Potential Command Execution vulnerabilities introduced by main-preload.js

[xiaofen9]

Hi,

We found that static/main-preload.js introduces dangerous API openShellExternal for arbitrary access on unsafe renderer process.
This may lead to remote command execution.
We suggest that a URL check should be enforced at L15, which enforces an allowlist on trusted URLs.

https://github.com/BoostIO/BoostNote.next/blob/a467dcb960531953040f26d09bd59a90c37a002e/static/main-preload.js#L14-L17

[Rokt33r]

Thanks for reporting. For now, it is okay since we're using the method with safe URLs only. So it won't cause any problems unless a user executing an arbitrary script from dev tools. But I'll make it safer for the case that someone makes a mistake.

@Komediruzecki This could be problematic for the local app since links in the markdown previewer are using this method without any URL filtering.

[xiaofen9]

Fixed by BoostIO/BoostNote.next-local#39