github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-01-10 07:58:08 -05:00
Code Issues Packages Projects Releases Wiki Activity

docs: Use Node's URL parser in the 5th security recommendation (#33463)

Browse Source 
Rule 13 recommends using Node's URL parser for handling url inputs. At
the moment, this is not being followed in the code example for rule 5,
which falls back on checking that the url ends with a '/'. If this was
forgotten when a user copies this code it could introduce security
vulnerabilities if an attacker uses an URL in the following way:

"https://example.com.attacker.com"

Using Node's URL parser fixes this potential missuse and enables the
'/' to be omited from the code example.

Co-authored-by: Baitinq <you@example.com>
This commit is contained in:
Baitinq
2022-03-28 18:25:44 +00:00
committed by GitHub
parent 3c30b59c3e
commit c4e3a1aad3
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/tutorial/security.md
View File

@@ -279,11 +279,12 @@ security-conscious developers might want to assume the very opposite.
```js title='main.js (Main Process)'
const { session } = require('electron')
const URL = require('url').URL
session
.fromPartition('some-partition')
.setPermissionRequestHandler((webContents, permission, callback) => {
const url = webContents.getURL()
const parsedUrl = new URL(webContents.getURL())
if (permission === 'notifications') {
// Approves the permissions request
@@ -291,7 +292,7 @@ session
}
// Verify URL
if (!url.startsWith('https://example.com/')) {
if (parsedUrl.protocol !== 'https:' || parsedUrl.host !== 'example.com') {
// Denies the permissions request
return callback(false)
}