feat(security): deny-by-default session permission handler#10168
Draft
jackkav wants to merge 1 commit into
Draft
feat(security): deny-by-default session permission handler#10168jackkav wants to merge 1 commit into
jackkav wants to merge 1 commit into
Conversation
Electron security checklist item 5 (handle session permission requests). Registers setPermissionRequestHandler / setPermissionCheckHandler on the default session, denying everything except clipboard, which the renderer uses via navigator.clipboard. Denied requests are logged. Logic isolated in session-security.ts and pinned by a unit test.
✅ Circular References ReportGenerated at: 2026-06-26T09:37:46.102Z Summary
Click to view all circular references in PR (9)Click to view all circular references in base branch (9)Analysis✅ No Change: This PR does not introduce or remove any circular references. This report was generated automatically by comparing against the |
Contributor
|
I created a similar PR for this: #10159 Is the ability to read the clipboard without user interaction necessary? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements item 5 of the Electron security checklist ("Handle session permission requests from remote content") for the main window's session.
Electron auto-approves several permissions (notifications, pointer-lock, etc.) for loaded content when no handler is registered. This adds an explicit deny-by-default posture on
session.defaultSession:setPermissionRequestHandler+setPermissionCheckHandlerdeny everything except clipboard.navigator.clipboard.writeText(e.g. the "copy routes" action inproject-navigation-sidebar.tsx).console.logged so unexpected requests are diagnosable.Design
src/main/session-security.ts), mirroring the existingwindow-security.tspattern, so it can be unit-tested.app.on('ready')handler inentry.main.ts, next to the existingdefaultSessionsetup.Risk
Low. The renderer is first-party content and has no legitimate use for camera/mic/geolocation/MIDI/notifications. The only web-permission API in the renderer is
navigator.clipboard, which remains allowed. Draft pending a quick smoke check that clipboard copy still works.Test plan
vitest run packages/insomnia/src/main/session-security.test.ts(13 tests)Checklist context
This is 1 of 2 follow-up PRs from a security-checklist audit of the main window. The other addresses item 7 (Content-Security-Policy). Item 12 (webview options) is handled by #9942.