debont80
3536626a8a
Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.
- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
(blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
taskkill/schtasks by absolute System32 path; validate per-download
outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
untrusted id in entryUrl; catch reserved device names with extensions in
sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
youtube.com feed URLs (SSRF guard); complete isValidSource validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
99 lines
3.9 KiB
TypeScript
99 lines
3.9 KiB
TypeScript
import { describe, it, expect, afterEach } from 'vitest'
|
|
import { mkdtempSync, writeFileSync, rmSync } from 'fs'
|
|
import { tmpdir } from 'os'
|
|
import { join } from 'path'
|
|
import { extractIncomingUrl } from '../src/main/deeplink'
|
|
|
|
const TARGET = 'https://www.youtube.com/watch?v=dQw4w9WgXcQ'
|
|
|
|
let dir: string | null = null
|
|
function urlFile(name: string, contents: string): string {
|
|
dir ??= mkdtempSync(join(tmpdir(), 'aerofetch-deeplink-'))
|
|
const path = join(dir, name)
|
|
writeFileSync(path, contents)
|
|
return path
|
|
}
|
|
|
|
afterEach(() => {
|
|
if (dir) rmSync(dir, { recursive: true, force: true })
|
|
dir = null
|
|
})
|
|
|
|
describe('extractIncomingUrl — aerofetch:// protocol', () => {
|
|
it('extracts the url= query param', () => {
|
|
const arg = `aerofetch://download?url=${encodeURIComponent(TARGET)}`
|
|
expect(extractIncomingUrl(['AeroFetch.exe', arg])).toBe(TARGET)
|
|
})
|
|
|
|
it('finds the protocol arg regardless of its position in argv', () => {
|
|
const arg = `aerofetch://download?url=${encodeURIComponent(TARGET)}`
|
|
expect(extractIncomingUrl(['AeroFetch.exe', '--some-flag', arg])).toBe(TARGET)
|
|
})
|
|
|
|
it('rejects a non-http(s) target (defence in depth)', () => {
|
|
const arg = `aerofetch://download?url=${encodeURIComponent('file:///C:/secrets.txt')}`
|
|
expect(extractIncomingUrl(['AeroFetch.exe', arg])).toBeNull()
|
|
})
|
|
|
|
it('ignores a malformed protocol invocation', () => {
|
|
expect(extractIncomingUrl(['AeroFetch.exe', 'aerofetch://'])).toBeNull()
|
|
})
|
|
|
|
it('returns null when there is no url= param', () => {
|
|
expect(extractIncomingUrl(['AeroFetch.exe', 'aerofetch://download'])).toBeNull()
|
|
})
|
|
|
|
it('normalises the target, stripping embedded control chars (audit T3 / F5)', () => {
|
|
// A tab spliced into the inner URL must not survive to the renderer banner.
|
|
const raw = 'https://www.youtube.com/watch?v=abc\tdef'
|
|
const arg = `aerofetch://download?url=${encodeURIComponent(raw)}`
|
|
expect(extractIncomingUrl(['AeroFetch.exe', arg])).toBe(
|
|
'https://www.youtube.com/watch?v=abcdef'
|
|
)
|
|
})
|
|
|
|
it('matches the aerofetch:// scheme case-insensitively (audit T5)', () => {
|
|
const arg = `AEROFETCH://download?url=${encodeURIComponent(TARGET)}`
|
|
expect(extractIncomingUrl(['AeroFetch.exe', arg])).toBe(TARGET)
|
|
})
|
|
})
|
|
|
|
describe('extractIncomingUrl — .url Internet Shortcut (Explorer "Send to")', () => {
|
|
it('reads the URL= line from a real .url file', () => {
|
|
const path = urlFile('Video.url', `[InternetShortcut]\r\nURL=${TARGET}\r\n`)
|
|
expect(extractIncomingUrl(['AeroFetch.exe', path])).toBe(TARGET)
|
|
})
|
|
|
|
it('rejects a .url file whose target is not http(s)', () => {
|
|
const path = urlFile('Local.url', '[InternetShortcut]\r\nURL=file:///C:/secrets.txt\r\n')
|
|
expect(extractIncomingUrl(['AeroFetch.exe', path])).toBeNull()
|
|
})
|
|
|
|
it('returns null for a .url path that does not exist on disk', () => {
|
|
expect(extractIncomingUrl(['AeroFetch.exe', 'C:\\nope\\Missing.url'])).toBeNull()
|
|
})
|
|
|
|
it('ignores files that merely end in .url-like text but are not real paths', () => {
|
|
expect(extractIncomingUrl(['AeroFetch.exe', 'not-a-real-path.url'])).toBeNull()
|
|
})
|
|
|
|
it('reads a URL= line that falls within the 64 KB size cap (audit T5)', () => {
|
|
const junk = '; padding\r\n'.repeat(100) // ~1 KB of leading content
|
|
const path = urlFile('Small.url', `[InternetShortcut]\r\n${junk}URL=${TARGET}\r\n`)
|
|
expect(extractIncomingUrl(['AeroFetch.exe', path])).toBe(TARGET)
|
|
})
|
|
|
|
it('ignores a URL= line that falls past the 64 KB size cap (audit T5)', () => {
|
|
const junk = '; padding\r\n'.repeat(8000) // ~88 KB, beyond the read window
|
|
const path = urlFile('Huge.url', `[InternetShortcut]\r\n${junk}URL=${TARGET}\r\n`)
|
|
expect(extractIncomingUrl(['AeroFetch.exe', path])).toBeNull()
|
|
})
|
|
})
|
|
|
|
describe('extractIncomingUrl — no match', () => {
|
|
it('returns null for ordinary argv (e.g. plain launch)', () => {
|
|
expect(extractIncomingUrl(['AeroFetch.exe'])).toBeNull()
|
|
expect(extractIncomingUrl([])).toBeNull()
|
|
})
|
|
})
|