Skip to content

Commit e776222

Browse files
akashnimareakashnimare
authored
browser-window: Prevent drag and drop events.
This stops a remote code execution via drag and drop event in the main/renderer process. Fixes #453.
1 parent 30b0557 commit e776222

File tree

6 files changed

+55
-27
lines changed

6 files changed

+55
-27
lines changed

‎app/renderer/about.html‎

Lines changed: 31 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,50 @@
11
<!DOCTYPE html>
22
<html lang="en">
3-
<head>
4-
<meta charset="UTF-8">
5-
<link rel="stylesheet" href="css/about.css">
6-
</head>
7-
<body>
3+
4+
<head>
5+
<meta charset="UTF-8">
6+
<link rel="stylesheet" href="css/about.css">
7+
</head>
8+
9+
<body>
810
<div class="about">
911
<img class="logo" src="../resources/zulip.png" />
1012
<p class="detail" id="version">v?.?.?</p>
1113
<div class="maintenance-info">
1214
<p class="detail maintainer">
13-
Maintained by <a onclick="linkInBrowser('website')">Zulip</a>
15+
Maintained by
16+
<a onclick="linkInBrowser('website')">Zulip</a>
1417
</p>
1518
<p class="detail license">
16-
Available under the <a onclick="linkInBrowser('license')">Apache 2.0 License</a>
19+
Available under the
20+
<a onclick="linkInBrowser('license')">Apache 2.0 License</a>
1721
</p>
1822
<a class="bug" onclick="linkInBrowser('bug')" href="#">Found bug?</a>
1923
</div>
2024
</div>
2125
<script>
2226

23-
const { app } = require('electron').remote;
24-
const { shell } = require('electron');
25-
const version_tag = document.querySelector('#version');
26-
version_tag.innerHTML = 'v' + app.getVersion();
27+
const { app } = require('electron').remote;
28+
const { shell } = require('electron');
29+
const version_tag = document.querySelector('#version');
30+
version_tag.innerHTML = 'v' + app.getVersion();
2731

28-
function linkInBrowser(type) {
29-
let url;
30-
switch (type) {
31-
case 'website':
32-
url = "https://zulipchat.com";
33-
break;
34-
case 'license':
35-
url = "https://github.com/zulip/zulip-electron/blob/master/LICENSE";
36-
break;
37-
default:
38-
url = 'https://github.com/zulip/zulip-electron/issues/new?body=' +
39-
'%3C!--Please%20describe%20your%20issue%20and%20steps%20to%20reproduce%20it.--%3E';
32+
function linkInBrowser(type) {
33+
let url;
34+
switch (type) {
35+
case 'website':
36+
url = "https://zulipchat.com";
37+
break;
38+
case 'license':
39+
url = "https://github.com/zulip/zulip-electron/blob/master/LICENSE";
40+
break;
41+
default:
42+
url = 'https://github.com/zulip/zulip-electron/issues/new?body=' +
43+
'%3C!--Please%20describe%20your%20issue%20and%20steps%20to%20reproduce%20it.--%3E';
44+
}
45+
shell.openExternal(url);
4046
}
41-
shell.openExternal(url);
42-
}
4347
</script>
44-
</body>
48+
<script>require('./js/shared/preventdrag.js')</script>
49+
</body>
4550
</html>

‎app/renderer/js/preload.js‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ const ConfigUtil = require(__dirname + '/utils/config-util.js');
88
// eslint-disable-next-line import/no-unassigned-import
99
require('./notification');
1010

11+
// Prevent drag and drop event in main process which prevents remote code executaion
12+
require(__dirname + '/shared/preventdrag.js');
13+
1114
const logout = () => {
1215
// Create the menu for the below
1316
document.querySelector('.dropdown-toggle').click();

‎app/renderer/js/shared/preventdrag.js‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
'use strict';
2+
3+
// This is a security fix. Following function prevents drag and drop event in the app
4+
// so that attackers can't execute any remote code within the app
5+
// It doesn't affect the compose box so that users can still
6+
// use drag and drop event to share files etc
7+
8+
const preventDragAndDrop = () => {
9+
const preventEvents = ['dragover', 'drop'];
10+
preventEvents.forEach(dragEvents => {
11+
document.addEventListener(dragEvents, event => {
12+
event.preventDefault();
13+
});
14+
});
15+
};
16+
17+
preventDragAndDrop();

‎app/renderer/main.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,4 +44,5 @@
4444
</div>
4545
</body>
4646
<script src="js/main.js"></script>
47+
<script>require('./js/shared/preventdrag.js')</script>
4748
</html>

‎app/renderer/network.html‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,6 @@
1717
<div id="reconnect">Try now</div>
1818
</div>
1919
</body>
20-
<script src="js/pages/network.js"></script>
20+
<script src="js/pages/network.js"></script>
21+
<script>require('./js/shared/preventdrag.js')</script>
2122
</html>

‎app/renderer/preference.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,5 @@
1313
</div>
1414
</body>
1515
<script src="js/pages/preference/preference.js"></script>
16+
<script>require('./js/shared/preventdrag.js')</script>
1617
</html>

0 commit comments

Comments
 (0)