security: harden Electron windows, IPC, and DOM rendering#46
Merged
flexiondotorg merged 3 commits intomainfrom Mar 25, 2026
Merged
security: harden Electron windows, IPC, and DOM rendering#46flexiondotorg merged 3 commits intomainfrom
flexiondotorg merged 3 commits intomainfrom
Conversation
- Add webPreferences sandbox, preload, and context isolation settings to createSplash() main window - Add webPreferences sandbox, preload, and context isolation settings to showAboutWindow() tray window - Add command allowlist to musicKitHook.js with cross-referenced validation in preload.ts Signed-off-by: Martin Wimpress <code@wimpress.io>
- Convert anonymous player event callbacks to named const declarations
- Add app.on('will-quit') handler following MPRIS pattern
- Clear all timers (debounce, pause, reconnect)
- Destroy Discord client with try/catch error handling
- Remove all player event listeners with stable references
- Reset mutable state to ensure clean shutdown
Signed-off-by: Martin Wimpress <code@wimpress.io>
- Document trust boundary for icon parameter in about.html (set by main process, not user-controllable) - Replace innerHTML with DOM construction in navigationBar.js using createElementNS and appendChild; extract three SVG builder functions - Add artifactName omission comment to package.json (prevents desktop shortcut version breakage) Signed-off-by: Martin Wimpress <code@wimpress.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three audit concerns addressed through security hardening and code quality improvements: sandboxing Electron windows, restricting IPC bridge commands, protecting against DOM injection, graceful lifecycle cleanup, and adding trust boundary annotations. No behaviour change for end users; all 203 tests pass.
Changes
webPreferencessandbox settings to splash window and about window (src/main.ts, src/tray.ts); add command allowlist to musicKitHook IPC bridge (assets/musicKitHook.js)will-quithandler to discord-presence integration for clean shutdown (src/integrations/discord-presence/index.ts)innerHTMLwith DOM construction in navigationBar.js; add artifact name metadata to package.jsonTesting
All 203 tests pass. Changes are localised refinements to seven audit concerns identified in code review - no functionality changes.
Related Issues
No GitHub issues referenced.