debont80
3536626a8a
Seven-tier security audit of the main process, each finding fixed with a
regression test. Typecheck (node + web) clean; unit tests 106 -> 140.
- Tier 1 (command exec/argv): allowlist the yt-dlp --update-to channel
(blocks arbitrary-binary-install RCE); gate per-download extraArgs behind
the customCommandEnabled consent flag in main (blocks --exec RCE); resolve
taskkill/schtasks by absolute System32 path; validate per-download
outputDir; normalize the URL in assertHttpUrl and use it at every spawn.
- Tier 2 (input validation): fix isSafeFilenameTemplate drive-relative
('C:foo') and Windows dotted-'..' traversal bypasses; percent-encode the
untrusted id in entryUrl; catch reserved device names with extensions in
sanitizeDirSegment.
- Tier 3 (fs/backup): drop malformed template rows in importBackup;
normalize deep-link URLs via assertHttpUrl.
- Tier 4 (cookies): confine the sign-in window's navigations/popups to web
URLs (recursively) and deny all web permissions on its session.
- Tier 5 (deep-link/argv): bound the .url file read to 64 KB; match the
aerofetch:// scheme case-insensitively.
- Tier 6 (Electron window): deny camera/mic/geolocation/USB/HID/serial/
Bluetooth permissions on the app window.
- Tier 7 (network/persistence): restrict the watched-source RSS fetch to
youtube.com feed URLs (SSRF guard); complete isValidSource validation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
33 lines
1.5 KiB
TypeScript
33 lines
1.5 KiB
TypeScript
/**
|
||
* Validate that a string is an http(s) URL and return it trimmed.
|
||
*
|
||
* This is the front-line guard against yt-dlp *argument injection*: the URL is
|
||
* passed to yt-dlp as a positional argv element, so a value beginning with `-`
|
||
* (e.g. `--config-locations=…`, `--load-info-json=…`, `--exec`) would be parsed
|
||
* as an OPTION rather than a URL — which can lead to arbitrary command
|
||
* execution. A string that `new URL()` accepts with an http/https protocol
|
||
* necessarily begins with its scheme, so it can never be read as an option.
|
||
* (Call sites also pass `--` before the positional URL as defence in depth.)
|
||
*
|
||
* Throws a user-friendly Error on anything that isn't an http(s) URL.
|
||
*
|
||
* Returns the parser-NORMALISED URL (`u.href`), not the raw input (audit F5).
|
||
* The WHATWG URL parser silently tolerates interior tab/newline characters and
|
||
* leading C0 control bytes (which `String.trim()` does not strip), so returning
|
||
* the raw string could hand a downstream consumer — argv, or the sign-in
|
||
* window's loadURL — a value subtly different from the one actually validated.
|
||
* Emitting `u.href` guarantees callers use exactly the URL that passed the check.
|
||
*/
|
||
export function assertHttpUrl(raw: string): string {
|
||
let u: URL
|
||
try {
|
||
u = new URL((raw ?? '').trim())
|
||
} catch {
|
||
throw new Error('That doesn’t look like a valid URL.')
|
||
}
|
||
if (u.protocol !== 'http:' && u.protocol !== 'https:') {
|
||
throw new Error('Only http and https links are supported.')
|
||
}
|
||
return u.href
|
||
}
|