debont80
3536626a8a
Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.
- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
(blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
taskkill/schtasks by absolute System32 path; validate per-download
outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
untrusted id in entryUrl; catch reserved device names with extensions in
sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
youtube.com feed URLs (SSRF guard); complete isValidSource validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
95 lines
3.8 KiB
TypeScript
95 lines
3.8 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
||
import { assertHttpUrl } from '../src/main/url'
|
||
import { isAllowedLoginUrl } from '../src/main/cookies'
|
||
import { isYtdlpUpdateChannel } from '@shared/ipc'
|
||
|
||
// --- F5: assertHttpUrl — argument-injection guard + normalisation -----------
|
||
|
||
describe('assertHttpUrl (audit F5)', () => {
|
||
it('accepts http(s) URLs and returns the normalised href', () => {
|
||
expect(assertHttpUrl('https://www.youtube.com/watch?v=abc')).toBe(
|
||
'https://www.youtube.com/watch?v=abc'
|
||
)
|
||
// http with a bare host normalises to a trailing slash
|
||
expect(assertHttpUrl('http://example.com')).toBe('http://example.com/')
|
||
})
|
||
|
||
it('trims surrounding whitespace', () => {
|
||
expect(assertHttpUrl(' https://example.com/v ')).toBe('https://example.com/v')
|
||
})
|
||
|
||
it('strips interior tabs/newlines the URL parser tolerates (normalised output)', () => {
|
||
// Returning the raw input would leak these through to argv / loadURL.
|
||
expect(assertHttpUrl('https://exa\nmple.com/v')).toBe('https://example.com/v')
|
||
const out = assertHttpUrl('https://example.com/a\tb')
|
||
expect(out).not.toContain('\t')
|
||
expect(out).not.toContain('\n')
|
||
})
|
||
|
||
it('rejects non-http(s) protocols', () => {
|
||
expect(() => assertHttpUrl('file:///C:/Windows/system32')).toThrow()
|
||
expect(() => assertHttpUrl('javascript:alert(1)')).toThrow()
|
||
expect(() => assertHttpUrl('ftp://example.com/x')).toThrow()
|
||
expect(() => assertHttpUrl('aerofetch://download?url=x')).toThrow()
|
||
})
|
||
|
||
it('rejects unparseable input', () => {
|
||
expect(() => assertHttpUrl('not a url')).toThrow()
|
||
expect(() => assertHttpUrl('')).toThrow()
|
||
})
|
||
|
||
it('can never return a value that begins with "-" (would read as a yt-dlp flag)', () => {
|
||
// A leading '-' cannot start a valid URL scheme, so it always throws —
|
||
// the returned value therefore never opens with a dash.
|
||
expect(() => assertHttpUrl('-https://example.com')).toThrow()
|
||
})
|
||
})
|
||
|
||
// --- T4: isAllowedLoginUrl — sign-in window navigation confinement ----------
|
||
|
||
describe('isAllowedLoginUrl (audit T4)', () => {
|
||
it('allows http(s) and about:blank', () => {
|
||
expect(isAllowedLoginUrl('https://accounts.google.com/signin')).toBe(true)
|
||
expect(isAllowedLoginUrl('http://example.com/login')).toBe(true)
|
||
expect(isAllowedLoginUrl('about:blank')).toBe(true)
|
||
})
|
||
|
||
it('blocks file://, the app protocol, and other external URI schemes', () => {
|
||
expect(isAllowedLoginUrl('file:///C:/Windows/System32/calc.exe')).toBe(false)
|
||
expect(isAllowedLoginUrl('aerofetch://download?url=https://evil.test')).toBe(false)
|
||
expect(isAllowedLoginUrl('ms-settings:')).toBe(false)
|
||
expect(isAllowedLoginUrl('mailto:x@y.z')).toBe(false)
|
||
expect(isAllowedLoginUrl('javascript:alert(1)')).toBe(false)
|
||
})
|
||
|
||
it('blocks unparseable input', () => {
|
||
expect(isAllowedLoginUrl('not a url')).toBe(false)
|
||
expect(isAllowedLoginUrl('')).toBe(false)
|
||
})
|
||
})
|
||
|
||
// --- F1: isYtdlpUpdateChannel — --update-to allowlist -----------------------
|
||
|
||
describe('isYtdlpUpdateChannel (audit F1)', () => {
|
||
it('accepts the two supported channels', () => {
|
||
expect(isYtdlpUpdateChannel('stable')).toBe(true)
|
||
expect(isYtdlpUpdateChannel('nightly')).toBe(true)
|
||
})
|
||
|
||
it('rejects an arbitrary repository spec (the --update-to RCE vector)', () => {
|
||
expect(isYtdlpUpdateChannel('evil/yt-dlp@latest')).toBe(false)
|
||
expect(isYtdlpUpdateChannel('owner/repo')).toBe(false)
|
||
})
|
||
|
||
it('rejects other yt-dlp channels not on AeroFetch’s allowlist', () => {
|
||
expect(isYtdlpUpdateChannel('master')).toBe(false)
|
||
})
|
||
|
||
it('rejects non-string / empty values', () => {
|
||
expect(isYtdlpUpdateChannel('')).toBe(false)
|
||
expect(isYtdlpUpdateChannel(undefined)).toBe(false)
|
||
expect(isYtdlpUpdateChannel(null)).toBe(false)
|
||
expect(isYtdlpUpdateChannel(42)).toBe(false)
|
||
})
|
||
})
|