Skip to main content

BrowserView window.open() 漏洞修复

· 3 min read
ckerr

发现一个代码漏洞，允许在子窗口中重新启用 Node。

¥A code vulnerability has been discovered that allows Node to be re-enabled in child windows.

使用 sandbox: true 或 nativeWindowOpen: true 和 nodeIntegration: false 打开 BrowserView 会生成一个 webContents，其中可以调用 window.open，并且新打开的子窗口将启用 nodeIntegration。此漏洞影响所有受支持的 Electron 版本。

¥Opening a BrowserView with sandbox: true or nativeWindowOpen: true and nodeIntegration: false results in a webContents where window.open can be called and the newly opened child window will have nodeIntegration enabled. This vulnerability affects all supported versions of Electron.

缓解措施​

¥Mitigation

我们已发布 Electron 的新版本，其中包含针对此漏洞的修复：2.0.17、3.0.15、3.1.3、4.0.4 和 5.0.0-beta.2。我们鼓励所有 Electron 开发者立即将其应用更新到最新稳定版本。

¥We've published new versions of Electron which include fixes for this vulnerability: 2.0.17, 3.0.15, 3.1.3, 4.0.4, and 5.0.0-beta.2. We encourage all Electron developers to update their apps to the latest stable version immediately.

如果由于某种原因你无法升级 Electron 版本，你可以通过禁用所有子 Web 内容来缓解此问题：

¥If for some reason you are unable to upgrade your Electron version, you can mitigate this issue by disabling all child web contents:

view.webContents.on('-add-new-contents', (e) => e.preventDefault());

更多信息​

¥Further Information

此漏洞由 PalmerAL 发现并负责任地报告给 Electron 项目。

¥This vulnerability was found and reported responsibly to the Electron project by PalmerAL.

要了解有关保护 Electron 应用安全的最佳实践的更多信息，请参阅我们的 安全教程。

¥To learn more about best practices for keeping your Electron apps secure, see our security tutorial.

如果你想报告 Electron 中的漏洞，请发送电子邮件至 security@electronjs.org。

¥If you wish to report a vulnerability in Electron, email security@electronjs.org.