导航、内容与系统能力的安全边界

'use strict';
const ASSETS = new Map([
  ['/index.html', 'index.html'],
  ['/renderer.js', 'renderer.js']
]);
function assetName(rawURL, method) {
  if (method !== 'GET' || typeof rawURL !== 'string') return null;
  try {
    const url = new URL(rawURL);
    if (url.protocol !== 'app:' || url.hostname !== 'ui' || url.port
        || url.username || url.password || url.search) return null;
    return ASSETS.get(url.pathname) || null; // 不把任意 URL 路径拼成磁盘路径
  } catch { return null; }
}
function externalDocsURL(rawURL) {
  if (typeof rawURL !== 'string' || rawURL.length > 2048) return null;
  try {
    const url = new URL(rawURL);
    if (url.protocol !== 'https:' || url.hostname !== 'www.electronjs.org'
        || url.port || url.username || url.password || url.search) return null;
    if (!/^\/docs\/latest\/[a-z0-9/_-]*$/i.test(url.pathname)) return null;
    return url.href;
  } catch { return null; }
}
function trustedFrame(event, owner) {
  return Boolean(owner && !owner.isDestroyed() && event.sender === owner.webContents
    && event.senderFrame && event.senderFrame === owner.webContents.mainFrame
    && event.senderFrame.origin === 'app://ui'
    && event.senderFrame.url === 'app://ui/index.html');
}
function allowPermission() {
  return false; // 本实验不需要摄像头、定位、浏览器剪贴板等权限
}
module.exports = { assetName, externalDocsURL, trustedFrame, allowPermission };

'use strict';
const assert = require('node:assert/strict');
const { assetName, externalDocsURL, allowPermission } = require('./policy.cjs');
assert.equal(assetName('app://ui/index.html', 'GET'), 'index.html');
assert.equal(assetName('app://ui/renderer.js', 'GET'), 'renderer.js');
for (const address of [
  'app://other/index.html', 'app://ui/package.json', 'app://ui/../main.cjs',
  'app://ui/%2e%2e/main.cjs', 'app://ui/index.html?file=secret'
]) assert.equal(assetName(address, 'GET'), null);
assert.equal(assetName('app://ui/index.html', 'POST'), null);
assert.equal(externalDocsURL('https://www.electronjs.org/docs/latest/tutorial/security'),
  'https://www.electronjs.org/docs/latest/tutorial/security');
for (const address of [
  'javascript:alert(1)', 'file:///secret.txt', 'data:text/html,hello',
  'https://www.electronjs.org.evil.invalid/docs/latest/',
  'https://evil@www.electronjs.org/docs/latest/',
  'https://www.electronjs.org:444/docs/latest/',
  'https://www.electronjs.org/docs/latest/../../other'
]) assert.equal(externalDocsURL(address), null);
assert.equal(allowPermission(), false);
console.log('通过：固定资源、方法限制、协议/主机/凭证/端口/路径边界');

{
  "name": "electron-security-lab",
  "version": "1.0.0",
  "private": true,
  "main": "main.cjs",
  "scripts": { "start": "electron .", "check": "node policy-check.cjs" },
  "devDependencies": { "electron": "44.3.0" }
}

'use strict';
const { app, BrowserWindow, protocol, session, ipcMain, shell } = require('electron');
const path = require('node:path');
const { readFile } = require('node:fs/promises');
const { assetName, externalDocsURL, trustedFrame, allowPermission } = require('./policy.cjs');
protocol.registerSchemesAsPrivileged([{
  scheme: 'app',
  privileges: { standard: true, secure: true, supportFetchAPI: true, corsEnabled: true }
}]);
let mainWindow = null;
let lastOpen = 0;
const fail = (code, message) => ({ ok: false, error: { code, message } });
const CSP = [
  "default-src 'none'", "script-src 'self'", "style-src 'self'",
  "img-src 'none'", "connect-src 'none'", "object-src 'none'",
  "base-uri 'none'", "frame-src 'none'", "frame-ancestors 'none'",
  "form-action 'none'"
].join('; ');

ipcMain.handle('security:open-docs', async (event, address) => {
  if (!trustedFrame(event, mainWindow)) return fail('FORBIDDEN', '来源不被允许');
  const target = externalDocsURL(address);
  if (!target) return fail('BAD_URL', '只允许指定范围的官方文档地址');
  if (Date.now() - lastOpen < 2000) return fail('RATE_LIMIT', '请稍后再打开');
  lastOpen = Date.now();
  try {
    await shell.openExternal(target);
    return { ok: true };
  } catch {
    return fail('OPEN_FAILED', '系统无法打开此地址');
  }
});
function createWindow(appSession) {
  const win = new BrowserWindow({
    width: 800, height: 560,
    webPreferences: {
      session: appSession,
      preload: path.join(__dirname, 'preload.cjs'),
      contextIsolation: true, sandbox: true, nodeIntegration: false,
      webSecurity: true, webviewTag: false
    }
  });
  mainWindow = win;
  // 页面发起的导航全部拒绝；主进程只加载下方固定入口。
  win.webContents.on('will-navigate', event => event.preventDefault());
  win.webContents.on('will-frame-navigate', event => event.preventDefault());
  win.webContents.on('will-redirect', event => event.preventDefault());
  win.webContents.on('will-attach-webview', event => event.preventDefault());
  win.webContents.setWindowOpenHandler(() => ({ action: 'deny' }));
  win.on('closed', () => {
    if (mainWindow === win) mainWindow = null;
  });
  void win.loadURL('app://ui/index.html').catch(error => {
    console.error('可信页面加载失败：', error.message);
    app.quit();
  });
}
app.whenReady().then(() => {
  const appSession = session.fromPartition('security-lab');
  appSession.setPermissionCheckHandler(() => allowPermission());
  appSession.setPermissionRequestHandler((_contents, _permission, callback) => {
    callback(allowPermission());
  });
  appSession.setDevicePermissionHandler(() => false);
  appSession.protocol.handle('app', async request => {
    const name = assetName(request.url, request.method);
    if (!name) return new Response('资源不被允许', { status: 403 });
    try {
      const bytes = await readFile(path.join(__dirname, name));
      const type = name.endsWith('.html') ? 'text/html; charset=utf-8' : 'text/javascript; charset=utf-8';
      return new Response(bytes, {
        headers: {
          'Content-Type': type,
          'Content-Security-Policy': CSP,
          'X-Content-Type-Options': 'nosniff'
        }
      });
    } catch {
      return new Response('资源加载失败', { status: 500 });
    }
  });
  createWindow(appSession);
  app.on('activate', () => {
    if (BrowserWindow.getAllWindows().length === 0) createWindow(appSession);
  });
}).catch(error => { console.error(error); app.quit(); });
app.on('window-all-closed', () => {
  if (process.platform !== 'darwin') app.quit();
});

'use strict';
const { contextBridge, ipcRenderer } = require('electron');
contextBridge.exposeInMainWorld('helpAPI', {
  openDocs: address => ipcRenderer.invoke('security:open-docs', address)
});

<!doctype html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>安全文本展示</title>
  <script src="./renderer.js" defer></script>
</head>
<body>
  <main>
    <h1>内容只作为文本</h1>
    <label for="source">输入要展示的内容</label>
    <textarea id="source" rows="5" cols="50"></textarea>
    <button id="render" type="button">展示原文</button>
    <button id="docs" type="button">在系统浏览器打开官方安全文档</button>
    <p id="status" role="status"></p>
    <pre id="output"></pre>
  </main>
</body>
</html>

'use strict';
const source = document.querySelector('#source');
const output = document.querySelector('#output');
const status = document.querySelector('#status');
source.value = '<img src=x onerror="alert(1)"> 这是一段外部文字';
function render() {
  output.textContent = source.value; // 不把外部文字交给 HTML 解析器
}
document.querySelector('#render').addEventListener('click', render);
document.querySelector('#docs').addEventListener('click', async () => {
  try {
    const reply = await window.helpAPI.openDocs(
      'https://www.electronjs.org/docs/latest/tutorial/security'
    );
    status.textContent = reply.ok ? '已请求系统浏览器打开' : reply.error.message;
  } catch { status.textContent = '打开文档通信失败'; }
});
render();

node policy-check.cjs
npm install
npm start