44r0n7/privacy.sexy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve desktop security by isolating Electron

Browse Source 
Enable `contextIsolation` in Electron to securely expose a limited set
of Node.js APIs to the renderer process. It:

1. Isolates renderer and main process contexts. It ensures that the
   powerful main process functions aren't directly accessible from
   renderer process(es), adding a security boundary.
2. Mitigates remote exploitation risks. By isolating contexts, potential
   malicious code injections in the renderer can't directly reach and
   compromise the main process.
3. Reduces attack surface.
4. Protect against prototype pollution: It prevents tampering of
   JavaScript object prototypes in one context from affecting another
   context, improving app reliability and security.

Supporting changes include:

- Extract environment and system operations classes to the infrastructure
  layer. This removes node dependencies from core domain and application
  code.
- Introduce `ISystemOperations` to encapsulate OS interactions. Use it
  from `CodeRunner` to isolate node API usage.
- Add a preloader script to inject validated environment variables into
  renderer context. This keeps Electron integration details
  encapsulated.
- Add new sanity check to fail fast on issues with preloader injected
  variables.
- Improve test coverage of runtime sanity checks and environment
  components. Move validation logic into separate classes for Single
  Responsibility.
- Improve absent value test case generation.
This commit is contained in:
undergroundwires
2023-08-25 14:31:30 +02:00
parent 62f8bfac2f
commit e9e0001ef8
83 changed files with 1846 additions and 769 deletions
Download Patch File Download Diff File Expand all files Collapse all files

116
tests/unit/infrastructure/RuntimeSanity/Common/FactoryValidator.spec.ts Normal file
View File

@@ -0,0 +1,116 @@
import { describe } from 'vitest';
import { FactoryValidator, FactoryFunction } from '@/infrastructure/RuntimeSanity/Common/FactoryValidator';
import { itEachAbsentObjectValue } from '@tests/unit/shared/TestCases/AbsentTests';
describe('FactoryValidator', () => {
describe('ctor', () => {
describe('throws when factory is absent', () => {
itEachAbsentObjectValue((absentValue) => {
// arrange
const expectedError = 'missing factory';
const factory = absentValue;
// act
const act = () => new TestableFactoryValidator(factory);
// assert
expect(act).to.throw(expectedError);
});
});
});
describe('collectErrors', () => {
it('reports error thrown by factory function', () => {
// arrange
const errorFromFactory = 'Error from factory function';
const expectedError = `Error in factory creation: ${errorFromFactory}`;
const factory: FactoryFunction<number | undefined> = () => {
throw new Error(errorFromFactory);
};
const sut = new TestableFactoryValidator(factory);
// act
const errors = [...sut.collectErrors()];
// assert
expect(errors).to.have.lengthOf(1);
expect(errors[0]).to.equal(expectedError);
});
describe('reports when factory returns falsy values', () => {
const falsyValueTestCases = [
{
name: '`false` boolean',
value: false,
},
{
name: 'number zero',
value: 0,
},
{
name: 'empty string',
value: '',
},
{
name: 'null',
value: null,
},
{
name: 'undefined',
value: undefined,
},
{
name: 'NaN (Not-a-Number)',
value: Number.NaN,
},
];
falsyValueTestCases.forEach(({ name, value }) => {
it(`reports for value: ${name}`, () => {
// arrange
const errorFromFactory = 'Factory resulted in a falsy value';
const factory: FactoryFunction<number | undefined> = () => {
return value as never;
};
const sut = new TestableFactoryValidator(factory);
// act
const errors = [...sut.collectErrors()];
// assert
expect(errors).to.have.lengthOf(1);
expect(errors[0]).to.equal(errorFromFactory);
});
});
});
it('does not report when factory returns a truthy value', () => {
// arrange
const factory: FactoryFunction<number | undefined> = () => {
return 35;
};
const sut = new TestableFactoryValidator(factory);
// act
const errors = [...sut.collectErrors()];
// assert
expect(errors).to.have.lengthOf(0);
});
it('executes factory for each method call', () => {
// arrange
let forceFalsyValue = false;
const complexFactory: FactoryFunction<number | undefined> = () => {
return forceFalsyValue ? undefined : 42;
};
const sut = new TestableFactoryValidator(complexFactory);
// act
const firstErrors = [...sut.collectErrors()];
forceFalsyValue = true;
const secondErrors = [...sut.collectErrors()];
// assert
expect(firstErrors).to.have.lengthOf(0);
expect(secondErrors).to.have.lengthOf(1);
});
});
});
class TestableFactoryValidator extends FactoryValidator<number | undefined> {
public constructor(factory: FactoryFunction<number | undefined>) {
super(factory);
}
public name = 'test';
public shouldValidate(): boolean {
return true;
}
}

69
tests/unit/infrastructure/RuntimeSanity/SanityChecks.spec.ts
View File

@@ -1,10 +1,10 @@
import { describe, it, expect } from 'vitest';
import { validateRuntimeSanity } from '@/infrastructure/RuntimeSanity/SanityChecks';
import { ISanityCheckOptions } from '@/infrastructure/RuntimeSanity/ISanityCheckOptions';
import { ISanityCheckOptions } from '@/infrastructure/RuntimeSanity/Common/ISanityCheckOptions';
import { SanityCheckOptionsStub } from '@tests/unit/shared/Stubs/SanityCheckOptionsStub';
import { ISanityValidator } from '@/infrastructure/RuntimeSanity/ISanityValidator';
import { ISanityValidator } from '@/infrastructure/RuntimeSanity/Common/ISanityValidator';
import { SanityValidatorStub } from '@tests/unit/shared/Stubs/SanityValidatorStub';
import { itEachAbsentObjectValue } from '@tests/unit/shared/TestCases/AbsentTests';
import { itEachAbsentCollectionValue, itEachAbsentObjectValue } from '@tests/unit/shared/TestCases/AbsentTests';
describe('SanityChecks', () => {
describe('validateRuntimeSanity', () => {
@@ -21,15 +21,31 @@ describe('SanityChecks', () => {
expect(act).to.throw(expectedError);
});
});
it('throws when validators are empty', () => {
// arrange
const expectedError = 'missing validators';
const context = new TestContext()
.withValidators([]);
// act
const act = () => context.validateRuntimeSanity();
// assert
expect(act).to.throw(expectedError);
describe('throws when validators are empty', () => {
itEachAbsentCollectionValue((absentCollection) => {
// arrange
const expectedError = 'missing validators';
const validators = absentCollection;
const context = new TestContext()
.withValidators(validators);
// act
const act = () => context.validateRuntimeSanity();
// assert
expect(act).to.throw(expectedError);
}, { excludeUndefined: true });
});
describe('throws when single validator is absent', () => {
itEachAbsentObjectValue((absentValue) => {
// arrange
const expectedError = 'missing validator in validators';
const absentValidator = absentValue;
const context = new TestContext()
.withValidators([new SanityValidatorStub(), absentValidator]);
// act
const act = () => context.validateRuntimeSanity();
// assert
expect(act).to.throw(expectedError);
});
});
});
@@ -99,6 +115,35 @@ describe('SanityChecks', () => {
expect(actualError).to.include(firstError);
expect(actualError).to.include(secondError);
});
it('throws with validators name', () => {
// arrange
const validatorWithErrors = 'validator-with-errors';
const validatorWithNoErrors = 'validator-with-no-errors';
let actualError = '';
const context = new TestContext()
.withValidators([
new SanityValidatorStub()
.withName(validatorWithErrors)
.withShouldValidateResult(true)
.withErrorsResult(['error']),
new SanityValidatorStub()
.withShouldValidateResult(true)
.withErrorsResult([]),
new SanityValidatorStub()
.withShouldValidateResult(true)
.withErrorsResult([]),
]);
// act
try {
context.validateRuntimeSanity();
} catch (err) {
actualError = err.toString();
}
// assert
expect(actualError).to.have.length.above(0);
expect(actualError).to.include(validatorWithErrors);
expect(actualError).to.not.include(validatorWithNoErrors);
});
it('accumulates error messages from validators', () => {
// arrange
const errorFromFirstValidator = 'first-error';

7
tests/unit/infrastructure/RuntimeSanity/Validators/EnvironmentValidator.spec.ts Normal file
View File

@@ -0,0 +1,7 @@
import { describe } from 'vitest';
import { EnvironmentValidator } from '@/infrastructure/RuntimeSanity/Validators/EnvironmentValidator';
import { itNoErrorsOnCurrentEnvironment } from './ValidatorTestRunner';
describe('EnvironmentValidator', () => {
itNoErrorsOnCurrentEnvironment(() => new EnvironmentValidator());
});

132
tests/unit/infrastructure/RuntimeSanity/Validators/MetadataValidator.spec.ts
View File

@@ -1,133 +1,7 @@
import { describe, it, expect } from 'vitest';
import { describe } from 'vitest';
import { MetadataValidator } from '@/infrastructure/RuntimeSanity/Validators/MetadataValidator';
import { SanityCheckOptionsStub } from '@tests/unit/shared/Stubs/SanityCheckOptionsStub';
import { itEachAbsentObjectValue } from '@tests/unit/shared/TestCases/AbsentTests';
import { AppMetadataStub } from '@tests/unit/shared/Stubs/AppMetadataStub';
import { IAppMetadata } from '@/infrastructure/Metadata/IAppMetadata';
import { itNoErrorsOnCurrentEnvironment } from './ValidatorTestRunner';
describe('MetadataValidator', () => {
describe('shouldValidate', () => {
it('returns true when validateMetadata is true', () => {
// arrange
const expectedValue = true;
const options = new SanityCheckOptionsStub()
.withValidateMetadata(true);
const validator = new TestContext()
.createSut();
// act
const actualValue = validator.shouldValidate(options);
// assert
expect(actualValue).to.equal(expectedValue);
});
it('returns false when validateMetadata is false', () => {
// arrange
const expectedValue = false;
const options = new SanityCheckOptionsStub()
.withValidateMetadata(false);
const validator = new TestContext()
.createSut();
// act
const actualValue = validator.shouldValidate(options);
// assert
expect(actualValue).to.equal(expectedValue);
});
});
describe('collectErrors', () => {
describe('yields "missing metadata" if metadata is not provided', () => {
itEachAbsentObjectValue((absentValue) => {
// arrange
const expectedError = 'missing metadata';
const validator = new TestContext()
.withMetadata(absentValue)
.createSut();
// act
const errors = [...validator.collectErrors()];
// assert
expect(errors).to.have.lengthOf(1);
expect(errors[0]).to.equal(expectedError);
});
});
it('yields missing keys if metadata has keys without values', () => {
// arrange
const expectedError = 'Metadata keys missing: name, homepageUrl';
const metadata = new AppMetadataStub()
.witName(undefined)
.withHomepageUrl(undefined);
const validator = new TestContext()
.withMetadata(metadata)
.createSut();
// act
const errors = [...validator.collectErrors()];
// assert
expect(errors).to.have.lengthOf(1);
expect(errors[0]).to.equal(expectedError);
});
it('yields missing keys if metadata has getters instead of properties', () => {
/*
This test may behave differently in unit testing vs. production due to how code
is transformed, especially around class getters and their enumerability during bundling.
*/
// arrange
const expectedError = 'Metadata keys missing: name, homepageUrl';
const stubWithGetters: Partial<IAppMetadata> = {
get name() {
return undefined;
},
get homepageUrl() {
return undefined;
},
};
const stub: IAppMetadata = {
...new AppMetadataStub(),
...stubWithGetters,
};
const validator = new TestContext()
.withMetadata(stub)
.createSut();
// act
const errors = [...validator.collectErrors()];
// assert
expect(errors).to.have.lengthOf(1);
expect(errors[0]).to.equal(expectedError);
});
it('yields unable to capture metadata if metadata has no getter values', () => {
// arrange
const expectedError = 'Unable to capture metadata key/value pairs';
const stub = {} as IAppMetadata;
const validator = new TestContext()
.withMetadata(stub)
.createSut();
// act
const errors = [...validator.collectErrors()];
// assert
expect(errors).to.have.lengthOf(1);
expect(errors[0]).to.equal(expectedError);
});
it('does not yield errors if all metadata keys have values', () => {
// arrange
const metadata = new AppMetadataStub();
const validator = new TestContext()
.withMetadata(metadata)
.createSut();
// act
const errors = [...validator.collectErrors()];
// assert
expect(errors).to.have.lengthOf(0);
});
});
itNoErrorsOnCurrentEnvironment(() => new MetadataValidator());
});
class TestContext {
public metadata: IAppMetadata = new AppMetadataStub();
public withMetadata(metadata: IAppMetadata): this {
this.metadata = metadata;
return this;
}
public createSut(): MetadataValidator {
const mockFactory = () => this.metadata;
return new MetadataValidator(mockFactory);
}
}

18
tests/unit/infrastructure/RuntimeSanity/Validators/ValidatorTestRunner.ts Normal file
View File

@@ -0,0 +1,18 @@
import { it, expect } from 'vitest';
import { ISanityValidator } from '@/infrastructure/RuntimeSanity/Common/ISanityValidator';
export function itNoErrorsOnCurrentEnvironment(
factory: () => ISanityValidator,
) {
if (!factory) {
throw new Error('missing factory');
}
it('it does report errors on current environment', () => {
// arrange
const validator = factory();
// act
const errors = [...validator.collectErrors()];
// assert
expect(errors).to.have.lengthOf(0);
});
}