From Markdown to remote code execution in Atom

Re:From Markdown to remote code execution in Atom by jsnar on Thursday November 23, 2017 @09:16AM (#15765165)

Electron makes things worse: it is not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and 62

[ Parent | on HN ]

Re:From Markdown to remote code execution in Atom by megous on Thursday November 23, 2017 @10:13AM (#15765494)

As long as you don't load untrusted code or content... I guess many of the issues are moot if untrusted code can't get access to javascript and is only exposed to HTML parser (DOMParser).

The way I'm using electron for my pet projects is only passing untrusted HTML to DOMParser and then sanitizing with strict whitelist of attributes/html elements. Only then will any HTML code get interpreted by the browser engine.

Feels somewhat safe, but I haven't read the bug list. :)

Image format decoding and HTTP/TLS/request processing layer bugs may be other source of issues in any case. But hopefully that runs in some restricted environment.

[ Parent | on HN ]

Re:From Markdown to remote code execution in Atom by sigzero on Thursday November 23, 2017 @12:55PM (#15766698)

"As long as you don't load untrusted code or content..."

Because end users are soooo good at that?

[ Parent | on HN ]

Re:From Markdown to remote code execution in Atom by AgentME on Thursday November 23, 2017 @06:18PM (#15768477)

They're referring to the application developer.

If the developer uses Electron only to open the application's own html files and doesn't render user-provided HTML anywhere, then there won't be any XSS vulnerabilities.

[ Parent | on HN ]

Re:From Markdown to remote code execution in Atom by jsnar on Thursday November 23, 2017 @09:19AM (#15765190)

See here for the security issues published in Chrome stable releases in those versions:

https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googleblog.com/2017/09/stable-channel... https://chromereleases.googleblog.com/2017/10/stable-channel...

[ Parent | on HN ]