mirror of
https://github.com/johannesjo/super-productivity.git
synced 2026-07-18 00:46:45 +00:00
* fix(ui): prevent stored XSS in enlarge-img directive
The enlarged-image element was built by interpolating the image URL into an innerHTML string, so a crafted synced/imported note.imgUrl could break out of the src attribute and inject an event handler (stored DOM-XSS). Build the <img> with createElement and property assignment instead, so the URL is never parsed as HTML. Adds a regression spec.
Refs: GHSA-78rv-m663-4fph
* fix(plugins): authorize nodeExecution from main-process state
The Electron main process authorized Node execution from the manifest the renderer passes on each IPC call, and window.ea.pluginExecNodeScript is callable by any renderer code — so injected renderer JS could forge {permissions:['nodeExecution']} and run arbitrary Node (CWE-501).
The main process now keeps its own grantedPlugins set, populated via a dedicated PLUGIN_SET_NODE_CONSENT channel. The renderer registers a grant in _fireOnReady (before the first node call, covering every load path including zip upload) and revokes it on teardown. The executor requires set membership.
Defense in depth, not a hard boundary: the registration channel is itself renderer-reachable, so a fully-compromised renderer could register a grant itself. It blocks the disclosed PoC (forged manifest for a never-loaded plugin) and removes per-call manifest trust. A hard boundary needs a main-process consent dialog.
Refs: GHSA-78rv-m663-4fph
* fix(security): add object-src 'none' and document CSP constraints
Adds object-src 'none' (the app embeds no <object>/<embed>) and replaces the stale TODO with an accurate note on why 'unsafe-eval'/'unsafe-inline' cannot be dropped yet: the plugin runtime and the inline bootstrap script use new Function, and the packaged app loads the renderer over file:// (opaque origin), so tightening script-src to 'self' is unreliable.
Refs: GHSA-78rv-m663-4fph
249 lines
6.2 KiB
TypeScript
249 lines
6.2 KiB
TypeScript
import { IpcRendererEvent } from 'electron';
|
|
import {
|
|
GlobalConfigState,
|
|
TakeABreakConfig,
|
|
TaskWidgetConfig,
|
|
} from '../src/app/features/config/global-config.model';
|
|
import { KeyboardConfig } from '../src/app/features/config/keyboard-config.model';
|
|
import { JiraCfg } from '../src/app/features/issue/providers/jira/jira.model';
|
|
import { AppDataCompleteLegacy } from '../src/app/imex/sync/sync.model';
|
|
import { Task } from '../src/app/features/tasks/task.model';
|
|
import { LocalBackupMeta } from '../src/app/imex/local-backup/local-backup.model';
|
|
import { AppDataComplete } from '../src/app/op-log/model/model-config';
|
|
import {
|
|
PluginNodeScriptRequest,
|
|
PluginNodeScriptResult,
|
|
PluginManifest,
|
|
} from '../packages/plugin-api/src/types';
|
|
import {
|
|
LocalRestApiRequestPayload,
|
|
LocalRestApiResponsePayload,
|
|
} from './shared-with-frontend/local-rest-api.model';
|
|
import { ElectronDistChannel } from './shared-with-frontend/get-dist-channel';
|
|
|
|
export interface ElectronAPI {
|
|
on(
|
|
channel: string,
|
|
listener: (event: IpcRendererEvent, ...args: unknown[]) => void,
|
|
): void;
|
|
|
|
// SYNC
|
|
// ----
|
|
getDistChannel(): ElectronDistChannel | null;
|
|
|
|
// INVOKE
|
|
// ------
|
|
getUserDataPath(): Promise<string>;
|
|
|
|
getBackupPath(): Promise<string>;
|
|
|
|
checkBackupAvailable(): Promise<false | LocalBackupMeta>;
|
|
|
|
loadBackupData(backupPath: string): Promise<string>;
|
|
|
|
fileSyncSave(args: {
|
|
filePath: string;
|
|
localRev: string | null;
|
|
dataStr: string;
|
|
}): Promise<string | Error>;
|
|
|
|
fileSyncLoad(args: {
|
|
filePath: string;
|
|
localRev: string | null;
|
|
}): Promise<{ rev: string; dataStr: string | undefined } | Error>;
|
|
|
|
fileSyncRemove(args: { filePath: string }): Promise<unknown | Error>;
|
|
|
|
fileSyncListFiles(args: { dirPath: string }): Promise<string[] | Error>;
|
|
|
|
checkDirExists(args: { dirPath: string }): Promise<true | Error>;
|
|
|
|
pickDirectory(): Promise<string | undefined>;
|
|
|
|
showOpenDialog(options: {
|
|
properties: string[];
|
|
title?: string;
|
|
defaultPath?: string;
|
|
filters?: { name: string; extensions: string[] }[];
|
|
}): Promise<string[] | undefined>;
|
|
|
|
toFileUrl(filePath: string): Promise<string>;
|
|
|
|
readLocalImageAsDataUrl(filePathOrUrl: string): Promise<string | null>;
|
|
|
|
// checkDirExists(dirPath: string): Promise<true | Error>;
|
|
|
|
// STANDARD
|
|
// --------
|
|
setZoomFactor(zoomFactor: number): void;
|
|
|
|
getZoomFactor(): number;
|
|
|
|
openPath(path: string): void;
|
|
|
|
openExternalUrl(url: string): void;
|
|
|
|
saveFileDialog(
|
|
filename: string,
|
|
data: string,
|
|
): Promise<{ success: boolean; path?: string }>;
|
|
|
|
shareNative(payload: {
|
|
text?: string;
|
|
url?: string;
|
|
title?: string;
|
|
files?: string[];
|
|
}): Promise<{ success: boolean; error?: string }>;
|
|
|
|
isLinux(): boolean;
|
|
|
|
isGnomeDesktop(): boolean;
|
|
|
|
isMacOS(): boolean;
|
|
|
|
isAppleSilicon(): boolean;
|
|
|
|
isSnap(): boolean;
|
|
|
|
isFlatpak(): boolean;
|
|
|
|
// CLIPBOARD IMAGES
|
|
// ----------------
|
|
saveClipboardImage(
|
|
basePath: string,
|
|
fileName: string,
|
|
base64Data: string,
|
|
mimeType: string,
|
|
): Promise<string>;
|
|
|
|
loadClipboardImage(
|
|
basePath: string,
|
|
imageId: string,
|
|
): Promise<{ base64: string; mimeType: string } | null>;
|
|
|
|
deleteClipboardImage(basePath: string, imageId: string): Promise<boolean>;
|
|
|
|
listClipboardImages(
|
|
basePath: string,
|
|
): Promise<{ id: string; mimeType: string; createdAt: number; size: number }[]>;
|
|
|
|
getClipboardImagePath(basePath: string, imageId: string): Promise<string | null>;
|
|
|
|
getClipboardFilePaths(): Promise<string[]>;
|
|
copyClipboardImageFile(
|
|
basePath: string,
|
|
filePath: string,
|
|
): Promise<{
|
|
id: string;
|
|
mimeType: string;
|
|
size: number;
|
|
createdAt: number;
|
|
} | null>;
|
|
|
|
readClipboardImage(basePath: string): Promise<{
|
|
id: string;
|
|
mimeType: string;
|
|
size: number;
|
|
createdAt: number;
|
|
} | null>;
|
|
|
|
getPathForFile(file: File): string | null;
|
|
|
|
// SEND
|
|
// ----
|
|
reloadMainWin(): void;
|
|
|
|
openDevTools(): void;
|
|
|
|
showEmojiPanel(): void;
|
|
|
|
relaunch(): void;
|
|
|
|
exit(exitCode: number): void;
|
|
|
|
shutdownNow(): void;
|
|
|
|
flashFrame(): void;
|
|
|
|
showOrFocus(): void;
|
|
|
|
lockScreen(): void;
|
|
|
|
informAboutAppReady(): void;
|
|
|
|
scheduleRegisterBeforeClose(id: string): void;
|
|
|
|
unscheduleRegisterBeforeClose(id: string): void;
|
|
|
|
setDoneRegisterBeforeClose(id: string): void;
|
|
|
|
setProgressBar(args: {
|
|
progress: number;
|
|
progressBarMode: 'normal' | 'pause' | 'none';
|
|
}): void;
|
|
|
|
sendAppSettingsToElectron(globalCfg: GlobalConfigState): void;
|
|
|
|
sendSettingsUpdate(globalCfg: GlobalConfigState): void;
|
|
|
|
updateTaskWidgetSettings(cfg: TaskWidgetConfig): void;
|
|
|
|
updateTitleBarDarkMode(isDarkMode: boolean): void;
|
|
|
|
registerGlobalShortcuts(keyboardConfig: KeyboardConfig): void;
|
|
|
|
showFullScreenBlocker(args: { msg?: string; takeABreakCfg: TakeABreakConfig }): void;
|
|
|
|
// TODO use invoke instead
|
|
makeJiraRequest(args: {
|
|
requestId: string;
|
|
url: string;
|
|
requestInit: RequestInit;
|
|
jiraCfg: JiraCfg;
|
|
}): void;
|
|
|
|
jiraSetupImgHeaders(args: { jiraCfg: JiraCfg }): void;
|
|
|
|
backupAppData(args: {
|
|
data: AppDataCompleteLegacy | AppDataComplete;
|
|
maxBackupFiles?: number | null;
|
|
}): void;
|
|
|
|
updateCurrentTask(
|
|
task: Task | null,
|
|
isPomodoroEnabled: boolean,
|
|
currentPomodoroSessionTime: number,
|
|
isFocusModeEnabled?: boolean,
|
|
currentFocusSessionTime?: number,
|
|
focusModeMode?: string,
|
|
);
|
|
|
|
updateTodayTasks(
|
|
tasks: { id: string; title: string; timeEstimate: number; timeSpent: number }[],
|
|
): void;
|
|
|
|
onSwitchTask(listener: (taskId: string) => void): void;
|
|
|
|
exec(command: string): void;
|
|
|
|
pluginExecNodeScript(
|
|
pluginId: string,
|
|
manifest: PluginManifest,
|
|
request: PluginNodeScriptRequest,
|
|
): Promise<PluginNodeScriptResult>;
|
|
|
|
// Register/revoke a plugin's nodeExecution grant with the main process so the
|
|
// executor authorizes from its own state, not the per-call manifest.
|
|
// See GHSA-78rv-m663-4fph.
|
|
pluginSetNodeConsent(pluginId: string, isGranted: boolean): Promise<void>;
|
|
|
|
// Plugin OAuth
|
|
pluginOAuthPrepare(): Promise<{ port: number }>;
|
|
pluginOAuthStart(url: string): void;
|
|
onPluginOAuthCb(
|
|
listener: (data: { code?: string; error?: string; state?: string }) => void,
|
|
): void;
|
|
|
|
onLocalRestApiRequest(listener: (payload: LocalRestApiRequestPayload) => void): void;
|
|
sendLocalRestApiResponse(payload: LocalRestApiResponsePayload): void;
|
|
}
|