Skip to content

Minimide 0.2.2 (security update)

Latest
Latest

Choose a tag to compare

View all tags
@mikemich mikemich released this 19 Oct 00:49
· 4 commits to master since this release
Immutable release. Only release title and notes can be modified.
v0.2.2
e5397ab

Security update. Please update: Check for Updates… in the app menu, or rerun the install script.

Opening a folder no longer runs anything from it until you trust it

A downloaded repository could make Minimide run commands as soon as you opened it, or even one file from it. Git honors settings in a repo's own .git/config (like core.fsmonitor or a filter driver), and language servers can run a project's own TypeScript. Minimide now asks the first time you open a folder. Until you trust it, it stays in Restricted Mode: git, blame and language servers are off, and everything else works. Even in trusted folders, background git calls never run a repo's fsmonitor command.

A tighter sandbox for installed packages

  • No permission can reach Minimide's own folder (~/.minimide). Before, the files permission could be turned into full access through it.
  • project-files is now read-only. Writing needs the new project-write, which never reaches .git/ or node_modules/.
  • Package stylesheets are reduced to visual properties, and can't load anything from the internet or draw fake prompts.
  • Packages can no longer talk to each other through shared browser storage, and each one can only load its own files.
  • Package names like core and ui are reserved. Prompts are labeled with the package's name. Calls and notifications are rate-limited.
  • The network permission can't reach your own machine, your local network or cloud metadata addresses.

Other hardening

  • The Markdown preview's remote-image blocking can no longer be bypassed, and documents can't overlay fake UI.
  • Stricter content security policy. Packaged builds refuse debugging switches. One more Electron fuse is off.
  • Windows: commands are found through PATH only, never the current folder.
  • The updater and install script refuse any file without a published checksum.
  • Releases are now immutable on GitHub, so published files can't be swapped afterwards.

Thanks to everyone who tries Minimide. If you find a security problem, please report it privately through GitHub's security advisory form rather than a public issue.

New

  • scripts/vscode-theme.mjs converts a VS Code color theme into a Minimide theme package.
Assets 11
Loading