JavaScript

JavaScript

Made by DeepSource

Audit: Unsanitized external input used with Electron's shell module is prone to vulnerabilities JS-A1007

Security
Critical
a03 cwe-77 sans top 25 owasp top 10

The openExternal API of Electron's shell module enables the use of the desktop's native utilities to open a protocol URI.

If not used carefully, the openExternal method can be used to compromise your application. It can be exploited to run arbitrary commands when invoked with untrusted content.

Bad Practice

const { shell } = require('electron')

app.post('/', (req, res) => {
  const url = req.body.url;
  shell.openExternal(url); // unsanitized content used with `openExternal`
});

Recommended

const { shell } = require('electron')

app.post('/', (req, res) => {
  const url = req.body.url;
  const safeUrl = sanitize(url)
  shell.openExternal(safeUrl); // sanitized content used with `openExternal`
});

References