From 55f6f671613b78f54d86d598a209b088cd95097e Mon Sep 17 00:00:00 2001
From: Mieo234 <201042552+Mieo234@users.noreply.github.com>
Date: Mon, 19 Oct 2026 16:24:06 +0800
Subject: [PATCH] fix(electron): bind websocket on 8084 to loopback only
 (CWE-306)

The WebSocket server on port 8084 was created without a host option, so ws
bound to 0.0.0.0. Any device on the same LAN could connect, register itself as
the trusted flowchart socket (type 0 / id 2), then send type 7 and receive every
cookie of the automated browser session.

Bind to 127.0.0.1 so the port is no longer reachable from the network.

An Origin allowlist is deliberately not added: the extension content script
(Extension/manifest_v3/src/content-scripts/messageInteraction.js) connects from
every scraped page, so its Origin is the page's origin and cannot be
distinguished from a malicious page. Token auth for the type 7 path is left for
a follow-up PR.

Refs: #986
---
 ElectronJS/main.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ElectronJS/main.js b/ElectronJS/main.js
index 73344b2..881202d 100644
--- a/ElectronJS/main.js
+++ b/ElectronJS/main.js
@@ -1411,7 +1411,9 @@ function send_message_to_browser(message) {
 const WebSocket = require("ws");
 const {all} = require("express/lib/application");
 const {copy} = require("selenium-webdriver/io");
-let wss = new WebSocket.Server({port: websocket_port});
+// 8084 端口只服务本机页面与浏览器扩展，绑定到回环地址，避免同网段设备直连。
+// 见 issue #986：未限制监听地址时，任意局域网设备都能连上并窃取浏览器 Cookie。
+let wss = new WebSocket.Server({host: "127.0.0.1", port: websocket_port});
 wss.on("connection", function (ws) {
     ws.on("message", async function (message, isBinary) {
         let msg = JSON.parse(message.toString());