From 1b2dceffb409dbb1a31abafb7dcf445247687faa Mon Sep 17 00:00:00 2001 From: Benjamin Pasero Date: Thu, 23 Aug 2018 10:08:46 +0200 Subject: [PATCH] :lipstick: (more for https://electronjs.org/docs/tutorial/security) --- src/vs/code/electron-main/app.ts | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/src/vs/code/electron-main/app.ts b/src/vs/code/electron-main/app.ts index 1f1ab8d4ca7..d68fb99ae68 100644 --- a/src/vs/code/electron-main/app.ts +++ b/src/vs/code/electron-main/app.ts @@ -125,29 +125,22 @@ export class CodeApplication { } }); - const isValidWebviewSource = (source: string): boolean => { - if (!source) { - return false; - } - if (source === 'data:text/html;charset=utf-8,%3C%21DOCTYPE%20html%3E%0D%0A%3Chtml%20lang%3D%22en%22%20style%3D%22width%3A%20100%25%3B%20height%3A%20100%25%22%3E%0D%0A%3Chead%3E%0D%0A%09%3Ctitle%3EVirtual%20Document%3C%2Ftitle%3E%0D%0A%3C%2Fhead%3E%0D%0A%3Cbody%20style%3D%22margin%3A%200%3B%20overflow%3A%20hidden%3B%20width%3A%20100%25%3B%20height%3A%20100%25%22%3E%0D%0A%3C%2Fbody%3E%0D%0A%3C%2Fhtml%3E') { - return true; - } - const srcUri: any = URI.parse(source.toLowerCase()).toString(); - return srcUri.startsWith(URI.file(this.environmentService.appRoot.toLowerCase()).toString()); - }; - // Security related measures (https://electronjs.org/docs/tutorial/security) // DO NOT CHANGE without consulting the documentation app.on('web-contents-created', (event: any, contents) => { contents.on('will-attach-webview', (event: Electron.Event, webPreferences, params) => { + + // Ensure defaults delete webPreferences.preload; webPreferences.nodeIntegration = false; // Verify URLs being loaded - if (isValidWebviewSource(params.src) && isValidWebviewSource(webPreferences.preloadURL)) { + if (this.isValidWebviewSource(params.src) && this.isValidWebviewSource(webPreferences.preloadURL)) { return; } + delete webPreferences.preloadUrl; + // Otherwise prevent loading this.logService.error('webContents#web-contents-created: Prevented webview attach'); @@ -247,6 +240,20 @@ export class CodeApplication { }); } + private isValidWebviewSource(source: string): boolean { + if (!source) { + return false; + } + + if (source === 'data:text/html;charset=utf-8,%3C%21DOCTYPE%20html%3E%0D%0A%3Chtml%20lang%3D%22en%22%20style%3D%22width%3A%20100%25%3B%20height%3A%20100%25%22%3E%0D%0A%3Chead%3E%0D%0A%09%3Ctitle%3EVirtual%20Document%3C%2Ftitle%3E%0D%0A%3C%2Fhead%3E%0D%0A%3Cbody%20style%3D%22margin%3A%200%3B%20overflow%3A%20hidden%3B%20width%3A%20100%25%3B%20height%3A%20100%25%22%3E%0D%0A%3C%2Fbody%3E%0D%0A%3C%2Fhtml%3E') { + return true; + } + + const srcUri: any = URI.parse(source.toLowerCase()).toString(); + + return srcUri.startsWith(URI.file(this.environmentService.appRoot.toLowerCase()).toString()); + } + private onUnexpectedError(err: Error): void { if (err) {