window/create.js:11,23 uses win.loadURL with https:// hardcoded in front of whatever the extension passes. no validation whatsoever. data: & javascript: won t slip through cuz of the prefix but any external domain works and u can spoof URLs with @ like google.com@sth.com
also misc.ts:4 calls shell.openExternal(url) from renderer with no checks. can open file:///, javascript:, or straight up phishing links. user can get tricked real easy
so yeah, any extension can open anything it wants, local files or malicious sites
fix: validate URLs against a whitelist of allowed protocols and domains, sanitize input, and block file://, javascript:, and other dangerous schemes
window/create.js:11,23useswin.loadURLwithhttps://hardcoded in front of whatever the extension passes. no validation whatsoever.data:&javascript:won t slip through cuz of the prefix but any external domain works and u can spoof URLs with@likegoogle.com@sth.comalso
misc.ts:4callsshell.openExternal(url)from renderer with no checks. can openfile:///,javascript:, or straight up phishing links. user can get tricked real easyso yeah, any extension can open anything it wants, local files or malicious sites
fix: validate URLs against a whitelist of allowed protocols and domains, sanitize input, and block
file://,javascript:, and other dangerous schemes