debont80
3536626a8a
Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.
- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
(blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
taskkill/schtasks by absolute System32 path; validate per-download
outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
untrusted id in entryUrl; catch reserved device names with extensions in
sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
youtube.com feed URLs (SSRF guard); complete isValidSource validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
50 lines
1.8 KiB
TypeScript
50 lines
1.8 KiB
TypeScript
import { app } from 'electron'
|
|
import { join } from 'path'
|
|
import { is } from '@electron-toolkit/utils'
|
|
|
|
/**
|
|
* Resolves the directory holding the bundled binaries (yt-dlp.exe, ffmpeg.exe).
|
|
*
|
|
* In dev they live in the repo at resources/bin/.
|
|
* In a packaged build, electron-builder's extraResources copies them to
|
|
* <resources>/bin (see electron-builder.yml), reachable via process.resourcesPath.
|
|
*/
|
|
export function getBinDir(): string {
|
|
return is.dev ? join(app.getAppPath(), 'resources', 'bin') : join(process.resourcesPath, 'bin')
|
|
}
|
|
|
|
export function getYtdlpPath(): string {
|
|
return join(getBinDir(), 'yt-dlp.exe')
|
|
}
|
|
|
|
export function getFfmpegPath(): string {
|
|
return join(getBinDir(), 'ffmpeg.exe')
|
|
}
|
|
|
|
/**
|
|
* yt-dlp finds ffprobe via --ffmpeg-location (the bin dir), so the app never
|
|
* spawns it directly — but it must be present, or duration-aware post-processing
|
|
* (SponsorBlock-remove, --force-keyframes-at-cuts, --split-chapters) fails. This
|
|
* accessor exists so startDownload can assert its presence up front.
|
|
*/
|
|
export function getFfprobePath(): string {
|
|
return join(getBinDir(), 'ffprobe.exe')
|
|
}
|
|
|
|
/** Optional bundled external downloader; absent unless dropped into resources/bin. */
|
|
export function getAria2cPath(): string {
|
|
return join(getBinDir(), 'aria2c.exe')
|
|
}
|
|
|
|
/**
|
|
* Absolute path to a Windows system executable (e.g. taskkill.exe, schtasks.exe).
|
|
*
|
|
* SECURITY (audit F3): system tools are resolved by full path under System32
|
|
* rather than by bare name, so a same-named binary planted in the current
|
|
* working directory or earlier on PATH can't be invoked in their place — a real
|
|
* risk for the portable build, which runs from user-writable locations.
|
|
*/
|
|
export function getSystem32Path(exe: string): string {
|
|
return join(process.env.SystemRoot || 'C:\\Windows', 'System32', exe)
|
|
}
|