mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

docs: Use Node's URL parser in the 5th security recommendation (#33463)

Browse source 
Rule 13 recommends using Node's URL parser for handling url inputs. At
the moment, this is not being followed in the code example for rule 5,
which falls back on checking that the url ends with a '/'. If this was
forgotten when a user copies this code it could introduce security
vulnerabilities if an attacker uses an URL in the following way:

"https://example.com.attacker.com"

Using Node's URL parser fixes this potential missuse and enables the
'/' to be omited from the code example.

Co-authored-by: Baitinq <you@example.com>
This commit is contained in:
Baitinq 2022-03-28 18:25:44 +00:00 committed by GitHub
parent 3c30b59c3e
commit c4e3a1aad3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/tutorial/security.md
View file

@ -279,11 +279,12 @@ security-conscious developers might want to assume the very opposite.
```js title='main.js (Main Process)' ```js title='main.js (Main Process)'
const { session } = require('electron') const { session } = require('electron')
const URL = require('url').URL
session session
.fromPartition('some-partition') .fromPartition('some-partition')
.setPermissionRequestHandler((webContents, permission, callback) => { .setPermissionRequestHandler((webContents, permission, callback) => {
const url = webContents.getURL() const parsedUrl = new URL(webContents.getURL())
if (permission === 'notifications') { if (permission === 'notifications') {
// Approves the permissions request // Approves the permissions request
@ -291,7 +292,7 @@ session
} }
// Verify URL // Verify URL
if (!url.startsWith('https://example.com/')) { if (parsedUrl.protocol !== 'https:' || parsedUrl.host !== 'example.com') {
// Denies the permissions request // Denies the permissions request
return callback(false) return callback(false)
} }