Harden app security: Electron 41, CSP, DevTools gate, entitlements#14
Merged
Harden app security: Electron 41, CSP, DevTools gate, entitlements#14
Conversation
- Hide the View → Toggle Developer Tools menu entry in packaged builds. DevTools are still accessible in dev (npm run dev) via the same role, so the developer loop is unaffected. - Remove com.apple.security.cs.disable-library-validation from the mac entitlements. We ship no third-party unsigned native modules in production dependencies, so library validation should stay on and reject any injected dylibs. Kept (still required): - com.apple.security.cs.allow-jit - com.apple.security.cs.allow-unsigned-executable-memory Both are needed by Electron's V8 JIT under Hardened Runtime.
Electron 33 is past the three-major support window and no longer receives security patches. 41 is the current stable and puts us back on the supported release train. Build, typecheck, and tests pass unchanged. - electron ^33.2.1 → ^41.2.1 - electron-builder ^25.1.8 → ^26.8.1 No source changes were needed to accommodate the Chromium, V8, or Node.js bumps that come with this jump.
Add frame-ancestors 'none' (anti-clickjacking), manifest-src 'none' (no web manifest is served), explicit worker-src and connect-src, and document the unsafe-eval trade-off inline. unsafe-eval and unsafe-inline remain because: * function-plot evaluates math.js expressions at runtime * jsxgraph evaluates formula strings for interactive geometry * mermaid parser paths rely on runtime Function() * Tailwind and React emit inline style attributes The proper future fix for unsafe-eval is to render diagram blocks inside sandboxed iframes with their own relaxed CSP, keeping the main renderer strict. That's a dedicated refactor and belongs in its own change.
adibhanna
force-pushed
the
chore/harden-app-security
branch
from
c75eb0b to
bb87de4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Production-readiness pass following the audit. Four atomic commits, each independently buildable.
Commits
1. Gate DevTools menu in production, trim mac entitlements
View → Toggle Developer Toolsis now hidden in packaged builds (still available innpm run dev)com.apple.security.cs.disable-library-validation— no prod native deps need unsigned dylibsallow-jitandallow-unsigned-executable-memory(required by Electron V8 JIT)2. Upgrade Electron 33 → 41, electron-builder 25 → 26
3. Tighten Content Security Policy
frame-ancestors 'none'(anti-clickjacking),manifest-src 'none', explicitworker-src,connect-srcunsafe-evalandunsafe-inlineremain (function-plot, jsxgraph, mermaid, Tailwind)4. Remove diagnostic console.log from IPC handler
listFontFamilieslog line that leaked into prod stdout.What was NOT changed (deliberately)
sandbox: falsestays. WithcontextIsolation: true+ a tight preload surface + the navigation guards already in place, this is a defensible tradeoff. Flipping it would require reworking preload IPC.unsafe-evalstays. Three diagram engines depend on it. The proper future fix is iframe-sandboxed diagram rendering — tracked as its own piece of work.Test plan
Local verification before pushing:
Known conflict
`package.json` + `package-lock.json` will likely conflict with the recent `1747b12 Disable Dependabot and fold in safe dependency updates` commit. When merging, prefer this branch's versions (the Electron bump supersedes the incremental updates there).