Skip to content

Deny unsafe Electron window protocols#199

Merged
siddu-k merged 1 commit into
siddu-k:mainfrom
kunal-9090:codex/issue-172-safe-window-open
Jun 4, 2026
Merged

Deny unsafe Electron window protocols#199
siddu-k merged 1 commit into
siddu-k:mainfrom
kunal-9090:codex/issue-172-safe-window-open

Conversation

@kunal-9090
Copy link
Copy Markdown
Contributor

Closes #172

GSSoC labels/level: gssoc:approved, level:advanced

Summary

  • Parse new-window URLs with URL before deciding how to handle them.
  • Allow only same-origin app windows inside DevShell.
  • Open only http: and https: URLs externally.
  • Deny unsafe protocols such as file:, data:, javascript:, and malformed URLs.

Validation

  • node --check main.js

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security: Electron setWindowOpenHandler Allows file:// and data: Protocol Loading

2 participants