search

rdw-archive / WebClient

[Proof of Concept] Browser-based client capable of rendering networked multiplayer games using modern web technologies
1 stars 0 forks source link

Replace NodeJS abstraction layer with a proper IPC mirror #9

Open rdw-software opened 3 years ago

rdw-software commented 3 years ago

There should be no way to execute remote content if everything is run locally, as is the intended use case for all prototypes, but this must be fixed later (before an "official' public release). Currently, the NODE global exposes the NodeJS APIs we need (only fs), but it's not secure as any script could still require any other APIs they provide.

Roadmap:

See https://www.electronjs.org/docs/tutorial/security#2-do-not-enable-nodejs-integration-for-remote-content)

rdw-software commented 3 years ago

This could likely be generalized to a proper Security Manager (similar to https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainting), that also deals with Electron and IPC concerns. Addons should probably be limited, too, if not configured properly?

rdw-software commented 3 years ago

See also: https://codice.atlassian.net/wiki/spaces/DDF/pages/289275905/OSGi+Security+Manager

Addons could be restricted from modifying the default environment, while still having access to their own files/folders if needed, etc.

rdw-software commented 3 years ago

Electron has disabled this by default as of version 12. There's some alternatives here: https://stackoverflow.com/questions/44391448/electron-require-is-not-defined/57049268#57049268

Right now it doesn't matter, so I simply disabled contextIsolation, but I suppose sooner or later a proper solution needs to be implemented.

rdw-software commented 2 years ago

Some info here: https://github.com/reZach/secure-electron-template/blob/master/docs/secureapps.md