Skip to content

LeafBase v1.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 May 03:45
· 19 commits to main since this release
v1.1.3
0ba2e77

fix(security): patch command injection, open-handler, and auto-update risks

  • bsonTools: replace exec() with execFile() when extracting tar archives so
    userData paths containing spaces or shell metacharacters can't be
    interpreted as commands.
  • main window: allowlist http(s)/mailto in setWindowOpenHandler to prevent
    file:// or custom-scheme URLs from triggering arbitrary handlers via
    shell.openExternal.
  • autoUpdater: only enable on macOS, where builds are signed/notarized.
    Windows/Linux builds are unsigned, so auto-downloading installers would
    be a supply-chain RCE vector until code-signing is in place.
Assets 17
Loading