Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change CREATE_NEW_WINDOW IPC call to accept a path and query #6595

Merged
merged 2 commits into from
Jan 20, 2025

Conversation

absidue
Copy link
Member

@absidue absidue commented Jan 16, 2025

Change CREATE_NEW_WINDOW IPC call to accept a path and query

Pull Request Type

  • Security improvement

Description

Currently the CREATE_NEW_WINDOW IPC call accepts a URL and performs no validation on it, which means it can be used to open new windows with arbitrary URLs. This pull request locks it down by making it accept a path and query parameters instead, so that it can only be used to create windows with in-app URLs and adds some parameter validation.

Testing

  • Please check that the new window button in the top bar still works (calls CREATE_NEW_WINDOW with no parameters)
  • Please test opening various queries in new windows from the search bar (SHIFT+ENTER or SHIFT+click on the search button)

Desktop

  • OS: Windows
  • OS Version: 10
  • FreeTube version: 7ad5873

@github-actions github-actions bot added the PR: waiting for review For PRs that are complete, tested, and ready for review label Jan 16, 2025
@FreeTubeBot FreeTubeBot enabled auto-merge (squash) January 16, 2025 18:51
src/main/index.js Outdated Show resolved Hide resolved
Co-authored-by: PikachuEXE <[email protected]>
@absidue absidue requested a review from PikachuEXE January 19, 2025 20:00
@FreeTubeBot FreeTubeBot merged commit ab8c7d6 into FreeTubeApp:development Jan 20, 2025
5 checks passed
@github-actions github-actions bot removed the PR: waiting for review For PRs that are complete, tested, and ready for review label Jan 20, 2025
@absidue absidue deleted the create-new-window-params branch January 20, 2025 13:58
PikachuEXE added a commit to PikachuEXE/FreeTube that referenced this pull request Jan 21, 2025
* development: (23 commits)
  Translated using Weblate (Czech)
  Translated using Weblate (German)
  Translated using Weblate (Basque)
  Translated using Weblate (Ukrainian)
  Translated using Weblate (German)
  Translated using Weblate (Basque)
  Translated using Weblate (German)
  Stay in fullscreen/fullwindow/PiP + default viewing mode setting (FreeTubeApp#5903)
  Undo Feature For Remove From Playlist. (FreeTubeApp#5885)
  group builds (FreeTubeApp#6497)
  Change CREATE_NEW_WINDOW IPC call to accept a path and query (FreeTubeApp#6595)
  Bump shaka-player from 4.12.7 to 4.12.8 (FreeTubeApp#6609)
  Bump electron from 33.3.1 to 34.0.0 (FreeTubeApp#6608)
  Translated using Weblate (French)
  Bump sass from 1.83.1 to 1.83.4 (FreeTubeApp#6607)
  Bump lefthook from 1.10.3 to 1.10.9 (FreeTubeApp#6606)
  Bump eslint-plugin-jsdoc from 50.6.1 to 50.6.2 in the eslint group (FreeTubeApp#6604)
  Translated using Weblate (Czech)
  Translated using Weblate (Estonian)
  Translated using Weblate (German)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants