4 ms·
What does this mean for Electron Apps?
by yayr 8y ago
What does this mean for Electron Apps?
- dleslie 8y agoThey are very likely to be vulnerable.
- eternal_virgin 8y agoElectron Apps are basically already malware
- bezosbaldballs 8y ago> uses up all your resources > is enormous in size for no reason > javascript Ok, agreed.
- AgentME 8y agoIf the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.
- nickysielicki 8y agoDo most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?
- cjones26 8y agoWhich is a massive security issue in itself--Electron documentation even warns you about this.
- AgentME 8y agoElectron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-untrusted-content https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.
- hartator 8y agoThe thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
- idlewan 8y agoFileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader https://developer.mozilla.org/en-US/docs/Web/API/FileReader So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.