Merge branch 'intercept-web-reqeusts'

1 files changed, 33 insertions, 0 deletions

diff --git a/gui/src/main/index.ts b/gui/src/main/index.ts
index a2e9a0560a..2db95816a0 100644
--- a/gui/src/main/index.ts
+++ b/gui/src/main/index.ts
@@ -356,6 +356,8 @@ class ApplicationMain {
     // fetching.  https://github.com/electron/electron/issues/22995
     session.defaultSession.setSpellCheckerDictionaryDownloadURL('https://00.00/');
 
+    this.blockRequests();
+
     this.updateCurrentLocale();
 
     this.daemonRpc.addConnectionObserver(
@@ -1362,6 +1364,37 @@ class ApplicationMain {
     }
   }
 
+  // Since the app frontend never performs any network requests, all requests originating from the
+  // renderer process are blocked to protect against the potential threat of malicious third party
+  // dependencies. There are a few exceptions which are described further down.
+  private blockRequests() {
+    session.defaultSession.webRequest.onBeforeRequest(
+      { urls: ['*://*/*'] },
+      (details, callback) => {
+        if (
+          process.env.NODE_ENV === 'development' &&
+          // Local web server providing assests (index.html, index.js and css files)
+          (details.url.startsWith('http://localhost:8080/') ||
+            // Automatic reloading performed by the browser-sync module
+            details.url.startsWith('http://localhost:35829/browser-sync/') ||
+            // Downloading of React and Redux developer tools.
+            details.url.startsWith('https://clients2.google.com') ||
+            details.url.startsWith('https://clients2.googleusercontent.com'))
+        ) {
+          callback({});
+        } else {
+          log.error(`${details.method} request blocked: ${details.url}`);
+          callback({ cancel: true });
+
+          // Throw error in development to notify since this should never happen.
+          if (process.env.NODE_ENV === 'development') {
+            throw new Error('Web request blocked');
+          }
+        }
+      },
+    );
+  }
+
   private async installDevTools() {
     // eslint-disable-next-line @typescript-eslint/no-var-requires
     const installer = require('electron-devtools-installer');