removed unsafe usage of shell.openExternal

altair-graphql · Sep 29, 2023 · 47aebc6 · 47aebc6
1 parent 654608e
commit 47aebc6
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 45 deletions.
diff --git a/packages/altair-app/src/app/modules/altair/components/fork-repo/fork-repo.component.ts b/packages/altair-app/src/app/modules/altair/components/fork-repo/fork-repo.component.ts
@@ -12,18 +12,9 @@ export class ForkRepoComponent {
   externalLink(e: Event, url: string) {
     e.preventDefault();
 
-    // If electron app
-    if (
-      (window as any).process &&
-      (window as any).process.versions['electron']
-    ) {
-      const electron = (window as any).require('electron');
-      electron.shell.openExternal(url);
-    } else {
-      const win = window.open(url, '_blank');
-      if (win) {
-        win.focus();
-      }
+    const win = window.open(url, '_blank');
+    if (win) {
+      win.focus();
     }
   }
 }
diff --git a/packages/altair-app/src/app/modules/altair/utils/events.ts b/packages/altair-app/src/app/modules/altair/utils/events.ts
@@ -31,18 +31,9 @@ export const handleExternalLinks = () => {
     }
     e.preventDefault();
 
-    // If electron app
-    if (
-      (window as any).process &&
-      (window as any).process.versions['electron']
-    ) {
-      const electron = (window as any).require('electron');
-      electron.shell.openExternal(url);
-    } else {
-      const win = window.open(url, '_blank');
-      if (win) {
-        win.focus();
-      }
+    const win = window.open(url, '_blank');
+    if (win) {
+      win.focus();
     }
   });
 };
diff --git a/packages/altair-app/src/app/modules/altair/utils/index.ts b/packages/altair-app/src/app/modules/altair/utils/index.ts
@@ -297,25 +297,9 @@ export function truncateText(text: string, maxLength = 70) {
 export const externalLink = (e: Event, url: string) => {
   e.preventDefault();
 
-  // If electron app
-  if (
-    (window as any).process &&
-    (window as any).process.versions.electron &&
-    isElectron
-  ) {
-    const electron = (window as any).require('electron');
-    if (electron) {
-      electron.shell.openExternal(url);
-    } else {
-      debug.log(
-        'cannot open link. Somehow electron is undefined. Please report this issue.'
-      );
-    }
-  } else {
-    const win = window.open(url, '_blank');
-    if (win) {
-      win.focus();
-    }
+  const win = window.open(url, '_blank');
+  if (win) {
+    win.focus();
   }
 };
 

diff --git a/packages/altair-electron/src/app/index.ts b/packages/altair-electron/src/app/index.ts
@@ -136,8 +136,19 @@ export class ElectronApp {
 
     app.on('web-contents-created', (event, contents) => {
       contents.setWindowOpenHandler(details => {
-        // Ask the operating system to open this event's url in the default browser.
-        shell.openExternal(details.url);
+        try {
+          log('Opening url', details.url);
+          // Ask the operating system to open this event's url in the default browser.
+          const url = new URL(details.url);
+          const supportedProtocols = ['http:', 'https:', 'mailto:'];
+          if (!supportedProtocols.includes(url.protocol)) {
+            log('Unsupported protocol', url.protocol);
+            return { action: 'deny' };
+          }
+          shell.openExternal(url.href);
+        } catch (err) {
+          log('Error opening url', err);
+        }
         return { action: 'deny' };
       });
     });