Merge branch 'main' into chore-dependabot

addons/api/addon/adapters/application.js

@@ -3,7 +3,7 @@ import { serializeIntoHash } from '@ember-data/adapter/-private';
 /* eslint-disable-next-line ember/no-mixins */
 import AdapterBuildURLMixin from '../mixins/adapter-build-url';
 import config from 'ember-get-config';
-import { get, getWithDefault } from '@ember/object';
+import { get } from '@ember/object';
 import { InvalidError } from '@ember-data/adapter/error';
 import { dasherize } from '@ember/string';
 import { pluralize } from 'ember-inflector';
@@ -69,7 +69,7 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
    * @return {string}
    */
   urlSuffix(modelName, id, snapshot = {}) {
-    const method = getWithDefault(snapshot, 'adapterOptions.method', '');
+    const method = get(snapshot, 'adapterOptions.method') || '';
     return method ? `:${method}` : '';
   }
 

ui/desktop/electron-app/src/handlers.js

@@ -26,10 +26,19 @@ handle('resetOrigin', async (requestOrigin) => {
 });
 
 /**
- * Opens the specified URL in an external browser.
+ * Opens the specified URL in an external browser.  Only HTTPS URLs are allowed.
  */
 handle('openExternal', async (href) => {
-  shell.openExternal(href);
+  if (href.startsWith('https://')) {
+    // openExternal is necessary in order to display documentation and to
+    // support arbitrary OIDC flows.  The protocol is validated.
+    shell.openExternal(href); /* eng-disable OPEN_EXTERNAL_JS_CHECK */
+  } else {
+    throw new Error(
+      `URLs may only be opened over HTTPS in an external browser.
+       The URL '${href}' could not be opened.`
+    );
+  }
 });
 
 /**

ui/desktop/electron-app/src/index.js

@@ -55,7 +55,9 @@ app.on('ready', async () => {
   const ses = session.fromPartition(partition);
 
   // Register custom protocol
-  ses.protocol.registerFileProtocol(emberAppProtocol, (request, callback) => {
+  // This file protocol is the exclusive protocol for this application.  All
+  // other protocols are disabled.
+  ses.protocol.registerFileProtocol(emberAppProtocol, (request, callback) => { /* eng-disable PROTOCOL_HANDLER_JS_CHECK */
     const isDir = request.url.endsWith('/');
     const absolutePath = request.url.substr(emberAppURL.length);
     const normalizedPath = isDir
@@ -67,17 +69,16 @@ app.on('ready', async () => {
     callback({ path: normalizedPath });
   });
 
-  // Disallow all permissions requests originating outside of serve://boundary,
+  // Disallow all permissions requests,
   // per Electronegativity PERMISSION_REQUEST_HANDLER_GLOBAL_CHECK
-  ses.setPermissionRequestHandler((webContents, permission, callback) => {
-    if (webContents.getURL().startsWith('serve://boundary'))
-      return callback(false);
-    return callback(true);
+  ses.setPermissionRequestHandler((webContents, permission, callback) => { /* eng-disable PERMISSION_REQUEST_HANDLER_JS_CHECK */
+    return callback(false);
   });
 
   // Setup content security policy
   ses.webRequest.onHeadersReceived((details, callback) => {
     callback({
+      // See `content-security-policy.js` to learn how the CSP is generated.
       responseHeaders: {
         ...details.responseHeaders,
         'Content-Security-Policy': [generateCSPHeader()],
@@ -116,7 +117,9 @@ app.on('ready', async () => {
       nodeIntegration: false,
       enableRemoteModule: false,
       allowRunningInsecureContent: false,
-      preload: preloadPath,
+      // The preload script establishes the message-based IPC pathway without
+      // exposing new modules to the renderer.
+      preload: preloadPath, /* eng-disable PRELOAD_JS_CHECK */
       disableBlinkFeatures: 'Auxclick',
     },
   });
@@ -148,11 +151,10 @@ app.on('ready', async () => {
 
   // Prevent navigation outside of serve://boundary per
   // Electronegativity LIMIT_NAVIGATION_GLOBAL_CHECK
-  mainWindow.webContents.on('will-navigate', (event, url) => {
+  mainWindow.webContents.on('will-navigate', (event, url) => { /* eng-disable LIMIT_NAVIGATION_JS_CHECK */
     if (!url.startsWith('serve://boundary')) event.preventDefault();
   });
-
-  mainWindow.webContents.on('new-window', (event, url) => {
+  mainWindow.webContents.on('new-window', (event, url) => { /* eng-disable LIMIT_NAVIGATION_JS_CHECK */
     if (!url.startsWith('serve://boundary')) event.preventDefault();
   });
 

ui/desktop/package.json

@@ -37,7 +37,7 @@
     "posttest": "ember coverage-merge && yarn clean:coverage"
   },
   "devDependencies": {
-    "@doyensec/electronegativity": "^1.7.0",
+    "@doyensec/electronegativity": "^1.8.1",
     "@ember/jquery": "^1.1.0",
     "@ember/optional-features": "^2.0.0",
     "@ember/render-modifiers": "^1.0.2",

yarn.lock

@@ -1264,10 +1264,10 @@
   resolved "https://registry.yarnpkg.com/@doyensec/csp-evaluator/-/csp-evaluator-1.0.3.tgz#0d0405cbfb5bb814c24b8a73736a9700da2c681f"
   integrity sha512-Nz2QxdGiYh7nHgRU4R5/v6NDGW+IYv7j7dyQgpjtl4aJzrwHAdoZ0yxz7/YO8bgIOyDJJlF7jbUqjYpPClk9ZQ==
 
-"@doyensec/electronegativity@^1.7.0":
-  version "1.8.0"
-  resolved "https://registry.yarnpkg.com/@doyensec/electronegativity/-/electronegativity-1.8.0.tgz#b71f4836318010e3583a0c347d2660ef1e6bc6ef"
-  integrity sha512-TDil3r1l6mSZMXI8JsWLqY/B77PhoJQ9DeS4PoosL44R+uO+ZoclSg7HBFzGANU9SJ+19X2uwd4R1ufYEQJVfg==
+"@doyensec/electronegativity@^1.8.1":
+  version "1.8.1"
+  resolved "https://registry.yarnpkg.com/@doyensec/electronegativity/-/electronegativity-1.8.1.tgz#401561cb822afb978d0ee89a97e64746a2a34680"
+  integrity sha512-3J1seE0TzGOUBhxopixy/DX88uvf1ho+D6NfF4w7VU/fhIK9zIWcHyrLco0nmrUlL0cOxul1dhx5c6ySI4JyQw==
   dependencies:
     "@babel/parser" "^7.1.2"
     "@babel/traverse" "^7.3.4"