xRangerDEandClaude Opus 4.7
32e0b1ab7d
Companion to 4.6.61. The open-file IPC handler (used by the "Open file" buttons in the queue + archive) was previously a plain shell.openPath call with only an existsSync check: if (typeof filePath !== "string" || !filePath) return false; if (!fs.existsSync(filePath)) return false; const result = await shell.openPath(filePath); shell.openPath happily launches any path the OS knows how to execute. An XSS landing through e.g. a smuggled queue item URL that reached the renderer-side openFile global function could pass `C:\\Windows\\System32\\calc.exe` and the IPC would launch calc. Added a deny-list of obvious shell-execution extensions (.exe, .bat, .cmd, .com, .ps1, .vbs, .vbe, .js, .jse, .wsf, .wsh, .scr, .msi, .msp, .lnk, .cpl, .reg, .hta, .jar, .application). Rejected calls log to debug + return false to the renderer. Media + text + image extensions remain unaffected — those open in their normal default-app viewers, which is the intended use case. show-in-folder + open-folder stay permissive on extension since they only open File Explorer (no execution). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>