aegarbutt

3 ms·

1. 1.▲
   by aegarbutt 8y ago

   Or I just expose my malicious share to the Internet. No mounting step necessary. file://<Evil-IP>/evil.js
2. 2.▲
   by aegarbutt 8y ago

   The CSP policy was 'self'. The problem is that all file:// URIs share an origin in Electron. So, 'self' is ALL file:// URIs.
3. 3.▲
   by aegarbutt 8y ago

   For reference: https://github.com/electron/electron/issues/5151
4. 4.▲
   by aegarbutt 8y ago

   If I remember correctly, on Windows you can reference file://<IP-Address>/path/to/file Thanks SMB / UNC Paths.
5. 5.▲
   by aegarbutt 8y ago

   In Electron, all file:/// URIs share an origin. Using `script-src: 'self'` isn't much of a boundary.
6. 6.▲
   by aegarbutt 10y ago

   They really missed an opportunity to have their URL be https://evaluate-csp.withgoogle.com Rolls off the tongue better than https://csp-evaluator.withgoogle.com .