Field["x"] tokens substituted into the body of an e v a l("...") or JS("...")
template were inserted as raw source. Because outputParameters values come
from scraped page content, any attacker controlling a crawled page could
break out of the surrounding string literal and execute arbitrary Python on
the user's machine (or arbitrary JS in the browser context).
Substitute Field["x"] inside Python expression bodies via repr() and inside
JS() bodies via json.dumps() so the scraped value is always a well-formed,
properly-escaped string literal that cannot escape its quoting. Field
expansions outside of those calls are still inserted as plain text.
The local Electron HTTP server (server.js) exposes endpoints that spawn
child processes (/executeTask), read/write task and config files
(/manageTask, /setUserDataFolder, /deleteTask), and otherwise perform
state-changing actions, but it has no authentication and previously sent
'Access-Control-Allow-Origin: *' on every response.
Because the server listens on a predictable local port, any website the
user visited could issue cross-origin POSTs to drive task creation and
execution (CWE-352 / CSRF).
This change:
- Removes the unconditional ACAO:* header.
- Echoes Access-Control-Allow-Origin only for loopback origins
(http(s)://localhost, 127.0.0.1, [::1]).
- Rejects requests with a non-local Origin header with HTTP 403.
- Handles CORS preflight (OPTIONS) safely.
- Binds the HTTP server (port 8074) and Express upload server
(port 8075) to 127.0.0.1 only, so they are not exposed on the LAN.
- Restricts the express 'cors' middleware to the same loopback allowlist.
Naibo Wang