The webSecurity flag in Electron applications controls the security settings for web content.

Why is this an issue?

When this flag is disabled, it allows the application to load and execute content from any source, including potentially unsafe ones. This vulnerability can be exploited when a user interacts with untrusted web content, such as clicking on a malicious link or opening a compromised webpage. The attacker can then inject harmful scripts or code into the application, bypassing the usual security restrictions.

What is the potential impact?

When the webSecurity flag is disabled, it opens the door to various types of attacks that can compromise the integrity and security of the application and its users.

Code Execution

When the webSecurity flag is off, attackers can inject malicious scripts into the application and execute arbitrary code. These scripts can steal sensitive information such as user credentials or sessions, personal data, and financial information. This can lead to identity theft and financial loss for users.

Phishing Attacks

With the webSecurity flag disabled, attackers can create convincing phishing pages within the application. These pages can trick users into providing sensitive information, believing they are interacting with a legitimate part of the application.

How to fix it

Code examples

To fix the webSecurity flag vulnerability in Electron applications, you should not use the disablewebsecurity attribute for webview tags. The security restrictions on web content loaded by your application are enabled per default.

Noncompliant code example

<webview disablewebsecurity src="page.html"></webview><!-- noncompliant -->

Compliant solution

<webview src="page.html"></webview>

How does this work?

The compliant example does not disable websecurity. The default setting is secure.

Going the extra mile

A Content Security Policy helps prevent the injection of malicious content. Define a CSP that restricts the sources of content that can be loaded by your application.

mainWindow.webContents.session.webRequest.onHeadersReceived((details, callback) => {
  callback({
    responseHeaders: {
      ...details.responseHeaders,
      'Content-Security-Policy': ["default-src 'self'; script-src 'self' https://example.com"]
    }
  });
});

Resources

Documentation