Limiting In-app Navigation

[masood]

Summary:
Thank you for designing the Free Chess Club Desktop Application and making it open source and available. The application does a great job of using secure web preferences. However, We list pointers of concern below that can help make the application more secure.

1. Open the Free Chess Club Desktop Application from the command-line. Add a command-line switch --remote-debugging-port=8315 while running the application.
2. Open a web browser on the same device and visit localhost:8315. The application can be interacted with via the DevTools protocol.
3. [Access Arbitrary File] Within the console, update the location, say, `window.open(“file:///path/to/file”). The file at the given path is opened in a new window.
4. [Chrome/V8 Bugs]: The application can benefit from opening links outside of the application. Currently, clicking a link opens a site within a new window in the application. In the past, these have been known to be used to perform RCE by taking advantage of bugs within Chrome’s V8/Blink. [Link]

Thank you!

Platform(s) Affected:
Windows, MacOS

–
Mir Masood Ali, PhD student, University of Illinois at Chicago
Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago
Chris Kanich, Associate Professor, University of Illinois at Chicago
Jason Polakis, Associate Professor, University of Illinois at Chicago