Skip to content

Commit

Permalink
Desktop: Re-enable UNC links (#10071)
Browse files Browse the repository at this point in the history
  • Loading branch information
personalizedrefrigerator authored Mar 7, 2024
1 parent 3177729 commit 9ef0a50
Showing 1 changed file with 5 additions and 13 deletions.
18 changes: 5 additions & 13 deletions packages/app-desktop/bridge.ts
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import ElectronAppWrapper from './ElectronAppWrapper';
import shim from '@joplin/lib/shim';
import { _, setLocale } from '@joplin/lib/locale';
import { BrowserWindow, nativeTheme, nativeImage, shell } from 'electron';
import { dirname, isUncPath, toSystemSlashes } from '@joplin/lib/path-utils';
import { dirname, toSystemSlashes } from '@joplin/lib/path-utils';
import { fileUriToPath } from '@joplin/utils/url';
import { urlDecode } from '@joplin/lib/string-utils';
import * as Sentry from '@sentry/electron/main';
Expand Down Expand Up @@ -84,11 +84,6 @@ export class Bridge {
return this.rootProfileDir_;
}

private logWarning(...message: string[]) {
// eslint-disable-next-line no-console
console.warn('bridge:', ...message);
}

public electronApp() {
return this.electronWrapper_;
}
Expand Down Expand Up @@ -331,13 +326,10 @@ export class Bridge {
fullPath = fileUriToPath(urlDecode(fullPath), shim.platformName());
}
fullPath = normalize(fullPath);
// On Windows, \\example.com\... links can map to network drives. Opening files on these
// drives can lead to arbitrary remote code execution.
const isUntrustedUncPath = isUncPath(fullPath);
if (isUntrustedUncPath) {
this.logWarning(`Not opening external file link: ${fullPath} -- it starts with two \\s, so could be to a network drive.`);
return 'Refusing to open file on a network drive.';
} else if (await pathExists(fullPath)) {

// Note: pathExists is intended to mitigate a security issue related to network drives
// on Windows.
if (await pathExists(fullPath)) {
return shell.openPath(fullPath);
} else {
return 'Path does not exist.';
Expand Down

0 comments on commit 9ef0a50

Please sign in to comment.