super-productivity/electron/electronAPI.d.ts
Johannes Millan 4a99e7e505
fix(security): stored XSS → RCE chain — note image, plugin nodeExecution, CSP (GHSA-78rv-m663-4fph) (#8178)
* fix(ui): prevent stored XSS in enlarge-img directive

The enlarged-image element was built by interpolating the image URL into an innerHTML string, so a crafted synced/imported note.imgUrl could break out of the src attribute and inject an event handler (stored DOM-XSS). Build the <img> with createElement and property assignment instead, so the URL is never parsed as HTML. Adds a regression spec.

Refs: GHSA-78rv-m663-4fph

* fix(plugins): authorize nodeExecution from main-process state

The Electron main process authorized Node execution from the manifest the renderer passes on each IPC call, and window.ea.pluginExecNodeScript is callable by any renderer code — so injected renderer JS could forge {permissions:['nodeExecution']} and run arbitrary Node (CWE-501).

The main process now keeps its own grantedPlugins set, populated via a dedicated PLUGIN_SET_NODE_CONSENT channel. The renderer registers a grant in _fireOnReady (before the first node call, covering every load path including zip upload) and revokes it on teardown. The executor requires set membership.

Defense in depth, not a hard boundary: the registration channel is itself renderer-reachable, so a fully-compromised renderer could register a grant itself. It blocks the disclosed PoC (forged manifest for a never-loaded plugin) and removes per-call manifest trust. A hard boundary needs a main-process consent dialog.

Refs: GHSA-78rv-m663-4fph

* fix(security): add object-src 'none' and document CSP constraints

Adds object-src 'none' (the app embeds no <object>/<embed>) and replaces the stale TODO with an accurate note on why 'unsafe-eval'/'unsafe-inline' cannot be dropped yet: the plugin runtime and the inline bootstrap script use new Function, and the packaged app loads the renderer over file:// (opaque origin), so tightening script-src to 'self' is unreliable.

Refs: GHSA-78rv-m663-4fph
2026-06-08 20:20:17 +02:00

249 lines
6.2 KiB
TypeScript

import { IpcRendererEvent } from 'electron';
import {
GlobalConfigState,
TakeABreakConfig,
TaskWidgetConfig,
} from '../src/app/features/config/global-config.model';
import { KeyboardConfig } from '../src/app/features/config/keyboard-config.model';
import { JiraCfg } from '../src/app/features/issue/providers/jira/jira.model';
import { AppDataCompleteLegacy } from '../src/app/imex/sync/sync.model';
import { Task } from '../src/app/features/tasks/task.model';
import { LocalBackupMeta } from '../src/app/imex/local-backup/local-backup.model';
import { AppDataComplete } from '../src/app/op-log/model/model-config';
import {
PluginNodeScriptRequest,
PluginNodeScriptResult,
PluginManifest,
} from '../packages/plugin-api/src/types';
import {
LocalRestApiRequestPayload,
LocalRestApiResponsePayload,
} from './shared-with-frontend/local-rest-api.model';
import { ElectronDistChannel } from './shared-with-frontend/get-dist-channel';
export interface ElectronAPI {
on(
channel: string,
listener: (event: IpcRendererEvent, ...args: unknown[]) => void,
): void;
// SYNC
// ----
getDistChannel(): ElectronDistChannel | null;
// INVOKE
// ------
getUserDataPath(): Promise<string>;
getBackupPath(): Promise<string>;
checkBackupAvailable(): Promise<false | LocalBackupMeta>;
loadBackupData(backupPath: string): Promise<string>;
fileSyncSave(args: {
filePath: string;
localRev: string | null;
dataStr: string;
}): Promise<string | Error>;
fileSyncLoad(args: {
filePath: string;
localRev: string | null;
}): Promise<{ rev: string; dataStr: string | undefined } | Error>;
fileSyncRemove(args: { filePath: string }): Promise<unknown | Error>;
fileSyncListFiles(args: { dirPath: string }): Promise<string[] | Error>;
checkDirExists(args: { dirPath: string }): Promise<true | Error>;
pickDirectory(): Promise<string | undefined>;
showOpenDialog(options: {
properties: string[];
title?: string;
defaultPath?: string;
filters?: { name: string; extensions: string[] }[];
}): Promise<string[] | undefined>;
toFileUrl(filePath: string): Promise<string>;
readLocalImageAsDataUrl(filePathOrUrl: string): Promise<string | null>;
// checkDirExists(dirPath: string): Promise<true | Error>;
// STANDARD
// --------
setZoomFactor(zoomFactor: number): void;
getZoomFactor(): number;
openPath(path: string): void;
openExternalUrl(url: string): void;
saveFileDialog(
filename: string,
data: string,
): Promise<{ success: boolean; path?: string }>;
shareNative(payload: {
text?: string;
url?: string;
title?: string;
files?: string[];
}): Promise<{ success: boolean; error?: string }>;
isLinux(): boolean;
isGnomeDesktop(): boolean;
isMacOS(): boolean;
isAppleSilicon(): boolean;
isSnap(): boolean;
isFlatpak(): boolean;
// CLIPBOARD IMAGES
// ----------------
saveClipboardImage(
basePath: string,
fileName: string,
base64Data: string,
mimeType: string,
): Promise<string>;
loadClipboardImage(
basePath: string,
imageId: string,
): Promise<{ base64: string; mimeType: string } | null>;
deleteClipboardImage(basePath: string, imageId: string): Promise<boolean>;
listClipboardImages(
basePath: string,
): Promise<{ id: string; mimeType: string; createdAt: number; size: number }[]>;
getClipboardImagePath(basePath: string, imageId: string): Promise<string | null>;
getClipboardFilePaths(): Promise<string[]>;
copyClipboardImageFile(
basePath: string,
filePath: string,
): Promise<{
id: string;
mimeType: string;
size: number;
createdAt: number;
} | null>;
readClipboardImage(basePath: string): Promise<{
id: string;
mimeType: string;
size: number;
createdAt: number;
} | null>;
getPathForFile(file: File): string | null;
// SEND
// ----
reloadMainWin(): void;
openDevTools(): void;
showEmojiPanel(): void;
relaunch(): void;
exit(exitCode: number): void;
shutdownNow(): void;
flashFrame(): void;
showOrFocus(): void;
lockScreen(): void;
informAboutAppReady(): void;
scheduleRegisterBeforeClose(id: string): void;
unscheduleRegisterBeforeClose(id: string): void;
setDoneRegisterBeforeClose(id: string): void;
setProgressBar(args: {
progress: number;
progressBarMode: 'normal' | 'pause' | 'none';
}): void;
sendAppSettingsToElectron(globalCfg: GlobalConfigState): void;
sendSettingsUpdate(globalCfg: GlobalConfigState): void;
updateTaskWidgetSettings(cfg: TaskWidgetConfig): void;
updateTitleBarDarkMode(isDarkMode: boolean): void;
registerGlobalShortcuts(keyboardConfig: KeyboardConfig): void;
showFullScreenBlocker(args: { msg?: string; takeABreakCfg: TakeABreakConfig }): void;
// TODO use invoke instead
makeJiraRequest(args: {
requestId: string;
url: string;
requestInit: RequestInit;
jiraCfg: JiraCfg;
}): void;
jiraSetupImgHeaders(args: { jiraCfg: JiraCfg }): void;
backupAppData(args: {
data: AppDataCompleteLegacy | AppDataComplete;
maxBackupFiles?: number | null;
}): void;
updateCurrentTask(
task: Task | null,
isPomodoroEnabled: boolean,
currentPomodoroSessionTime: number,
isFocusModeEnabled?: boolean,
currentFocusSessionTime?: number,
focusModeMode?: string,
);
updateTodayTasks(
tasks: { id: string; title: string; timeEstimate: number; timeSpent: number }[],
): void;
onSwitchTask(listener: (taskId: string) => void): void;
exec(command: string): void;
pluginExecNodeScript(
pluginId: string,
manifest: PluginManifest,
request: PluginNodeScriptRequest,
): Promise<PluginNodeScriptResult>;
// Register/revoke a plugin's nodeExecution grant with the main process so the
// executor authorizes from its own state, not the per-call manifest.
// See GHSA-78rv-m663-4fph.
pluginSetNodeConsent(pluginId: string, isGranted: boolean): Promise<void>;
// Plugin OAuth
pluginOAuthPrepare(): Promise<{ port: number }>;
pluginOAuthStart(url: string): void;
onPluginOAuthCb(
listener: (data: { code?: string; error?: string; state?: string }) => void,
): void;
onLocalRestApiRequest(listener: (payload: LocalRestApiRequestPayload) => void): void;
sendLocalRestApiResponse(payload: LocalRestApiResponsePayload): void;
}