security: harden command exec, IPC, deep-link, cookies, and persistence

Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.

- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
  (blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
  the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
  taskkill/schtasks by absolute System32 path; validate per-download
  outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
  ('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
  untrusted id in entryUrl; catch reserved device names with extensions in
  sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
  normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
  URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
  aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
  Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
  youtube.com feed URLs (SSRF guard); complete isValidSource validation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/validation.ts

@@ -13,15 +13,21 @@ import type { HistoryEntry, ErrorLogEntry, CommandTemplate, Source, MediaItem }
 
 /**
  * A filenameTemplate is joined onto the output directory and handed to yt-dlp's
- * `-o`. Reject anything that could write outside that directory — an absolute
- * path, or any `..` path segment — so a malicious backup/settings write can't
- * traverse out of the chosen folder (e.g. '%(title)s\..\..\win32.exe'). The
- * template still legitimately contains yt-dlp `%(field)s` tokens and `/` or `\`
- * for sub-folders, which are fine.
+ * `-o`. Reject anything that could write outside that directory so a malicious
+ * backup/settings write can't traverse out of the chosen folder (e.g.
+ * '%(title)s\..\..\win32.exe'). Legitimate templates still contain yt-dlp
+ * `%(field)s` tokens and `/` or `\` for sub-folders, which are fine.
+ *
+ * Two Windows-specific bypasses are guarded beyond the obvious cases (audit T1):
+ *  - drive-relative prefixes like 'C:foo' — `path.isAbsolute` returns FALSE for
+ *    these, yet they escape the output dir, so a leading drive letter is rejected.
+ *  - a '..' segment dressed up with trailing dots/spaces ('.. ', '.. .') —
+ *    Windows silently trims those, so an exact `=== '..'` check would miss them.
  */
+const TRAVERSAL_SEGMENT = /^[. ]*\.\.[. ]*$/
 export function isSafeFilenameTemplate(template: string): boolean {
-  if (isAbsolute(template)) return false
-  return !template.split(/[\\/]/).some((segment) => segment === '..')
+  if (isAbsolute(template) || /^[a-zA-Z]:/.test(template)) return false
+  return !template.split(/[\\/]/).some((segment) => TRAVERSAL_SEGMENT.test(segment))
 }
 
 /** An output directory must be an absolute path ('' resolves to OS Downloads). */
@@ -88,6 +94,10 @@ export function isValidSource(o: unknown): o is Source {
     typeof s.addedAt === 'number' &&
     typeof s.itemCount === 'number' &&
     isOptionalString(s.channel) &&
+    // feedUrl drives a network fetch in the sync, so validate its shape here too
+    // (audit T7); the host is additionally restricted at the fetch boundary.
+    isOptionalString(s.feedUrl) &&
+    (s.watched === undefined || typeof s.watched === 'boolean') &&
     (s.lastIndexedAt === undefined || typeof s.lastIndexedAt === 'number')
   )
 }