security: validate IPC file paths, sanitize viewer HTML, add CSP (port upstream #27)

eslint.config.js

@@ -132,6 +132,7 @@ const rendererCrossFileGlobals = {
   // Third-party renderer libs loaded as <script>
   morphdom: 'readonly',
   marked: 'readonly',
+  DOMPurify: 'readonly',
   ViewerPanel: 'readonly',
 
   // Switchboard preload bridge

ipc-path-validator.js

@@ -0,0 +1,77 @@
+// ipc-path-validator.js — path validation helpers for IPC file-access handlers.
+//
+// Two layers of defense:
+//   1. isSensitivePath   — denylist for well-known credential / secret files.
+//      Used by the file-panel handlers (read-file-for-panel, save-file-for-panel,
+//      watch-file) which intentionally accept arbitrary project paths (OSC 8
+//      hyperlinks from terminal output). Blocking a static denylist is lighter
+//      than allowlisting because the legitimate surface is unbounded.
+//
+//   2. isAllowedMemoryPath — strict allowlist for memory/plan handlers
+//      (read-memory, save-memory) that should only touch ~/.claude/ or active
+//      project directories.
+//
+// Both helpers resolve the incoming path (path.resolve) before comparing, so
+// ../traversal sequences are normalised before any check fires.
+
+'use strict';
+
+const os   = require('os');
+const path = require('path');
+
+const CLAUDE_DIR = path.join(os.homedir(), '.claude');
+
+// Patterns matching well-known credential / secret file locations.
+// A match on the resolved absolute path blocks the operation.
+const SENSITIVE_PATH_PATTERNS = [
+  /[/\\]\.ssh[/\\]/i,
+  /[/\\]\.gnupg[/\\]/i,
+  /[/\\]\.aws[/\\]credentials$/i,
+  /[/\\]\.env$/i,
+  /[/\\]\.env\.local$/i,
+  /[/\\]\.netrc$/i,
+  /[/\\]\.docker[/\\]config\.json$/i,
+  /[/\\]\.kube[/\\]config$/i,
+];
+
+/**
+ * Returns true when `filePath` resolves to a sensitive credential location.
+ *
+ * @param {string} filePath - Absolute or relative path from the renderer.
+ * @returns {boolean}
+ */
+function isSensitivePath(filePath) {
+  const resolved = path.resolve(filePath);
+  return SENSITIVE_PATH_PATTERNS.some(pattern => pattern.test(resolved));
+}
+
+/**
+ * Returns true when `filePath` is allowed for memory/plan read-write operations.
+ *
+ * Allowed roots:
+ *   - ~/.claude/  (and ~/.claude itself)
+ *   - any path in `activeProjectPaths`
+ *
+ * @param {string}   filePath           - Absolute or relative path from the renderer.
+ * @param {string[]} activeProjectPaths - Array of active project root paths.
+ * @returns {boolean}
+ */
+function isAllowedMemoryPath(filePath, activeProjectPaths) {
+  const resolved = path.resolve(filePath);
+
+  // Must start with CLAUDE_DIR + sep, or equal CLAUDE_DIR exactly.
+  if (resolved === CLAUDE_DIR || resolved.startsWith(CLAUDE_DIR + path.sep)) {
+    return true;
+  }
+
+  // Must start with an active project path + sep (strict prefix, not a substring).
+  for (const projectPath of activeProjectPaths) {
+    if (projectPath && resolved.startsWith(projectPath + path.sep)) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+module.exports = { isSensitivePath, isAllowedMemoryPath };

main.js

@@ -1,5 +1,5 @@
-const { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, screen, shell } = require('electron');
+const { app, BrowserWindow, clipboard, dialog, ipcMain, Menu, screen, session, shell } = require('electron');
 const { Worker } = require('worker_threads');
 const { execFile } = require('child_process');
 const path = require('path');
 const fs = require('fs');
@@ -16,7 +16,7 @@
 }
 
 // getFolderIndexMtimeMs moved to session-cache.js
 const { startMcpServer, shutdownMcpServer, shutdownAll: shutdownAllMcp, resolvePendingDiff, rekeyMcpServer, cleanStaleLockFiles } = require('./mcp-bridge');
 const { fetchAndTransformUsage } = require('./claude-auth');
 log.transports.file.level = app.isPackaged ? 'info' : 'debug';
 log.transports.console.level = app.isPackaged ? 'info' : 'debug';
@@ -36,9 +36,10 @@
 );
 
 // Shell profiles → shell-profiles.js
 const { discoverShellProfiles, getShellProfiles, resolveShell, isWindows, isWslShell, windowsToWslPath, shellArgs } = require('./shell-profiles');
 const { startScheduler } = require('./schedule-runner');
 const { encodeProjectPath } = require('./encode-project-path');
+const { isSensitivePath, isAllowedMemoryPath: _isAllowedMemoryPath } = require('./ipc-path-validator');
 
 
 
@@ -73,7 +74,7 @@
   getMeta, getAllMeta, toggleStar, setName, setArchived,
   isCachePopulated, getAllCached, getCachedByFolder, getCachedByParent, getCachedFolder, getCachedSession, upsertCachedSessions,
   deleteCachedSession, deleteCachedFolder, replaceSessionMetrics, touchCachedModified,
   getFolderMeta, getAllFolderMeta, setFolderMeta,
   upsertSearchEntries, updateSearchTitle, deleteSearchSession, deleteSearchFolder, deleteSearchType,
   searchByType, isSearchIndexPopulated, searchFtsRecreated,
   getSetting, setSetting, deleteSetting,
@@ -91,6 +92,31 @@
 const activeSessions = new Map();
 let mainWindow = null;
 
+// Wrapper that plumbs the set of known project roots into isAllowedMemoryPath.
+// The Plans/Memory panel (get-memories) surfaces CLAUDE.md / agents.md and
+// .claude/*.md from EVERY indexed project — not just ones with a live session —
+// so the allowlist must cover every known project root, otherwise reading a
+// memory file for a project without an open session would be rejected.
+function isAllowedMemoryPath(filePath) {
+  const projectPaths = new Set();
+  for (const [, s] of activeSessions) {
+    if (s.projectPath) projectPaths.add(s.projectPath);
+  }
+  // All indexed projects (same enumeration as the get-memories handler).
+  try {
+    const { deriveProjectPath } = require('./derive-project-path');
+    if (fs.existsSync(PROJECTS_DIR)) {
+      for (const d of fs.readdirSync(PROJECTS_DIR, { withFileTypes: true })) {
+        if (!d.isDirectory() || d.name === '.git') continue;
+        const folderPath = path.join(PROJECTS_DIR, d.name);
+        const p = deriveProjectPath(folderPath, d.name);
+        if (p) projectPaths.add(p);
+      }
+    }
+  } catch {}
+  return _isAllowedMemoryPath(filePath, [...projectPaths]);
+}
+
 // Subagent live-tail watchers (watchId → { filePath, parentSessionId, agentId, teardown })
 const subagentWatchers = new Map();
 let subagentWatcherSeq = 0;
@@ -290,8 +316,8 @@
     setFolderMeta, getAllFolderMeta, getAllMeta, getAllCached, getSetting, getMeta, setName,
   },
 });
 const { readSessionFile, readFolderFromFilesystem, refreshFolder, reconcileCacheFromFilesystem,
         buildProjectsFromCache, notifyRendererProjectsChanged, sendStatus, populateCacheViaWorker } = sessionCache;
 const { resolveJsonlPath, enumerateSessionFiles } = require('./read-session-file');
 
 
@@ -565,7 +591,9 @@
 
 ipcMain.handle('read-file-for-panel', async (_event, filePath) => {
   try {
-    const content = fs.readFileSync(filePath, 'utf8');
+    const resolved = path.resolve(filePath);
+    if (isSensitivePath(resolved)) return { ok: false, error: 'access to sensitive path denied' };
+    const content = fs.readFileSync(resolved, 'utf8');
     return { ok: true, content };
   } catch (err) {
     return { ok: false, error: err.message };
@@ -575,6 +603,7 @@
 ipcMain.handle('save-file-for-panel', async (_event, filePath, content) => {
   try {
     const resolved = path.resolve(filePath);
+    if (isSensitivePath(resolved)) return { ok: false, error: 'access to sensitive path denied' };
     if (!fs.existsSync(resolved)) return { ok: false, error: 'File does not exist' };
     fs.writeFileSync(resolved, content, 'utf8');
     return { ok: true };
@@ -588,6 +617,7 @@
 
 ipcMain.handle('watch-file', (_event, filePath) => {
   const resolved = path.resolve(filePath);
+  if (isSensitivePath(resolved)) return { ok: false, error: 'access to sensitive path denied' };
   if (fileWatchers.has(resolved)) return { ok: true };
   try {
     let debounce = null;
@@ -947,9 +977,8 @@
 ipcMain.handle('read-memory', (_event, filePath) => {
   try {
     const resolved = path.resolve(filePath);
-    // Allow paths under ~/.claude/ or any .md file that exists
     if (!resolved.endsWith('.md')) return '';
-    if (!resolved.startsWith(CLAUDE_DIR) && !fs.existsSync(resolved)) return '';
+    if (!isAllowedMemoryPath(resolved)) return '';
     return fs.readFileSync(resolved, 'utf8');
   } catch (err) {
     console.error('Error reading memory file:', err);
@@ -962,6 +991,7 @@
   try {
     const resolved = path.resolve(filePath);
     if (!resolved.endsWith('.md')) return { ok: false, error: 'not a .md file' };
+    if (!isAllowedMemoryPath(resolved)) return { ok: false, error: 'path not allowed' };
     if (!fs.existsSync(resolved)) return { ok: false, error: 'file does not exist' };
     fs.writeFileSync(resolved, content, 'utf8');
     return { ok: true };
@@ -1410,7 +1440,7 @@
   // WSL profiles only work for plain terminals — Claude CLI sessions need the
   // Windows shell because session data lives on the Windows filesystem.
   const requestedProfile = resolveShell(effectiveProfileId);
   const useWslProfile = isWslShell(requestedProfile.path) && isPlainTerminal;
   const shellProfile = (isWslShell(requestedProfile.path) && !isPlainTerminal)
     ? resolveShell('auto')
     : requestedProfile;
@@ -1885,6 +1915,20 @@
   });
 
   app.whenReady().then(() => {
+    // Content Security Policy — restrict what the renderer can load or execute.
+    // 'unsafe-inline' for style-src is required because the app sets .style.*
+    // properties via JavaScript and style.css uses data: URIs in background-image.
+    session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
+      callback({
+        responseHeaders: {
+          ...details.responseHeaders,
+          'Content-Security-Policy': [
+            "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' data:; font-src 'self'",
+          ],
+        },
+      });
+    });
+
     buildMenu();
     createWindow();
     startProjectsWatcher();

package.json

@@ -30,6 +30,7 @@
     "@xterm/addon-webgl": "^0.19.0",
     "@xterm/xterm": "^6.0.0",
     "better-sqlite3": "^12.0.0",
+    "dompurify": "^3.4.8",
     "electron-log": "^5.3.0",
     "electron-updater": "^6.3.0",
     "marked": "^17.0.4",

public/index.html

@@ -108,6 +108,7 @@
   <script src="../node_modules/@xterm/addon-unicode-graphemes/lib/addon-unicode-graphemes.js"></script>
   <script src="../node_modules/@xterm/addon-webgl/lib/addon-webgl.js"></script>
   <script src="../node_modules/morphdom/dist/morphdom-umd.js"></script>
+  <script src="../node_modules/dompurify/dist/purify.min.js"></script>
   <script src="codemirror-bundle.js"></script>
   <script src="icons.js"></script>
   <script src="viewer-toolbar.js"></script>

public/viewer-panel.js

@@ -344,7 +344,7 @@ class ViewerPanel {
     }
 
     if (this.previewMode) {
-      this.previewEl.innerHTML = window.marked.parse(newContent);
+      this.previewEl.innerHTML = DOMPurify.sanitize(window.marked.parse(newContent));
     }
   }
 

public/viewer-toolbar.js

@@ -44,7 +44,7 @@ function flashButtonText(btn, text, duration = 1200) {
 function toggleMarkdownPreview({ editorEl, previewEl, toggleBtn, editorView, isPreview, storageKey }) {
   if (!isPreview) {
     const content = editorView ? editorView.state.doc.toString() : '';
-    previewEl.innerHTML = window.marked.parse(content);
+    previewEl.innerHTML = DOMPurify.sanitize(window.marked.parse(content));
     editorEl.style.display = 'none';
     previewEl.style.display = 'block';
     toggleBtn.classList.add('active');