security: isAppPageUrl checks devRendererUrl with startsWith instead of comparing parsed URL origins
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- electron, typescript
Research direction
The bug is in isAppPageUrl in src/main/renderer_url.ts (around lines 25-26), where url.startsWith(dev) is used on the dev renderer URL. Start by reading that function and devRendererUrl, then check how ELECTRON_RENDERER_URL is set. Done means both url and dev are parsed with new URL(...) and compared by origin, plus a pathname prefix when dev has a path, and a URL like http://localhost:5173.evil.example/ no longer passes.
Written by the indexing model from the issue text.
Description
Problem
Found in the Oct 13 audit (at 704a0b7).
In src/main/renderer_url.ts:25-26, isAppPageUrl checks whether an IPC call came from the development server with:
const dev = devRendererUrl(isPackaged, env);
if (dev && url.startsWith(dev)) return true;
Packaged builds ignore ELECTRON_RENDERER_URL (isPackaged is true), so this affects development runs only. However, when ELECTRON_RENDERER_URL has no trailing slash (for example http://localhost:5173), url.startsWith(dev) also matches http://localhost:5173.evil.example/ or http://localhost:[email protected]/.
Fix
Parse both url and dev with new URL(...) and compare origin (plus pathname prefix when dev includes a path).
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- Avg merge
- 8h 28m
- Merged PRs (30d)
- 26
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PierrunoYT/patch
-
enhancement priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
PierrunoYT/patch#305 ·
Maintainers usually reply within 1 day
-
Claude Code chats: tool calls made inside Claude Code subagents leave cards that end as "(stopped)"Openbug priority: low severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
PierrunoYT/patch#289 ·
Maintainers usually reply within 1 day
-
bug priority: medium severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
PierrunoYT/patch#285 ·
Maintainers usually reply within 1 day
-
priority: medium security severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
PierrunoYT/patch#283 ·
Maintainers usually reply within 1 day
-
performance priority: low severity: low
Difficulty 4/5 3-5 days Newbie friendliness 30/100
PierrunoYT/patch#306 ·
Maintainers usually reply within 1 day
All issues in PierrunoYT/patch
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
juice-shop/juice-shop#3686 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
dsh-market/dsh-market#877 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
ScottKirvan/GOMAC#61 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
stellar/stellar-dev-skill#151 ·
Maintainers usually reply within 1 day