mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-07-17 16:37:43 +00:00
2b628a0a50
Pre-merge review of #8228 flagged four real items in the otherwise solid security boundary. All non-blocking; rolled into one pass: 1) IMAGE_PICK_AND_IMPORT was the only renderer-callable handler that threw raw Errors back across IPC. The FS handlers all funnel through createSafeIpcError, which strips e.stack so main-bundle paths can't leak via the renderer's error-handling. Switch IMAGE_PICK_AND_IMPORT to the same shape: returns Error on validation failure, null on user cancel, value on success. Renderer adapter uses `instanceof Error` (parity with fileSyncLoad et al). New test asserts the returned error has no path content and no stack. 2) The image picker button was not disabled while the IPC was in flight. A second click would queue a second IPC, opening a second dialog after the first resolves; because `replacesId` is computed from the form value at click time, the first import's id would never be GC'd. Add an `isPickerBusy` signal and bind the button's `disabled` to it. New spec asserts the second concurrent click is a no-op and the busy flag clears in the `finally`. 3) Stale comment in `local-file.model.ts` pointed at `electron/sync-folder-store.ts`, which doesn't exist (the storage was inlined into local-file-sync.ts in Phase 2.5). Update to describe the actual current shape and clarify that the field is read once on upgrade for the migration breadcrumb and never written from new code paths. 4) Image input placeholder advertised `file://` URLs as a valid input. Phase 4 removed the IPC that resolved them, so the placeholder was a footgun. Drop the `file://` half. 68/68 electron security tests; 8/8 formly-image-input karma; lint + tsc clean. |
||
|---|---|---|
| .. | ||
| assets/icons | ||
| ipc-handlers | ||
| scripts | ||
| shared-with-frontend | ||
| task-widget | ||
| wayland-idle-helper | ||
| app-control.test.cjs | ||
| backup.ts | ||
| clear-stale-idb-locks.ts | ||
| clipboard-image-handler.test.cjs | ||
| clipboard-image-handler.ts | ||
| common.const.ts | ||
| CONFIG.ts | ||
| debug.ts | ||
| electronAPI.d.ts | ||
| error-handler-with-frontend-inform.ts | ||
| file-path-guard.test.cjs | ||
| file-path-guard.ts | ||
| full-screen-blocker.ts | ||
| gpu-startup-guard.ts | ||
| idle-time-handler.ts | ||
| image-cache.test.cjs | ||
| image-cache.ts | ||
| indicator.test.cjs | ||
| indicator.ts | ||
| ipc-handler-wrapper.test.cjs | ||
| ipc-handler-wrapper.ts | ||
| ipc-handler.ts | ||
| jira.ts | ||
| local-file-sync.test.cjs | ||
| local-file-sync.ts | ||
| local-rest-api.ts | ||
| lockscreen.ts | ||
| main-window.ts | ||
| main.ts | ||
| plugin-node-executor.test.cjs | ||
| plugin-node-executor.ts | ||
| plugin-oauth.ts | ||
| preload.ts | ||
| protocol-handler.ts | ||
| proxy-agent.test.cjs | ||
| proxy-agent.ts | ||
| shared-state.ts | ||
| simple-store.test.cjs | ||
| simple-store.ts | ||
| start-app.ts | ||
| sync-path-resolver.test.cjs | ||
| sync-path-resolver.ts | ||
| task-widget.test.cjs | ||
| tsconfig.electron.json | ||
| various-shared.ts | ||