Closed masood closed 10 months ago
The http://localhost:8315/
is a normal http-based link address, so links with such address get processed the same way as other http-based links.
Additionally, the application does not include a listener on the will-navigate. While it uses additional handlers, it will be a good idea to add a listener to ensure this event is handled the same way that clicks are handled.
Web page link clicking is opening its address in an external handler/browser, not in the webview itself. But will-navigate
affects navigation of the app/@electron web page. So this is a different thing.
There are measures preventing fishy webview page loading (webview is where https://github.com/ProtonMail/WebClients/ client apps get loaded):
WebClients
version (reported and fixed), but I believe that normally WebClients
can be trusted.Closing as responded.
Summary:
While the ElectronMail Desktop Application does a great job of handling links that are clicked within the application, it does not completely filter these links to remove localhost.
Platform(s) Affected:
MacOS, Linux, Windows
Steps To Reproduce:
http://localhost:8315/
). The link is passed as is to the system since the application only checks the protocol [Link]Additionally, the application does not include a listener on the
will-navigate
. While it uses additional handlers, it will be a good idea to add a listener to ensure this event is handled the same way that clicks are handled.–
Mir Masood Ali, PhD student, University of Illinois at Chicago Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago Chris Kanich, Associate Professor, University of Illinois at Chicago Jason Polakis, Associate Professor, University of Illinois at Chicago