rules-electron

RISK: contextBridge.exposeInMainWorld that hands the page the raw ipcRenderer, require, or a passthrough send(channel,...) lets the renderer invoke ANY IPC channel or Node module — it defeats the whole point of the bridge (CWE-749, Electron checklist #3). FIX: expose a small fixed object of named methods, each hard-coding its channel (e.g. getRules: () => ipcRenderer.invoke('rules:list')); never forward an attacker-chosen channel name or expose require/process.

RISK: contextIsolation:false runs the preload and the loaded page in the same JS context, so a malicious page can reach into your privileged preload objects and Electron internals (CWE-1188, Electron checklist #3). FIX: keep contextIsolation:true (default since Electron 12) and pass APIs across the boundary only via contextBridge.exposeInMainWorld.

RISK: webContents.executeJavaScript with a template literal or string-concatenated value injects untrusted data straight into the page's JS engine — classic script injection / XSS-to-RCE (CWE-95 eval injection). FIX: never build the script from runtime data; pass data into the page via a preload contextBridge method or postMessage and run a static, pre-written script.

RISK: allowRunningInsecureContent:true lets an https page pull scripts over plain http, giving a network MITM script-injection into your renderer (CWE-311, Electron checklist #7). FIX: remove the flag (defaults to false) and load every sub-resource over https or a bundled local protocol.

RISK: webPreferences nodeIntegration:true exposes Node's require/child_process/fs to the renderer; any XSS or compromised remote page becomes full host RCE (CWE-94, Electron security checklist #2). FIX: keep nodeIntegration:false (the default) and surface only the specific calls the UI needs through a contextBridge allow-list in a preload script.

RISK: the remote module (enableRemoteModule:true / @electron/remote) hands the renderer live references to main-process objects like app, BrowserWindow, and child_process — a compromised page calls them directly for RCE (CVE-2018-1000136 class, removed from core in Electron 14). FIX: delete the remote module; expose only the exact operations the UI needs via a typed IPC/RPC channel (e.g. BrowserView.defineRPC) validated in the main process.

RISK: shell.openExternal/openPath (and Electrobun Utils.openExternal/openPath) hand the string to the OS shell handler — an unvalidated value enables command/URL injection and dangerous schemes like file:, smb:, javascript:, or a crafted ms-msdt: payload (CWE-78, CVE-2018-1000006 / Follina-class). FIX: pass only string literals you control; for dynamic values parse with new URL() and allow only http:/https:/mailto: (and a vetted path root for openPath) before calling.

RISK: webSecurity:false turns off the same-origin policy and lets any page read cross-origin responses and load file:// resources, defeating CSP and enabling credential theft (CWE-942, Electron checklist #5). FIX: never disable webSecurity; serve local assets from a custom protocol and request remote APIs through fetch with explicit CORS.

RISK: remote.require() pulls a main-process module into the renderer through the deprecated remote bridge — it both leaks privileged APIs to the page and was removed from Electron core in v14 (Electron checklist #15). FIX: replace it with a dedicated ipcRenderer.invoke / contextBridge call whose main-side handler does the work and returns only serializable data.

RISK: a CSP that allows 'unsafe-eval', 'unsafe-inline' for script-src, or a wildcard script-src lets injected markup execute, removing the last line of defence against renderer XSS in a privileged Electron window (CWE-1021, Electron checklist #6). FIX: ship a strict CSP — default-src 'none'; script-src 'self'; no 'unsafe-eval'/'unsafe-inline'; use nonces/hashes for any inline script and bundle eval-free code.

RISK: an ipcMain.handle/on handler that feeds a renderer-supplied argument into fs.* or child_process treats the (untrusted) renderer as authoritative — a compromised page reads/overwrites arbitrary files or runs commands (CWE-20/CWE-78, Electron checklist #2 IPC validation). FIX: validate and canonicalise every argument in the handler — assert the sender frame, allow-list the operation, resolve paths under a fixed base dir and reject '..'/absolute escapes, and never pass renderer input to a shell.

RISK: loadURL/loadFile pointed at a remote http(s) origin runs third-party, network-controlled HTML inside your app's privileged window; a server compromise or MITM becomes code in your renderer (Electron checklist #1 — only load content you control). NOTE: SigmaShake Desktop loads only http://127.0.0.1:<port> (the local ssg dashboard), which is fine. FIX: bundle the UI and load it from a local file/custom protocol, or pin a single first-party https origin behind webSecurity + a strict CSP and a will-navigate allow-list.

RISK: a BrowserWindow with no will-navigate or setWindowOpenHandler guard lets in-page links/redirects navigate the privileged window to an attacker origin or spawn arbitrary child windows (Electron checklist #12/#13, CWE-601 open redirect). FIX: add webContents.on('will-navigate', (e,url) => { if (!isAllowed(url)) e.preventDefault(); }) and setWindowOpenHandler(({url}) => isAllowed(url) ? {action:'allow'} : {action:'deny'}) with a first-party allow-list.

RISK: sandbox:false drops the OS-level renderer sandbox, so a renderer-side memory bug or supply-chain script reaches the host directly (Electron checklist #4; cf. SigmaShake Desktop ships its dashboard window with sandbox:true). FIX: set sandbox:true on every BrowserWindow/webPreferences and move any Node work into the main process behind an IPC handler.