3 ms·

Imagine you’re writing Javascript code on a webpage. You write `const fs = require(‘fs’)`. It throws an error because the browser has no idea what “require” or

Imagine you’re writing Javascript code on a webpage. You write `const fs = require(‘fs’)`. It throws an error because the browser has no idea what “require” or “fs” are. In electron, you can configure your page to be interlinked with node, so that you could write `const fs = require(‘fs’)` and import the Node filesystem module. This is a big feature of Electron, but it also opens you up to a whole host of vulnerabilities. For instance, you are never supposed to spin up a WebView like this and then just load random URLs (this is emphasized in the docs when they’re explaining how to do this). However, if you did, untrusted code on a random webpage would have access to the user’s filesystem. [Edit now that I'm back on my laptop]: Here's the section of the docs that covers this security concern: https://www.electronjs.org/docs/tutorial/security#isolation-for-untrusted-content https://www.electronjs.org/docs/tutorial/security#isolation-... > Under no circumstances should you load and execute remote code with Node.js integration enabled. Instead, use only local files (packaged together with your application) to execute Node.js code. To display remote content, use the <webview> tag or BrowserView, make sure to disable the nodeIntegration and enable contextIsolation

therealdrag0 7y ago
In electron the UI javascript is running in a separate process than the node javascript. They can communicate through Electron's IPC channel. I wouldn't be too surprised if it could be exploited, but it's not as easy as require('fs'). Instead you have to send messages through the pipe and you'd have to know how to exploit the handlers at the other end in the NodeJs process. https://www.electronjs.org/docs/api/ipc-main https://www.electronjs.org/docs/api/ipc-main
- Uehreka 7y ago
  I was on a phone before and didn't have the docs pulled up, but the thing I was referring to is called nodeIntegration (it's a boolean you set in the webPreferences object in the options object you pass to the BrowserWindow constructor). This section of the docs explains it a bit better: https://www.electronjs.org/docs/tutorial/application-architecture#using-nodejs-apis https://www.electronjs.org/docs/tutorial/application-archite... > Electron exposes full access to Node.js both in the main and the renderer process.
  - therealdrag0 7y ago
    TIL, thanks.
  - sieabahlpark 7y ago
    > As you might already be able to guess, this has important security implications if you ever attempt to load remote content. You can find more information and guidance on loading remote content in our security documentation. Don't enable the feature if you don't want it to be an avenue for exploits?

therealdrag0 7y ago

In electron the UI javascript is running in a separate process than the node javascript. They can communicate through Electron's IPC channel. I wouldn't be too surprised if it could be exploited, but it's not as easy as require('fs'). Instead you have to send messages through the pipe and you'd have to know how to exploit the handlers at the other end in the NodeJs process. https://www.electronjs.org/docs/api/ipc-main https://www.electronjs.org/docs/api/ipc-main

Uehreka 7y ago
I was on a phone before and didn't have the docs pulled up, but the thing I was referring to is called nodeIntegration (it's a boolean you set in the webPreferences object in the options object you pass to the BrowserWindow constructor). This section of the docs explains it a bit better: https://www.electronjs.org/docs/tutorial/application-architecture#using-nodejs-apis https://www.electronjs.org/docs/tutorial/application-archite... > Electron exposes full access to Node.js both in the main and the renderer process.
- therealdrag0 7y ago
  TIL, thanks.
- sieabahlpark 7y ago
  > As you might already be able to guess, this has important security implications if you ever attempt to load remote content. You can find more information and guidance on loading remote content in our security documentation. Don't enable the feature if you don't want it to be an avenue for exploits?