From bbfa2a38e974c44a06ac1418ee3905da24380d84 Mon Sep 17 00:00:00 2001 From: Amit Haridas Date: Fri, 24 Apr 2026 17:19:52 +0530 Subject: [PATCH] security: add permission request handler for security isolation Restrict Electron permission requests to only clipboard operations. Deny: camera, microphone, geolocation, notifications, and all other permissions by default. Implements setPermissionRequestHandler on web-contents-created event to enforce security policy early in the app lifecycle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/main.js | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/main.js b/src/main.js index f5de081..e44c884 100644 --- a/src/main.js +++ b/src/main.js @@ -319,6 +319,32 @@ ipcMain.handle('plugin-settings:set', (_event, { key, value }) => { }); ipcMain.handle('get-app-version', () => app.getVersion()); +// ============================================ +// SECURITY: Permission Request Handler +// ============================================ +// Restrict permissions to only those explicitly needed. +// Deny: camera, microphone, geolocation, notifications, etc. +// Allow: clipboard-read, clipboard-write (user expects these) +app.on('web-contents-created', (event, contents) => { + contents.session.setPermissionRequestHandler((webContents, permission, callback) => { + const ALLOWED_PERMISSIONS = [ + 'clipboard-read', + 'clipboard-write' + ]; + + if (ALLOWED_PERMISSIONS.includes(permission)) { + callback(true); + } else { + // Deny all other permissions (camera, microphone, geolocation, etc.) + console.warn(`[Security] Blocked permission request: ${permission}`); + callback(false); + } + }); + + // Disable file download dialogs for security + // contents.session.setDownloadPath(userDownloadsPath); +}); + let mainWindow; let currentFile = null; // This will now represent the active tab's file let pandocAvailable = null; // Cache pandoc availability check