Handling localhost Links

[masood]

Summary:

While the ElectronMail Desktop Application does a great job of handling links that are clicked within the application, it does not completely filter these links to remove localhost.

Platform(s) Affected:

MacOS, Linux, Windows

Steps To Reproduce:

1. Open the ElectronMail Desktop Application.
2. Click on a link that includes a localhost server (say, http://localhost:8315/). The link is passed as is to the system since the application only checks the protocol [Link]
3. If a user has another application that runs on that port, it can be triggered from ElectronMail.

Additionally, the application does not include a listener on the will-navigate. While it uses additional handlers, it will be a good idea to add a listener to ensure this event is handled the same way that clicks are handled.

–

Mir Masood Ali, PhD student, University of Illinois at Chicago
Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago
Chris Kanich, Associate Professor, University of Illinois at Chicago
Jason Polakis, Associate Professor, University of Illinois at Chicago

[vladimiry]

The http://localhost:8315/ is a normal http-based link address, so links with such address get processed the same way as other http-based links.

Additionally, the application does not include a listener on the will-navigate. While it uses additional handlers, it will be a good idea to add a listener to ensure this event is handled the same way that clicks are handled.

Web page link clicking is opening its address in an external handler/browser, not in the webview itself. But will-navigate affects navigation of the app/@electron web page. So this is a different thing.

There are measures preventing fishy webview page loading (webview is where https://github.com/ProtonMail/WebClients/ client apps get loaded):

• Dynamically created webviews get processed by

  ElectronMail/src/electron-main/web-contents.ts

  Line 304 in c4f835f

  if (typeof bannedAccessMsg === "string") {

  and

  ElectronMail/src/electron-main/web-contents.ts

  Line 320 in c4f835f

  if (typeof bannedAccessMsg === "string") {

  This ensures that webview page gets loaded from the packaged into the app https://github.com/ProtonMail/WebClients/ static clients bundle.
• The Block non "API entry point"-based network requests feature can be explicitly enabled by a user on per-account base to prevent potential external requests initiated from the webview with loaded https://github.com/ProtonMail/WebClients client. This is a sort of firewall thing for those who keen on this stuff. There was an unintentional external request case in beta WebClients version (reported and fixed), but I believe that normally WebClients can be trusted.

[vladimiry]

Closing as responded.