electron / electron/forge

New Electron Fuse `GrantFileProtocolExtraPrivileges` breaks `forge/plugin-webpack`'s (and potentially other plugins') entry points in production builds

Open
#3,508 3 comments 0 reactions 0 assignees View on GitHub
bug plugin/webpack
Dominant language
TypeScript
Stars
7.1k
Forks
641
Avg merge
3d 17m
Merged PRs (30d)
32

Description

### Pre-flight checklist

- [X] I have read the [contribution documentation](https://github.com/electron/forge/blob/main/CONTRIBUTING.md) for this project.
- [X] I agree to follow the [code of conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project uses.
- [X] I have searched the issue tracker for a bug that matches the one I want to file, without success.

### Electron Forge version

7.3.0

### Electron version

29.0.1

### Operating system

macOS Sonoma 14.3.1

### Last known working Electron Forge version

N/A

### Expected behavior

The Electron security recommendations state that we should serve all local files through custom protocols, and not use the file protocol. After the recent CVE-issue, I saw that Electron has added a new fuse to demote the `file`-protocol to a standard one without extra privileges.

This means that we should be able to overwrite the string constants that point to the various window entry points to use a custom protocol ourselves. This would mean a bit more boilerplate, but it should be fine. However, I was unable to find a way to provide a custom protocol setting for the Forge config, nor was there any indication in the docs of how to handle this.

### Actual behavior

When building an app package with the fuse setting `[FuseV1Options.GrantFileProtocolExtraPrivileges]: false`, the window code will not load and the console will print an access error.

Enabling that fuse (i.e., granting the file protocol extra privileges) makes the entry points usable again.

### Steps to reproduce

Use the webpack template, set the corresponding fuse, and build a full app. Attempt to run it, and observe the error appearing.

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.