セキュリティ [Electron]

セキュリティ

Checklist: Security Recommendations

You should at least follow these steps to improve the security of your application:

1. Only load secure content
2. Disable the Node.js integration in all renderers that display remote content
3. Enable context isolation in all renderers that display remote content
4. Use ses.setPermissionRequestHandler() in all sessions that load remote content
5. Do not disable webSecurity
6. Define a Content-Security-Policy and use restrictive rules (i.e. script-src ‘self’)
7. Do not set allowRunningInsecureContent to true
8. Do not enable experimental features
9. Do not use enableBlinkFeatures
10. <webview>: Do not use allowpopups
11. <webview>: Verify options and params
12. Disable or limit navigation
13. Disable or limit creation of new windows
14. Do not use openExternal with untrusted content
15. Use a current version of Electron

—— security.md

参考：

セキュリティを考える | 悠雀堂ブログ

Electron のセキュリティは難しい？ | DeNA Engineers’ Blog

electron/electron/security.md – Security, Native Capabilities, and Your Responsibility · electron/electron – GitHub

Web ビューをサンドボックス化する

参考：

セキュリティ項目の実装 | 悠雀堂ブログ

ローカルの画像が表示できない

参考：

9.0.0 does not display local images · Issue #23757 · electron/electron – GitHub

脆弱性

参考：

Electron におけるセキュリティ関連の Issue の再現 – GitHub Gist

webview タグの脆弱性

参考：

window.open allows a malicious script to read arbitrary local files · Issue #5151 · electron/electron – GitHub

file URI スキームの脆弱性

参考：

Disabling nodeintegration can be bypassed by loading remote scripts in Preload · Issue #5173 · electron/electron – GitHub