4 ms·
If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functi
by AgentME 8y ago
If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.
- nickysielicki 8y agoDo most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?
- cjones26 8y agoWhich is a massive security issue in itself--Electron documentation even warns you about this.
- AgentME 8y agoElectron's docs (https://electronjs.org/docs/tutorial/security#isolation-for-untrusted-content https://electronjs.org/docs/tutorial/security#isolation-for-...) mention that you should webview or BrowserView with a certain option with untrusted content, not that it shouldn't be done at all.
- hartator 8y agoThe thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
- idlewan 8y agoFileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader https://developer.mozilla.org/en-US/docs/Web/API/FileReader So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.