Version: 0.18.0
contextIsolation: truenodeIntegration: falsesandbox: trueon BrowserWindow (preferred)- No remote module
- Preload is the only bridge; whitelist IPC channels
- Normalize and resolve paths in main before any IO
- Reject path segments that escape intended roots for protocol serving
- Symlinks:
statcarefully; do not follow symlinks out of allowlisted roots for protocol reads. Allowlist prefers the resolved realpath when available (a link whose target lies outside every approved root is denied even when the link path sits under an open tab). On UNC/SMB,realpathoften fails even for readable files — then the allowlist falls back to the lexical absolute path (still must sit in an approved dir). Long-path (\\?\UNC\…) and trailing-separator forms are normalized so mapped-drive vs Network-share browsing both work. - UNC paths allowed when user navigates to them; still validated as absolute
Renderer must not read arbitrary files via file://. Use mfe-media:// (name TBD) with main-side allowlist:
- Paths under currently open tab directories (and parents as needed for icons)
- Explicit preview target
- Thumb cache directory inside userData
- Custom tab icons directory
userData/tab-icons(D54)
Media metadata (D50) writes NTFS streams on the user-selected file/folder (and its parent container flag) only after a context-menu or preview action. Paths go through requireAbsolute like other FS IPC. Outbound TMDB / OMDb / Plex / Ask AI calls send titles (parsed from video filenames, folder titles after videos are confirmed, or typed Search-as text) — never file bytes, and never non-video basenames. See MEDIA_METADATA.md.
| Action | Guard |
|---|---|
| Trash | Paths must exist; basename/path validation |
| Permanent delete | Extra confirm for directories or multi-select (D7) |
| Move onto self / into own child | Reject |
| Paste overwrite | User confirmation |
Never delete userData internals via normal file UI unless user navigated there deliberately (treat like any folder — OK).
Scripts (D51): chrome is off until Settings → Scripting and AI → Enable scripting. Spawned as exe + argv (shell: false). Paths in --root / --input-list are requireAbsolute. AI HTTP is off unless Enable AI is on; generate/modify/fix never include user paths, listings, or file bytes. API keys use safeStorage. See SCRIPTS.md.
Prefer Electron / OS APIs for file lists. Do not execute clipboard text as paths without user paste action into the address bar or paste command.
Prefer maintained native modules; audit on upgrade. Sharp and better-sqlite3 (or equivalent) are expected natives — package with electron-builder unpack rules.