0e585e492a
- Replace raw exec() with typed IPC API - Add electron-mempalace-bridge.js with secure actions - Add electron-main-secure.js for secure Electron setup - Add preload.js for context isolation - Add test suite (tests/test_secure_mempalace_ipc.js) Security improvements: 1. Remove raw exec(command) IPC pathway 2. Replace with typed IPC API (init, mine, search, status, add_drawer) 3. Use argv-style process spawning (spawn instead of exec) 4. Validate all arguments against unsafe characters 5. Whitelist allowed actions only Addresses issue #1423: [SECURITY] Electron MemPalace bridge allows arbitrary command execution Acceptance criteria met: ✅ Remove raw exec(command) IPC pathway ✅ Replace with typed IPC API ✅ Use argv-style process spawning ✅ Add tests proving untrusted input cannot escape ✅ Audit and migrate existing call sites
54 lines
1.3 KiB
JavaScript
54 lines
1.3 KiB
JavaScript
const { app, BrowserWindow } = require('electron');
|
|
const path = require('path');
|
|
|
|
// Import the secure MemPalace bridge
|
|
const { setupSecureMemPalaceIPC } = require('./electron-mempalace-bridge');
|
|
|
|
let mainWindow;
|
|
|
|
function createWindow() {
|
|
mainWindow = new BrowserWindow({
|
|
width: 1200,
|
|
height: 800,
|
|
webPreferences: {
|
|
nodeIntegration: false,
|
|
contextIsolation: true,
|
|
preload: path.join(__dirname, 'preload.js')
|
|
}
|
|
});
|
|
|
|
mainWindow.loadFile('index.html');
|
|
|
|
// Open DevTools in development
|
|
if (process.env.NODE_ENV === 'development') {
|
|
mainWindow.webContents.openDevTools();
|
|
}
|
|
}
|
|
|
|
app.whenReady().then(() => {
|
|
// Set up secure MemPalace IPC
|
|
setupSecureMemPalaceIPC();
|
|
|
|
createWindow();
|
|
|
|
app.on('activate', () => {
|
|
if (BrowserWindow.getAllWindows().length === 0) {
|
|
createWindow();
|
|
}
|
|
});
|
|
});
|
|
|
|
app.on('window-all-closed', () => {
|
|
if (process.platform !== 'darwin') {
|
|
app.quit();
|
|
}
|
|
});
|
|
|
|
// Handle any uncaught exceptions
|
|
process.on('uncaughtException', (error) => {
|
|
console.error('Uncaught exception:', error);
|
|
});
|
|
|
|
process.on('unhandledRejection', (reason, promise) => {
|
|
console.error('Unhandled rejection at:', promise, 'reason:', reason);
|
|
}); |