adam/sunburn-desktop
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Screen picker: remove nodeIntegration and script-injected data #11

Merged
adam merged 1 commit from ai/issue-7 into master 2026-10-03 11:58:44 -04:00
Conversation 0 Commits 1 Files changed 3 +200 -293
adam commented 2026-10-03 11:52:21 -04:00
Owner
Copy link

Closes #7

  • Picker now loads static src/picker.html with a sandboxed, context-isolated preload (src/picker-preload.js) exposing onInit/select/cancel/listAudio. Window titles are sent over IPC and only rendered via textContent, so </script> in a title can no longer inject code.
  • Added a CSP to the picker page.
  • IPC handlers are registered per-window on webContents.ipc (no accumulating ipcMain.once listeners; messages from other senders are ignored). Result resolves once on window close.
  • Removed dead showAudioOnlyPicker and getPickerHTML.

Testing: node --check on both JS files. Not run in Electron (no test framework; node_modules not installed). Manual check suggested: open a window titled </script><script>require('child_process')... and open the picker.

Note: picker reuses the global list-audio-sources handler; if #6 restricts IPC by origin, register it on the picker's webContents instead.

Closes #7 - Picker now loads static `src/picker.html` with a sandboxed, context-isolated preload (`src/picker-preload.js`) exposing onInit/select/cancel/listAudio. Window titles are sent over IPC and only rendered via textContent, so `</script>` in a title can no longer inject code. - Added a CSP to the picker page. - IPC handlers are registered per-window on `webContents.ipc` (no accumulating `ipcMain.once` listeners; messages from other senders are ignored). Result resolves once on window close. - Removed dead `showAudioOnlyPicker` and `getPickerHTML`. Testing: `node --check` on both JS files. Not run in Electron (no test framework; node_modules not installed). Manual check suggested: open a window titled `</script><script>require('child_process')...` and open the picker. Note: picker reuses the global `list-audio-sources` handler; if #6 restricts IPC by origin, register it on the picker's webContents instead.
adam changed title from WIP: Screen picker: remove nodeIntegration and script-injected data to Screen picker: remove nodeIntegration and script-injected data 2026-10-03 11:52:28 -04:00
adam merged commit e2240e6b72 into master 2026-10-03 11:58:44 -04:00
adam deleted branch ai/issue-7 2026-10-03 11:58:44 -04:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
ai
Suitable for AI to work on

  
ai:in-progress

   
ai:in-review

   
ai:merging

   
ai:needs-attention

   
cleanup

   
performance

   
security

   
severity/high
Fix first

  
severity/low

   
severity/medium
No labels
ai
ai:in-progress
ai:in-review
ai:merging
ai:needs-attention
cleanup
performance
security
severity/high
severity/low
severity/medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
adam/sunburn-desktop!11
No description provided.