Administrator/Multi-Debrid-Downloader
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 596 Wiki Activity

Harden Electron trust boundaries

Browse Source 
Add centralized browser security helpers for restrictive BrowserWindow profiles, navigation denial, popup denial, permission denial, and exact HTTPS host allowlists. Apply those policies to the main renderer window and to the Real-Debrid and AllDebrid browser-login windows without weakening the credential renderer boundary.

Add shared IPC sender validation for renderer handlers so development accepts only the local Vite origin and non-development accepts only the built file renderer tree. Route the registered renderer IPC handlers through the shared guard and restrict app:open-external to the same exact HTTPS allowlist.

Cover the hardening with focused red-green tests for untrusted navigation, popup handling, permission requests, exact host/subdomain matching, packaged file renderer boundaries, untrusted IPC senders, and both browser-login window profiles.
This commit is contained in:
Sucukdeluxe
2026-08-12 00:30:49 +02:00
parent bfb901903d
commit 265498d629
9 changed files with 765 additions and 165 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/all-debrid-web.ts
+10 -9
View File
@@ -1,7 +1,8 @@
import { BrowserWindow, session } from "electron";
import { AllDebridHostInfo } from "../shared/types";
import { UnrestrictedLink } from "./realdebrid";
import { filenameFromUrl, sleep } from "./utils";
import { AllDebridHostInfo } from "../shared/types";
import { UnrestrictedLink } from "./realdebrid";
import { filenameFromUrl, sleep } from "./utils";
import { ALLDEBRID_LOGIN_HOSTS, applyRemoteLoginSecurity, createRemoteLoginWebPreferences } from "./browser-security";
const ALLDEBRID_BASE_URL = "https://alldebrid.com";
const ALLDEBRID_LOGIN_URL = `${ALLDEBRID_BASE_URL}/register/?from=de`;
@@ -302,12 +303,12 @@ export class AllDebridWebFallback {
minHeight: 760,
autoHideMenuBar: true,
title: "AllDebrid Web-Login",
webPreferences: {
partition,
contextIsolation: true,
nodeIntegration: false
}
});
webPreferences: createRemoteLoginWebPreferences(partition)
});
applyRemoteLoginSecurity(window, {
providerHosts: ALLDEBRID_LOGIN_HOSTS,
externalHosts: ALLDEBRID_LOGIN_HOSTS
});
window.setMenuBarVisibility(false);
window.on("closed", () => {
if (this.loginWindow === window) {