Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve ELECTRON_VERSION_CHECK #30

Closed
ikkisoft opened this issue Jan 16, 2019 · 1 comment
Closed

Improve ELECTRON_VERSION_CHECK #30

ikkisoft opened this issue Jan 16, 2019 · 1 comment

Comments

@ikkisoft
Copy link
Contributor

The current implementation of ELECTRON_VERSION_CHECK is using a static array for the "latest" versions (see safe_releases.json) - to compare the releases with the electron dependency in package.json (if present).

Ideally, we would want to improve this check in two ways:

  • Obtain the latest releases from the Electron Github/Website so that a new release won't require an update of this tool. Even better, we could warn the user if the version used is old AND contains security issues (this can be implemented by checking whether there're any [SECURITY] fixes in between releases - https://electronjs.org/releases )
  • Derive the current Electron version directly from the bundle (asar file), application binary, ...and all other possible ways (instead of just checking package.json). I have some ideas here - talk to @ikkisoft
@ikkisoft
Copy link
Contributor Author

Just to clarify, the current safe_releases.json is meant to contain versions that are not affected by known vulnerabilities - and not necessarily the latest versions of each release family.

This file is currently updated manually, but could be done programmatically (assuming Electron releases do always include the [SECURITY] tag)

phosphore added a commit that referenced this issue Apr 14, 2019
Introduce AVAILABLE_SECURITY_FIXES_GLOBAL_CHECK, resolves #30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant