Lock main window to the Sunburn origin #6

New issue

Closed

opened 2026-10-03 09:24:06 -04:00 by adam · 1 comment

adam commented

2026-10-03 09:24:06 -04:00

Owner

Problem: No setWindowOpenHandler / will-navigate guard, and the permission handler grants media/display-capture/notifications to any origin.

Impact: A link clicked in chat (or any navigation) opens a third-party site inside Electron, inheriting the preload bridge and auto-granted camera/mic/screen permissions.

Fix:

setWindowOpenHandler → shell.openExternal for non-Sunburn URLs, deny.
will-navigate → block anything outside https://chat.galactica.host.
Permission handler: check webContents.getURL() origin before granting.
Validate loadLastUrl() is on the Sunburn origin before loading.

Where: main.js:28-47

**Problem:** No `setWindowOpenHandler` / `will-navigate` guard, and the permission handler grants media/display-capture/notifications to any origin. **Impact:** A link clicked in chat (or any navigation) opens a third-party site inside Electron, inheriting the preload bridge and auto-granted camera/mic/screen permissions. **Fix:** - `setWindowOpenHandler` → `shell.openExternal` for non-Sunburn URLs, `deny`. - `will-navigate` → block anything outside `https://chat.galactica.host`. - Permission handler: check `webContents.getURL()` origin before granting. - Validate `loadLastUrl()` is on the Sunburn origin before loading. **Where:** `main.js:28-47`

adam added the

security

severity/high

labels

2026-10-03 09:24:06 -04:00

adam referenced this issue

2026-10-03 11:52:21 -04:00

Screen picker: remove nodeIntegration and script-injected data #11

adam referenced this issue from a pull request that will close it,

2026-10-03 11:54:51 -04:00

Lock main window to the Sunburn origin #13

adam referenced this issue from a commit