From ef332ccae147078618a2e48021a0bef720f70c07 Mon Sep 17 00:00:00 2001 From: Ivan Date: Fri, 14 Aug 2026 11:09:50 -0500 Subject: [PATCH] chore: update docs --- .agents/conventions/android.md | 2 +- .../skills/android-webview-bridge/SKILL.md | 1 + .../skills/electron-frozen-packaging/SKILL.md | 1 + .../skills/plugin-install-security/SKILL.md | 1 + .agents/skills/url-origin-allowlists/SKILL.md | 14 +++++++++----- meshchatx.rsm | Bin 193489 -> 193489 bytes 6 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.agents/conventions/android.md b/.agents/conventions/android.md index 24cbdd42..891fa337 100644 --- a/.agents/conventions/android.md +++ b/.agents/conventions/android.md @@ -6,4 +6,4 @@ Applies when editing `android/**/*.{java,kt}`. - Set `EXTRA_ALLOW_MULTIPLE` only when the chooser mode is multi-open. - Prefer existing bridge patterns in `MainActivity` for storage, file pick, and push. - After Android bridge changes, note whether emulator smoke or unit coverage is needed. -- WebView navigation uses `RemoteBackendUrl.isAllowedShellNavigation` (backend origin only). Deny `data:` and userinfo. The JS bridge follows every loaded page. See `.agents/skills/url-origin-allowlists/SKILL.md`. +- WebView navigation uses `RemoteBackendUrl.isAllowedShellNavigation` (backend origin only). Deny `data:` and userinfo. Keep file access off and mixed content never-allow. The JS bridge follows every loaded page. See `.agents/skills/url-origin-allowlists/SKILL.md`. diff --git a/.agents/skills/android-webview-bridge/SKILL.md b/.agents/skills/android-webview-bridge/SKILL.md index 4624a49e..36a62bd7 100644 --- a/.agents/skills/android-webview-bridge/SKILL.md +++ b/.agents/skills/android-webview-bridge/SKILL.md @@ -32,6 +32,7 @@ Keep Chaquopy backend boot, WebView file choosers, storage locks, and external n - External http(s) links open in the system browser. Do not navigate the WebView away from the app. - `isAllowedWebViewNavigationUri` must call `RemoteBackendUrl.isAllowedShellNavigation`. Allow the configured backend origin, `about:blank`, and blobs whose inner origin matches the backend. - Deny `data:`, `javascript:`, `file:`, and userinfo URLs. The `MeshChatXAndroid` JS bridge is injected into every page the WebView loads. +- Keep `setAllowFileAccess(false)`, `setAllowFileAccessFromFileURLs(false)`, `setAllowUniversalAccessFromFileURLs(false)`, and `MIXED_CONTENT_NEVER_ALLOW`. File pickers use Intents, not WebView `file:` URLs. - Any loopback host on any port is not an allowlist. Remote-backend mode must not still permit `127.0.0.1:`. - Parse with `java.net.URI`. Reject `getUserInfo()`. Do not prefix-match `http://127.0.0.1`. - Vendored `lxmfy` and `rns_filesync` are synced into Chaquopy `src/main/python/`. Android pip does not install them like desktop setuptools. diff --git a/.agents/skills/electron-frozen-packaging/SKILL.md b/.agents/skills/electron-frozen-packaging/SKILL.md index 4561c957..04e4f67b 100644 --- a/.agents/skills/electron-frozen-packaging/SKILL.md +++ b/.agents/skills/electron-frozen-packaging/SKILL.md @@ -28,6 +28,7 @@ Package and recover the desktop shell correctly: frozen subprocess re-entry, loa - Attach `will-navigate`, `will-redirect`, `will-frame-navigate`, and `setWindowOpenHandler` on `web-contents-created` so popouts get the same guards. - Deny `will-attach-webview`. Deny `data:` in-window. Allow `blob:` only when the inner origin is the local backend. - Preload `window.electron` IPC runs only for `isTrustedShellOrigin` (file loading.html/crash.html, `127.0.0.1`/`localhost` port 9337, trusted blobs). +- `ipcMain` handlers must call `isTrustedIpcEvent` (sender frame URL, same allowlist). Do not rely on preload alone. - `safeExternalUrl` sends remaining http(s)/mailto to the OS browser. Do not replace the app window with external sites. - Close behaviour (quit / tray / ask) persists per user choice. Guard re-entrancy on close. diff --git a/.agents/skills/plugin-install-security/SKILL.md b/.agents/skills/plugin-install-security/SKILL.md index ce1f289b..9f8cd9a7 100644 --- a/.agents/skills/plugin-install-security/SKILL.md +++ b/.agents/skills/plugin-install-security/SKILL.md @@ -37,6 +37,7 @@ Plugins are powerful. Treat install and enable as security-sensitive. - Invalid RSG signatures **hard-block** install. Do not add bypass paths. - ZIP extract must use zip-slip safe extraction. WASM must pass `validate_wasm_file`. - New hooks go in `KNOWN_HOOKS`. New managers go in `KNOWN_MANAGERS` in `plugin_permissions.py`. +- Network endpoint scanning parses the URL host. A remote URL is not local because the string contains `127.0.0.1` or `localhost`. - Plugin i18n lives in the plugin bundle (`locales/{locale}.json`), not core `en.json`. - Disable everything with `--disable-plugins` / `MESHCHAT_DISABLE_PLUGINS=true` when diagnosing. diff --git a/.agents/skills/url-origin-allowlists/SKILL.md b/.agents/skills/url-origin-allowlists/SKILL.md index 3d4d8cce..8454da6f 100644 --- a/.agents/skills/url-origin-allowlists/SKILL.md +++ b/.agents/skills/url-origin-allowlists/SKILL.md @@ -1,6 +1,6 @@ --- name: url-origin-allowlists -description: Parse URL origins for shell and outbound allowlists. Never prefix-match http(s). Use when changing Electron navigation, Android WebView nav, preload IPC, or HTTP URL guards. +description: Parse URL origins for shell and outbound allowlists. Never prefix-match http(s). Use when changing Electron navigation, Android WebView nav, preload IPC, ipcMain handlers, or HTTP URL guards. --- # Skill: url-origin-allowlists @@ -9,7 +9,7 @@ Decide allow/deny from a parsed URL (scheme, host, port, userinfo), never from a ## When to use -- Electron `will-navigate`, `will-redirect`, `window.open`, preload IPC +- Electron `will-navigate`, `will-redirect`, `window.open`, preload IPC, ipcMain sender URL - Android WebView navigation or `JavascriptInterface` pages - Outbound HTTP allowlists (`http_url_guard`, community directory, remote backend URL) - Any new "is this our local backend?" helper @@ -23,8 +23,10 @@ Decide allow/deny from a parsed URL (scheme, host, port, userinfo), never from a 5. Deny `data:` and `javascript:` in app shells. Those pages still receive Electron preload or Android `addJavascriptInterface`. 6. Electron: attach guards on `web-contents-created` (every WebContents, including popouts). Handle `will-navigate`, `will-redirect`, and `will-frame-navigate`. Deny `will-attach-webview`. 7. Electron preload: no-op IPC unless `isTrustedShellOrigin` (`file:` loading.html/crash.html, local backend `:9337`, trusted blobs). -8. Android WebView: allow only `matchesBackend(url, resolveBackendUrl())`, `about:blank`, and blobs whose inner origin matches the backend. Any loopback host/port is not enough. -9. Hostname RFC1918 checks must require a dotted-quad IPv4 (or a parsed hostname), not `host.startsWith("10.")`. +8. Electron `ipcMain.handle`: reject unless `event.senderFrame.url` (fallback `sender.getURL()`) passes `isTrustedShellOrigin`. Preload checks are not enough. +9. Android WebView: allow only `matchesBackend(url, resolveBackendUrl())`, `about:blank`, and blobs whose inner origin matches the backend. Any loopback host/port is not enough. Keep `setAllowFileAccess(false)` and `MIXED_CONTENT_NEVER_ALLOW`. +10. Hostname RFC1918 checks must require a dotted-quad IPv4 (or a parsed hostname), not `host.startsWith("10.")`. +11. Plugin `network:fetch` scanning: parse the URL host. Do not treat a remote URL as local because the string contains `127.0.0.1` or `localhost`. ## Tests (oracle, not crash-only) @@ -40,12 +42,13 @@ Do not write exploit pages or PoCs. The oracle is accept/reject on the parser. ## Key files - `electron/shellOrigin.js` -- `electron/main.js` (`web-contents-created`) +- `electron/main.js` (`web-contents-created`, `trustedIpcHandle`) - `electron/preload.js` - `electron/safeExternalUrl.js` - `android/app/src/main/java/com/meshchatx/RemoteBackendUrl.java` - `meshchatx/src/frontend/js/remoteBackendUrl.js` - `meshchatx/src/backend/http_url_guard.py` +- `meshchatx/src/backend/plugin_permissions.py` (`_is_external_http_url`) - `tests/electron/mainHelpers.test.js` - `android/app/src/test/java/com/meshchatx/RemoteBackendUrlTest.java` @@ -53,4 +56,5 @@ Do not write exploit pages or PoCs. The oracle is accept/reject on the parser. - `.agents/skills/electron-frozen-packaging/SKILL.md` - `.agents/skills/android-webview-bridge/SKILL.md` +- `.agents/skills/plugin-install-security/SKILL.md` - `.agents/skills/test-oracles/SKILL.md` diff --git a/meshchatx.rsm b/meshchatx.rsm index d870781c5ab9217579459b30c638e4f9a1001e21..fff65432970dbe50afbdf81c1a827af4a5a19a9a 100644 GIT binary patch delta 472 zcmWNMF=&)Q5QV+-Oq8II6D5VBod`;HXJ=<;x?fHU(ITA?3A#JGTiJ+(7t}N)qFCA3NeV42gd^Y;X{;;~MgLblcwh0o&B@H>WTyFWZs*zAC3n6z`{K)) z#odkPTQ@!*JGFl}_isGee)sLf%GRZYeUIq(_-pUx)Z(4*x90#8 znOYCz%1jkuB-3uHi6BKqLkL`|6IX*8s8mAE6ik%ZD#X^T4Y9IEnn`L+UCNNo*`tXs?^qL4R$~@4OxKyAQ_y E0la;cApigX delta 472 zcmWNNy=#;~5XMOi337^Zl8{og5G!|QX5ZZzkeR%}%@YxBvTWygl>mPrLDW z+uOCH2VPzNF}wDwyYl78XZ!lx{M_Dl$BW_W^xVtkE1mD>@4bI|v+O(c?%VXz>BZx3 zCj0H|?h_{;+&H*v=cCcx;m`f^XD(j&^ki!E@&4gGA2yb+KfJckzcg$Mx{#VkXa&Gn z%VbgOHi=0^LA-5{Gla%N1aE>18VqYF+z0~QIW;~rSRLECrIm(?Iw+`;)r)i0Q#2X? z&QcXHhA0%RfhYn^pzIymfZqA!n>ZLv{2ObPl*pwf3wRHd9R{0