安全最佳实践 #

┌─────────────────────────────────────────────────────────────┐
│                    安全威胁与防护                            │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌─────────────┐         ┌─────────────┐                   │
│  │  渲染进程    │         │   主进程     │                   │
│  │             │         │             │                   │
│  │  隔离环境   │◄──IPC──►│  Node.js    │                   │
│  │  沙箱      │         │  完全权限    │                   │
│  └─────────────┘         └─────────────┘                   │
│        │                        │                          │
│        ▼                        ▼                          │
│  ┌─────────────────────────────────────┐                   │
│  │           安全防护措施               │                   │
│  │                                     │                   │
│  │  • 上下文隔离                        │                   │
│  │  • 禁用 Node.js 集成                 │                   │
│  │  • 内容安全策略 (CSP)                │                   │
│  │  • 预加载脚本白名单                  │                   │
│  │  • 安全的 IPC 通信                   │                   │
│  └─────────────────────────────────────┘                   │
│                                                             │
└─────────────────────────────────────────────────────────────┘

const mainWindow = new BrowserWindow({
    webPreferences: {
        // 必须启用的安全选项
        nodeIntegration: false,           // 禁用 Node.js 集成
        contextIsolation: true,           // 启用上下文隔离
        enableRemoteModule: false,        // 禁用 remote 模块
        sandbox: true,                    // 启用沙箱
        
        // 推荐的安全选项
        webSecurity: true,                // 启用 Web 安全
        allowRunningInsecureContent: false,  // 禁止加载不安全内容
        
        // 预加载脚本
        preload: path.join(__dirname, 'preload.js')
    }
});

<!-- index.html -->
<meta http-equiv="Content-Security-Policy" content="
    default-src 'self';
    script-src 'self';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: https:;
    font-src 'self' data:;
    connect-src 'self' https://api.example.com;
    frame-src 'none';
">

// 或在主进程中设置
session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
    callback({
        responseHeaders: {
            ...details.responseHeaders,
            'Content-Security-Policy': [
                "default-src 'self'; " +
                "script-src 'self'; " +
                "style-src 'self' 'unsafe-inline'"
            ]
        }
    });
});

// 禁用导航到外部 URL
mainWindow.webContents.on('will-navigate', (event, url) => {
    const parsedUrl = new URL(url);
    if (parsedUrl.origin !== 'app://-') {
        event.preventDefault();
    }
});

// 禁止打开新窗口
mainWindow.webContents.setWindowOpenHandler(({ url }) => {
    // 在默认浏览器中打开
    shell.openExternal(url);
    return { action: 'deny' };
});

// 禁用 webview 标签
const mainWindow = new BrowserWindow({
    webPreferences: {
        webviewTag: false
    }
});

// preload.js
const { contextBridge, ipcRenderer } = require('electron');

// 定义允许的频道白名单
const validChannels = {
    invoke: ['get-user', 'save-settings', 'read-file'],
    send: ['log-event', 'track-analytics'],
    receive: ['update-available', 'notification']
};

// 安全地暴露 API
contextBridge.exposeInMainWorld('electronAPI', {
    invoke: (channel, ...args) => {
        if (validChannels.invoke.includes(channel)) {
            return ipcRenderer.invoke(channel, ...args);
        }
        throw new Error(`Invalid channel: ${channel}`);
    },
    
    send: (channel, ...args) => {
        if (validChannels.send.includes(channel)) {
            ipcRenderer.send(channel, ...args);
        }
    },
    
    on: (channel, callback) => {
        if (validChannels.receive.includes(channel)) {
            const subscription = (event, ...args) => callback(...args);
            ipcRenderer.on(channel, subscription);
            
            // 返回取消订阅函数
            return () => {
                ipcRenderer.removeListener(channel, subscription);
            };
        }
    }
});

// preload.js
function validatePath(filePath) {
    const allowedDir = app.getPath('userData');
    const resolvedPath = path.resolve(filePath);
    
    if (!resolvedPath.startsWith(allowedDir)) {
        throw new Error('Access denied: path outside allowed directory');
    }
    
    return resolvedPath;
}

contextBridge.exposeInMainWorld('electronAPI', {
    readFile: async (filePath) => {
        const safePath = validatePath(filePath);
        return ipcRenderer.invoke('read-file', safePath);
    }
});

// main.js
const Joi = require('joi');

// 定义验证模式
const schemas = {
    'save-user': Joi.object({
        name: Joi.string().required(),
        email: Joi.string().email().required()
    }),
    'read-file': Joi.string().required()
};

// IPC 处理器
ipcMain.handle('save-user', async (event, data) => {
    // 验证数据
    const { error, value } = schemas['save-user'].validate(data);
    if (error) {
        throw new Error(`Validation error: ${error.message}`);
    }
    
    // 处理请求
    return await saveUser(value);
});

// 验证请求来源
ipcMain.handle('sensitive-action', (event, data) => {
    const webContents = event.sender;
    const win = BrowserWindow.fromWebContents(webContents);
    
    // 检查是否是预期的窗口
    if (win !== expectedWindow) {
        throw new Error('Unauthorized source');
    }
    
    // 处理请求
    return handleSensitiveAction(data);
});

// 不推荐：直接加载远程内容
// mainWindow.loadURL('https://example.com');

// 推荐：只加载本地内容
mainWindow.loadFile('index.html');

// 如果必须加载远程内容
const mainWindow = new BrowserWindow({
    webPreferences: {
        nodeIntegration: false,
        contextIsolation: true,
        sandbox: true,
        webSecurity: true,
        preload: path.join(__dirname, 'preload.js')
    }
});

// 验证 URL
mainWindow.loadURL('https://trusted-domain.com');

// 验证 URL 白名单
const allowedOrigins = [
    'https://api.example.com',
    'https://cdn.example.com'
];

function isAllowedOrigin(url) {
    try {
        const parsedUrl = new URL(url);
        return allowedOrigins.includes(parsedUrl.origin);
    } catch {
        return false;
    }
}

// 在请求前验证
session.defaultSession.webRequest.onBeforeRequest(
    { urls: ['*://*/*'] },
    (details, callback) => {
        if (!isAllowedOrigin(details.url)) {
            callback({ cancel: true });
        } else {
            callback({});
        }
    }
);

const Store = require('electron-store');
const crypto = require('crypto');

// 加密存储
const store = new Store({
    encryptionKey: process.env.ENCRYPTION_KEY || 'fallback-key'
});

// 或自定义加密
function encrypt(text, key) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    return iv.toString('hex') + ':' + encrypted;
}

function decrypt(text, key) {
    const [ivHex, encrypted] = text.split(':');
    const iv = Buffer.from(ivHex, 'hex');
    const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    return decrypted;
}

const fs = require('fs');

// 安全删除文件（多次覆写）
async function secureDelete(filePath, passes = 3) {
    const stats = await fs.promises.stat(filePath);
    const bufferSize = stats.size;
    
    for (let i = 0; i < passes; i++) {
        const randomData = crypto.randomBytes(bufferSize);
        await fs.promises.writeFile(filePath, randomData);
    }
    
    await fs.promises.unlink(filePath);
}

// 强制 HTTPS
app.on('web-contents-created', (event, contents) => {
    contents.on('will-navigate', (event, navigationUrl) => {
        const parsedUrl = new URL(navigationUrl);
        
        if (parsedUrl.protocol !== 'https:') {
            event.preventDefault();
        }
    });
});

// 自定义证书验证（仅用于开发）
if (isDev) {
    app.on('certificate-error', (event, webContents, url, error, certificate, callback) => {
        // 开发环境忽略证书错误
        event.preventDefault();
        callback(true);
    });
}

// 生产环境使用系统证书验证

const { net } = require('electron');

// 安全的网络请求
async function secureFetch(url, options = {}) {
    // 验证 URL
    if (!url.startsWith('https://')) {
        throw new Error('Only HTTPS is allowed');
    }
    
    const request = net.request({
        method: options.method || 'GET',
        url: url
    });
    
    // 设置安全头
    request.setHeader('Content-Type', 'application/json');
    
    return new Promise((resolve, reject) => {
        request.on('response', (response) => {
            let data = '';
            response.on('data', (chunk) => { data += chunk; });
            response.on('end', () => {
                resolve({
                    status: response.statusCode,
                    data: data
                });
            });
        });
        request.on('error', reject);
        request.end();
    });
}

const mainWindow = new BrowserWindow({
    webPreferences: {
        sandbox: true,  // 启用沙箱
        contextIsolation: true,
        nodeIntegration: false
    }
});

// 在单独的渲染进程中运行不受信任的代码
const untrustedWindow = new BrowserWindow({
    webPreferences: {
        sandbox: true,
        contextIsolation: true,
        nodeIntegration: false,
        webSecurity: true,
        allowRunningInsecureContent: false
    }
});

// 限制权限
untrustedWindow.webContents.session.setPermissionRequestHandler(
    (webContents, permission, callback) => {
        // 拒绝所有权限请求
        callback(false);
    }
);

- [ ] nodeIntegration: false
- [ ] contextIsolation: true
- [ ] enableRemoteModule: false
- [ ] sandbox: true
- [ ] webSecurity: true
- [ ] 设置 CSP
- [ ] 验证 IPC 数据
- [ ] 频道白名单

- [ ] 禁用 webviewTag
- [ ] 验证远程 URL
- [ ] 加密敏感数据
- [ ] 安全删除敏感文件
- [ ] 使用 HTTPS
- [ ] 限制权限请求
- [ ] 审计第三方依赖