Johannes Millan b361f86a91 fix: close remaining no-click NTLM image-load sinks (GHSA-hr87-735w-hfq3) ... A sweep for auto-loading subresource sinks fed attacker-controllable (synced) content found two more no-click NTLM vectors beyond the markdown/attachment images already gated: - READ_LOCAL_IMAGE_AS_DATA_URL (electron/local-file-sync.ts): a synced theme backgroundImage 'file://host/share/x.png' reaches this main-process handler, where fileURLToPath -> fs.stat/readFile on the resulting UNC path opens an SMB connection and leaks the NTLM hash — no click, just the theme being active. This is the most reliable variant (main-process fs, not a Chromium subresource). Guard with isPathSafeToOpen before any fs access. - note.imgUrl (note.component): a synced note image URL is bound directly to <img [src]>/[enlargeImg] and auto-loads on render. Gate at the setter so only a safe URL reaches the bindings. Both reuse the existing isPathSafeToOpen helper; local file://, http(s), data: and blob: are unaffected. New electron test proves stat/readFile are never reached for UNC / remote file:// input. (cherry picked from commit 80a3c20b3f5a3f535f5d04d7fd215ba569493ef8)		2026-06-09 19:07:15 +02:00
..
assets/icons	fix: wrong icon for kde title bar	2025-07-22 20:42:28 +02:00
ipc-handlers	fix(electron): validate URL scheme before shell.openExternal/openPath (GHSA-hr87-735w-hfq3) (#8210)	2026-06-09 17:29:18 +02:00
scripts	refactor(electron): bundle preload script with esbuild to support sandbox mode	2026-03-22 19:38:21 +01:00
shared-with-frontend	fix(plugins): harden nodeExecution grants (#8205)	2026-06-09 18:16:41 +02:00
task-widget	Feat/task widget global shortcut (#7099)	2026-06-09 16:11:16 +02:00
wayland-idle-helper	Add ext-idle-notify backend for Wayland idle detection (#7337)	2026-04-24 16:50:24 +02:00
app-control.test.cjs	fix(electron): respect tray title settings #7823 (#8097)	2026-06-08 12:07:09 +02:00
backup.ts	fix(electron): restrict loadBackupData IPC to the backup directory (#8206)	2026-06-09 15:29:06 +02:00
clear-stale-idb-locks.ts	Feat/to me it looks like there are lots of 60dd04 (#7280)	2026-04-20 12:04:38 +02:00
clipboard-image-handler.test.cjs	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
clipboard-image-handler.ts	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
common.const.ts	chore: update electron to v41.x (#7097)	2026-04-17 18:12:43 +02:00
CONFIG.ts	Increase ping interval and idle time in order to not waste CPU cycles. (#6227)	2026-01-28 15:37:50 +01:00
debug.ts	refactor: rename overlay-indicator to task-widget	2026-03-30 22:00:47 +02:00
electronAPI.d.ts	fix(plugins): harden nodeExecution grants (#8205)	2026-06-09 18:16:41 +02:00
error-handler-with-frontend-inform.ts	fix(error-handling): prevent [object Object] from appearing in error messages	2026-01-02 15:40:14 +01:00
file-path-guard.test.cjs	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
file-path-guard.ts	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
full-screen-blocker.ts	fix(security): harden XSS sinks and add Origin check (#7413)	2026-05-06 21:37:06 +02:00
gpu-startup-guard.ts	fix(electron): add GPU startup guard for confined Linux packages	2026-04-20 18:35:31 +02:00
idle-time-handler.ts	fix(electron): retry Wayland idle helper startup (#7527)	2026-05-10 22:35:33 +02:00
indicator.test.cjs	fix(electron): respect tray title settings #7823 (#8097)	2026-06-08 12:07:09 +02:00
indicator.ts	fix(electron): respect tray title settings #7823 (#8097)	2026-06-08 12:07:09 +02:00
ipc-handler-wrapper.test.cjs	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
ipc-handler-wrapper.ts	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
ipc-handler.ts	feat(electron): add Local REST API for desktop automation (#6981)	2026-03-28 13:35:04 +01:00
jira.ts	fix(jira): honor no_proxy for electron requests #6324 (#8177)	2026-06-09 15:00:43 +02:00
local-file-sync-ntlm.test.cjs	fix: close remaining no-click NTLM image-load sinks (GHSA-hr87-735w-hfq3)	2026-06-09 19:07:15 +02:00
local-file-sync.test.cjs	fix(security): restrict renderer-supplied filesystem IPC paths (#8223)	2026-06-09 18:16:22 +02:00
local-file-sync.ts	fix: close remaining no-click NTLM image-load sinks (GHSA-hr87-735w-hfq3)	2026-06-09 19:07:15 +02:00
local-rest-api.ts	fix(security): harden XSS sinks and add Origin check (#7413)	2026-05-06 21:37:06 +02:00
lockscreen.ts	fix(electron): restore macOS lock screen by correcting osascript quoting	2026-04-16 19:47:52 +02:00
main-window.ts	fix(electron): validate URL scheme before shell.openExternal/openPath (GHSA-hr87-735w-hfq3) (#8210)	2026-06-09 17:29:18 +02:00
main.ts	fix(electron): improve protocol URL handling and register URL scheme on Linux	2026-03-05 16:45:05 +01:00
plugin-node-executor.test.cjs	fix(plugins): harden nodeExecution grants (#8205)	2026-06-09 18:16:41 +02:00
plugin-node-executor.ts	fix(plugins): harden nodeExecution grants (#8205)	2026-06-09 18:16:41 +02:00
plugin-oauth.ts	Improve OAuth error handling and reporting (#7445)	2026-05-01 18:45:11 +02:00
preload.ts	fix(plugins): harden nodeExecution grants (#8205)	2026-06-09 18:16:41 +02:00
protocol-handler.ts	feat(sync): add OneDrive sync provider with PKCE auth (#7523)	2026-05-26 15:31:06 +02:00
proxy-agent.test.cjs	fix(jira): honor no_proxy for electron requests #6324 (#8177)	2026-06-09 15:00:43 +02:00
proxy-agent.ts	fix(jira): honor no_proxy for electron requests #6324 (#8177)	2026-06-09 15:00:43 +02:00
shared-state.ts	fix: refactor tray handling to use shared state for task and countdown visibility	2025-11-28 18:53:00 +01:00
simple-store.test.cjs	fix(electron): harden simple store writes (#7297)	2026-04-21 15:03:30 +02:00
simple-store.ts	fix(electron): harden simple store writes (#7297)	2026-04-21 15:03:30 +02:00
start-app.ts	fix(macOS): gracefully quit app (#7733)	2026-05-27 17:13:43 +02:00
task-widget.test.cjs	Feat/task widget global shortcut (#7099)	2026-06-09 16:11:16 +02:00
tsconfig.electron.json	feat(sync): add OneDrive sync provider with PKCE auth (#7523)	2026-05-26 15:31:06 +02:00
various-shared.ts	Feat/task widget global shortcut (#7099)	2026-06-09 16:11:16 +02:00