fix: lock the desktop backend to the app's own origin (GHSA-frx8-qqgg-7j7g)

src/backend/tests/utils/cors-config.test.ts

@@ -1,6 +1,9 @@
 import { afterEach, describe, expect, it } from "vitest";
 import type { Request } from "express";
-import { isCorsOriginAllowed } from "../../utils/cors-config.js";
+import {
+  isCorsOriginAllowed,
+  isDesktopAppOrigin,
+} from "../../utils/cors-config.js";
 
 function request(headers: Record<string, string> = {}): Request {
   return {
@@ -11,6 +14,7 @@ function request(headers: Record<string, string> = {}): Request {
 
 afterEach(() => {
   delete process.env.CORS_ALLOWED_ORIGINS;
+  delete process.env.ELECTRON_EMBEDDED;
 });
 
 describe("isCorsOriginAllowed", () => {
@@ -41,4 +45,41 @@ describe("isCorsOriginAllowed", () => {
     const req = request({ host: "termix.example" });
     expect(isCorsOriginAllowed(req, "https://attacker.example")).toBe(false);
   });
+
+  describe("embedded desktop backend", () => {
+    it("rejects other websites even with no allowlist", () => {
+      process.env.ELECTRON_EMBEDDED = "true";
+      const req = request({ host: "127.0.0.1:30001" });
+      expect(isCorsOriginAllowed(req, "https://evil.example")).toBe(false);
+    });
+
+    it("still allows the desktop app and the dev server", () => {
+      process.env.ELECTRON_EMBEDDED = "true";
+      const req = request({ host: "127.0.0.1:30001" });
+      expect(isCorsOriginAllowed(req, "file://")).toBe(true);
+      expect(isCorsOriginAllowed(req, "http://localhost:5173")).toBe(true);
+      expect(isCorsOriginAllowed(req, undefined)).toBe(true);
+    });
+
+    it("allows an explicitly configured origin", () => {
+      process.env.ELECTRON_EMBEDDED = "true";
+      process.env.CORS_ALLOWED_ORIGINS = "https://portal.example";
+      expect(isCorsOriginAllowed(request(), "https://portal.example")).toBe(
+        true,
+      );
+    });
+  });
+});
+
+describe("isDesktopAppOrigin", () => {
+  it("accepts no origin, file:// and the dev server", () => {
+    expect(isDesktopAppOrigin(undefined)).toBe(true);
+    expect(isDesktopAppOrigin("file://")).toBe(true);
+    expect(isDesktopAppOrigin("http://127.0.0.1:5173")).toBe(true);
+  });
+
+  it("rejects websites", () => {
+    expect(isDesktopAppOrigin("https://evil.example")).toBe(false);
+    expect(isDesktopAppOrigin("null")).toBe(false);
+  });
 });