Screen picker: remove nodeIntegration and script-injected data #7

New issue

Closed

opened 2026-10-03 09:24:07 -04:00 by adam · 1 comment

adam commented

2026-10-03 09:24:07 -04:00

Owner

Problem: The picker window runs with nodeIntegration: true, contextIsolation: false, and source names (window titles) are interpolated into a <script> via JSON.stringify, which does not escape </script>.

Impact: Any window title — e.g. a browser tab whose page sets <title></script><script>require('child_process')… — breaks out of the script block when the picker opens → arbitrary code execution.

Fix:

contextIsolation: true, nodeIntegration: false, small preload exposing select/cancel/listAudio.
Pass sources over IPC (or loadFile + postMessage) instead of string-templating into the HTML.
Delete dead showAudioOnlyPicker (also builds innerHTML from app names).
Remove ipcMain.once('picker-select'|'picker-cancel') leftovers when the window closes (they accumulate per open).

Where: src/picker.js

**Problem:** The picker window runs with `nodeIntegration: true, contextIsolation: false`, and source names (window titles) are interpolated into a `<script>` via `JSON.stringify`, which does not escape `</script>`. **Impact:** Any window title — e.g. a browser tab whose page sets `<title></script><script>require('child_process')…` — breaks out of the script block when the picker opens → arbitrary code execution. **Fix:** - `contextIsolation: true`, `nodeIntegration: false`, small preload exposing `select/cancel/listAudio`. - Pass sources over IPC (or `loadFile` + `postMessage`) instead of string-templating into the HTML. - Delete dead `showAudioOnlyPicker` (also builds `innerHTML` from app names). - Remove `ipcMain.once('picker-select'|'picker-cancel')` leftovers when the window closes (they accumulate per open). **Where:** `src/picker.js`

adam added the

security

severity/high

labels

2026-10-03 09:24:07 -04:00

adam referenced this issue from a pull request that will close it,

2026-10-03 11:52:21 -04:00

Screen picker: remove nodeIntegration and script-injected data #11

adam referenced this issue from a commit

2026-10-03 11:52:22 -04:00

fix(picker): drop nodeIntegration, load static HTML and pass sources over IPC (#7)

adam commented