pathname: path.join(__dirname, 'assets', 'index.html')
  }));
  </code></pre>
  
  <blockquote>
    <p>index.html</p>
  </blockquote>
  
  <pre><code>&lt;div id='minimize' class='noSelect'&gt;&amp;#xE921;&lt;/div&gt;
  &lt;div id='maximize' class='noSelect'&gt;&amp;#xE922;&lt;/div&gt;
  &lt;div id='restore' class='noSelect'&gt;&amp;#xE923;&lt;/div&gt;
  &lt;div id='close' class='noSelect'&gt;&amp;#xE8BB;&lt;/div&gt;
  
  &lt;script type='text/javascript' src='../assets/js/index.js'&gt;&lt;/script&gt;
  </code></pre>
  
  <p>By default, nodeIntegration is off so <code>index.js</code> has no access to Node. However, I need to be able to add functionality to the buttons to close, min/max and restore the window.</p>
  
  <blockquote>
    <p>index.js</p>
  </blockquote>
  
  <pre><code>const { remote } = require('electron');
  const mainWindow = remote.getCurrentWindow();
  
  document.getElementById('close').addEventListener('click', () =&gt; {
    mainWindow.close();
  });
  </code></pre>
  
  <p>This wouldn't work because of nodeIntegration being disabled. Is it safe to have it enabled in a local page? If not, what is a safe way of doing this?</p>