1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
/**
* The bridge, and the whole of it.
*
* `contextIsolation` puts this in its own world, so what is exposed here is all
* the page can reach — page script cannot read the closure, cannot replace
* these functions for other code, and cannot call an IPC channel that is not
* named below. That is what makes the enumeration meaningful rather than
* decorative.
*
* The rule for anything added here: **the renderer never names a path, a file
* handle or a process.** It asks for a dialog and receives an opaque id. The
* renderer parses decrypted content from nodes — video, images, filenames —
* which is attacker-controlled input, so it is treated as hostile even though
* it is our own code.
*/
'use strict';
const { contextBridge, ipcRenderer } = require('electron');
const HUB_BASE = (process.argv.find(a => a.startsWith('--meshbay-hub=')) || '')
.slice('--meshbay-hub='.length);
contextBridge.exposeInMainWorld('meshbay', {
// Where the hub is. The interface prefixes every API path with this; in a
// browser the same function returns '' and relative paths go to the origin
// that served the page.
//
// Read from a process argument, not over IPC: the interface asks for this
// while its modules are still loading, before anything can await, and
// synchronous IPC would block the renderer for a value that cannot change
// within a run.
hubBase: () => HUB_BASE,
setHubBase: (base) => ipcRenderer.invoke('hub:set', base),
// What this build can do that a browser cannot. The interface renders
// features gated on these nowhere at all in a browser, rather than offering
// something that fails when clicked.
capabilities: {
nodeAdmin: true,
localFolders: true,
nativeSave: true,
},
secrets: {
get: (name) => ipcRenderer.invoke('secrets:get', name),
set: (name, value) => ipcRenderer.invoke('secrets:set', name, value),
clear: (name) => ipcRenderer.invoke('secrets:clear', name),
// 'unprotected_fallback' means safeStorage found no keyring and is using a
// fixed key. Encrypted on disk, by a key that is not a secret — the
// interface says so rather than letting someone believe otherwise.
backend: () => ipcRenderer.invoke('secrets:backend'),
},
// A save dialog and a write that never passes back through the page. The
// renderer holds an id, not a path.
saveFile: async (suggestedName) => {
const handle = await ipcRenderer.invoke('save:begin', suggestedName);
if (!handle) return null;
return {
name: handle.name,
write: (chunk) => ipcRenderer.invoke('save:write', handle.id, chunk),
close: () => ipcRenderer.invoke('save:end', handle.id),
};
},
});
|