Security fixes (#7615)

.github/workflows/nodejs.yml

@@ -8,30 +8,45 @@ on:
 defaults:
   run:
     shell: bash
+env:
+  NODE_VERSION: 18.x
 jobs:
   build:
     runs-on: ${{matrix.os}}
     strategy:
       matrix:
-        node-version: [16.x]
         os:
-          - macos-12
-          - ubuntu-18.04
+          - macos-latest
+          - ubuntu-latest
           - windows-latest
       fail-fast: false
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/checkout@v4
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
-          cache: yarn
-          cache-dependency-path: |
-            yarn.lock
-            app/yarn.lock
+          node-version: ${{ env.NODE_VERSION }}
+      - name: Fix node-gyp and Python
+        run: python3 -m pip install packaging setuptools
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+      - uses: actions/cache/restore@v3
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'app/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
       - name: Install
         run: yarn install
+        env:
+          npm_config_node_gyp: ${{ github.workspace }}${{ runner.os == 'Windows' && '\node_modules\node-gyp\bin\node-gyp.js' || '/node_modules/node-gyp/bin/node-gyp.js' }}
+      - name: Install libarchive-tools
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt update
+          sudo apt install libarchive-tools
       - name: Lint and Run Unit Tests
         run: yarn run test
       - name: Getting Build Icon
@@ -40,7 +55,14 @@ jobs:
           cp build/canary.ico build/icon.ico
           cp build/canary.icns build/icon.icns
       - name: Build
-        run: if [ ! -z "$CSC_LINK" ] ; then yarn run dist ; else unset CSC_LINK && unset WIN_CSC_LINK && yarn run dist --publish=never ; fi
+        run: |
+          if [ -z "$CSC_LINK" ] ; then unset CSC_LINK ; fi
+          if [ -z "$CSC_KEY_PASSWORD" ] ; then unset CSC_KEY_PASSWORD ; fi
+          if [ -z "$WIN_CSC_LINK" ] ; then unset WIN_CSC_LINK ; fi
+          if [ -z "$WIN_CSC_KEY_PASSWORD" ] ; then unset WIN_CSC_KEY_PASSWORD ; fi
+          if [ -z "$APPLE_ID" ] ; then unset APPLE_ID ; fi
+          if [ -z "$APPLE_APP_SPECIFIC_PASSWORD" ] ; then unset APPLE_APP_SPECIFIC_PASSWORD ; fi
+          yarn run dist
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CSC_LINK: ${{ secrets.MAC_CERT_P12_BASE64 }}
@@ -48,7 +70,7 @@ jobs:
           WIN_CSC_LINK: ${{ secrets.WIN_CERT_P12_BASE64 }}
           WIN_CSC_KEY_PASSWORD: ${{ secrets.WIN_CERT_P12_PASSWORD }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
       - name: Archive Build Artifacts
         uses: LabhanshAgrawal/upload-artifact@v3
         with:
@@ -58,12 +80,19 @@ jobs:
             dist/*.AppImage
             dist/*.deb
             dist/*.rpm
+            dist/*.pacman
             dist/*.exe
       - name: Run E2E Tests
         if: runner.os != 'Linux'
         run: yarn run test:e2e
+      - name: Run E2E Tests on Linux
+        if: runner.os == 'Linux'
+        uses: GabrielBB/xvfb-action@v1.6
+        with:
+          run: yarn run test:e2e
+        env:
+          SHELL: /bin/bash
       - name: Archive E2E test screenshot
-        if: runner.os != 'Linux'
         uses: actions/upload-artifact@v3
         with:
           name: e2e
@@ -79,3 +108,83 @@ jobs:
         with:
           name: pr_num
           path: ./pr_num.txt
+      - uses: actions/cache/save@v3
+        if: github.event_name == 'push'
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'app/yarn.lock') }}
+
+  build-linux-arm:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - name: armv7l
+            cpu: cortex-a8
+            image: raspios_lite:latest
+          - name: arm64
+            cpu: cortex-a53
+            image: raspios_lite_arm64:latest
+      fail-fast: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      - name: Fix node-gyp and Python
+        run: python3 -m pip install packaging setuptools
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+      - uses: actions/cache/restore@v3
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('yarn.lock', 'app/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+      - name: Install
+        run: |
+          yarn install
+          sudo apt update
+          sudo apt install libarchive-tools
+      - name: Compile
+        run: yarn run build
+      - name: rebuild node-pty
+        uses: pguyot/arm-runner-action@v2.5.2
+        with:
+          image_additional_mb: 2000
+          base_image: ${{ matrix.image }}
+          cpu: ${{ matrix.cpu }}
+          shell: bash
+          copy_artifact_path: target/node_modules/node-pty
+          copy_artifact_dest: target/node_modules
+          commands: |
+            wget https://nodejs.org/dist/v18.16.0/node-v18.16.0-linux-${{ matrix.name }}.tar.xz
+            tar -xJf node-v18.16.0-linux-${{ matrix.name }}.tar.xz
+            sudo cp node-v18.16.0-linux-${{ matrix.name }}/* /usr/local/ -R
+            npm run rebuild-node-pty
+      - name: chown node-pty
+        run: |
+          sudo chown -R $USER:$USER target/node_modules/node-pty
+      - name: Prepare v8 snapshot
+        if: matrix.name == 'armv7l'
+        run: |
+          sudo dpkg --add-architecture i386
+          sudo apt update
+          sudo apt install -y libglib2.0-0:i386 libexpat1:i386 libgcc-s1:i386
+          npm_config_arch=armv7l yarn run v8-snapshot:arch
+      - name: Build
+        run: yarn run electron-builder -l deb rpm AppImage pacman --${{ matrix.name }} -c electron-builder-linux-ci.json
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Archive Build Artifacts
+        uses: LabhanshAgrawal/upload-artifact@v3
+        with:
+          path: |
+            dist/*.snap
+            dist/*.AppImage
+            dist/*.deb
+            dist/*.rpm
+            dist/*.pacman

app/index.ts

@@ -25,11 +25,13 @@ import * as config from './config';
 // set up config
 config.setup();
 
+import notify from './notify';
 import * as plugins from './plugins';
 import {installCLI} from './utils/cli-install';
 import * as AppMenu from './menus/menu';
 import {newWindow} from './ui/window';
 import * as windowUtils from './utils/window-utils';
+import parseUrl from 'parse-url';
 
 const windowSet = new Set<BrowserWindow>([]);
 
@@ -233,6 +235,10 @@ app.on('open-file', (_event, path) => {
 
 app.on('open-url', (_event, sshUrl) => {
   GetWindow((win: BrowserWindow) => {
-    win.rpc.emit('open ssh', sshUrl);
+    try {
+      win.rpc.emit('open ssh', parseUrl(sshUrl));
+    } catch (e) {
+      notify('Invalid ssh url', 'Please check your ssh url and try again.', {error: e});
+    }
   });
 });

app/package.json

@@ -2,7 +2,7 @@
   "name": "hyper",
   "productName": "Hyper",
   "description": "A terminal built on web technologies",
-  "version": "3.4.0-canary.1",
+  "version": "3.4.1",
   "license": "MIT",
   "author": {
     "name": "ZEIT, Inc.",
@@ -24,7 +24,7 @@
     "mkdirp": "1.0.4",
     "ms": "2.1.3",
     "native-process-working-directory": "^1.0.2",
-    "node-pty": "0.11.0-beta26",
+    "node-pty": "0.10.1",
     "os-locale": "5.0.0",
     "parse-url": "8.1.0",
     "pify": "5.0.0",

app/ui/window.ts

@@ -275,22 +275,33 @@ export function newWindow(
     }
   });
 
-  const handleDrop = (event: Event, url: string) => {
+  const handleDroppedURL = (url: string) => {
     const protocol = typeof url === 'string' && new URL(url).protocol;
     if (protocol === 'file:') {
-      event.preventDefault();
       const path = fileURLToPath(url);
-      rpc.emit('session data send', {data: path, escaped: true});
+      return {data: path, escaped: true};
     } else if (protocol === 'http:' || protocol === 'https:') {
-      event.preventDefault();
-      rpc.emit('session data send', {data: url});
+      return {data: url};
     }
   };
 
   // If file is dropped onto the terminal window, navigate and new-window events are prevented
-  // and his path is added to active session.
-  window.webContents.on('will-navigate', handleDrop);
-  window.webContents.on('new-window', handleDrop);
+  // and it's path is added to active session.
+  window.webContents.on('will-navigate', (event, url) => {
+    const data = handleDroppedURL(url);
+    if (data) {
+      event.preventDefault();
+      rpc.emit('session data send', data);
+    }
+  });
+  window.webContents.setWindowOpenHandler(({url}) => {
+    const data = handleDroppedURL(url);
+    if (data) {
+      rpc.emit('session data send', data);
+      return {action: 'deny'};
+    }
+    return {action: 'allow'};
+  });
 
   // expose internals to extension authors
   window.rpc = rpc;

app/yarn.lock

@@ -470,7 +470,7 @@ ms@2.1.3:
   resolved "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz#574c8138ce1d2b5861f0b44579dbadd60c6615b2"
   integrity sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==
 
-nan@^2.17.0:
+nan@^2.14.0:
   version "2.17.0"
   resolved "https://registry.npmjs.org/nan/-/nan-2.17.0.tgz#c0150a2368a182f033e9aa5195ec76ea41a199cb"
   integrity sha512-2ZTgtl0nJsO0KQCjEpxcIr5D+Yv90plTitZt9JBfQvVJDS5seMl3FOvsh3+9CoYWXf/1l5OaZzzF6nDm4cagaQ==
@@ -504,12 +504,12 @@ node-gyp-build@4:
   resolved "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.3.0.tgz#9f256b03e5826150be39c764bf51e993946d71a3"
   integrity sha512-iWjXZvmboq0ja1pUGULQBexmxq8CV4xBhX7VDOTbL7ZR4FOowwY/VOtRxBN/yKxmdGoIp4j5ysNT4u3S2pDQ3Q==
 
-node-pty@0.11.0-beta26:
-  version "0.11.0-beta26"
-  resolved "https://registry.npmjs.org/node-pty/-/node-pty-0.11.0-beta26.tgz#59b58d5ebcf10cba1a85593b2f8395b22fa685c1"
-  integrity sha512-txc5z6KVdVKaEoybgN6NlS7ldZJyeFvhrkfafOsNm6IiLqhY5F0y+U4ZQeZpqU3hxDg708bwajoqyTpMYst6Ng==
+node-pty@0.10.1:
+  version "0.10.1"
+  resolved "https://registry.npmjs.org/node-pty/-/node-pty-0.10.1.tgz#cd05d03a2710315ec40221232ec04186f6ac2c6d"
+  integrity sha512-JTdtUS0Im/yRsWJSx7yiW9rtpfmxqxolrtnyKwPLI+6XqTAPW/O2MjS8FYL4I5TsMbH2lVgDb2VMjp+9LoQGNg==
   dependencies:
-    nan "^2.17.0"
+    nan "^2.14.0"
 
 normalize-path@^3.0.0, normalize-path@~3.0.0:
   version "3.0.0"

bin/notarize.js

@@ -1,4 +1,4 @@
-const { notarize } = require("electron-notarize");
+const { notarize } = require("@electron/notarize");
 
 exports.default = async function notarizing(context) {
   const { electronPlatformName, appOutDir } = context;

electron-builder-linux-ci.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json.schemastore.org/electron-builder",
+  "extends": "electron-builder.json",
+  "afterSign": null,
+  "npmRebuild": false
+}

electron-builder.json

@@ -17,42 +17,25 @@
       ]
     }
   ],
+  "artifactName": "${productName}-${version}-${arch}.${ext}",
   "linux": {
     "category": "TerminalEmulator",
     "target": [
-      {
-        "target": "deb",
-        "arch": [
-          "x64",
-          "arm64"
-        ]
-      },
-      {
-        "target": "AppImage",
-        "arch": [
-          "x64",
-          "arm64"
-        ]
-      },
-      {
-        "target": "rpm",
-        "arch": [
-          "x64",
-          "arm64"
-        ]
-      },
-      {
-        "target": "snap",
-        "arch": [
-          "x64"
-        ]
-      }
+      "deb",
+      "AppImage",
+      "rpm",
+      "snap",
+      "pacman"
     ]
   },
   "win": {
-    "target": [
-      "nsis"
-    ],
+    "target": {
+      "target": "nsis",
+      "arch": [
+        "x64",
+        "arm64"
+      ]
+    },
     "rfc3161TimeStampServer": "http://timestamp.comodoca.com"
   },
   "nsis": {

lib/actions/ui.ts

@@ -292,12 +292,17 @@ export function leaveFullScreen(): HyperActions {
   };
 }
 
-export function openSSH(url: string) {
+export function openSSH(parsedUrl: ReturnType<typeof parseUrl>) {
   return (dispatch: HyperDispatch) => {
     dispatch({
       type: UI_OPEN_SSH_URL,
       effect() {
-        const parsedUrl = parseUrl(url, true);
+        const resourseIsValid = /^(?!-)[\w.-]+$/.test(parsedUrl.resource);
+        if (!resourseIsValid) {
+          notify('Invalid ssh url', 'Please check your ssh url and try again.');
+          return;
+        }
+
         let command = `${parsedUrl.protocol} ${parsedUrl.user ? `${parsedUrl.user}@` : ''}${parsedUrl.resource}`;
 
         if (parsedUrl.port) command += ` -p ${parsedUrl.port}`;

lib/ext-modules.d.ts

@@ -2,10 +2,6 @@ declare module 'php-escape-shell' {
   export function php_escapeshellcmd(path: string): string;
 }
 
-declare module 'parse-url' {
-  export default function (...args: any[]): any;
-}
-
 declare module 'react-deep-force-update' {
   export default function (...args: any[]): any;
 }

lib/index.tsx

@@ -204,8 +204,8 @@ rpc.on('open file', ({path}) => {
   store_.dispatch(uiActions.openFile(path));
 });
 
-rpc.on('open ssh', (url) => {
-  store_.dispatch(uiActions.openSSH(url));
+rpc.on('open ssh', (parsedUrl) => {
+  store_.dispatch(uiActions.openSSH(parsedUrl));
 });
 
 rpc.on('update available', ({releaseName, releaseNotes, releaseUrl, canInstall}) => {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hyper",
-  "version": "3.4.0-canary.1",
+  "version": "3.4.1",
   "repository": "zeit/hyper",
   "scripts": {
     "start": "echo 'please run `yarn run dev` in one tab and then `yarn run app` in another one'",
@@ -39,7 +39,6 @@
     "ms": "2.1.3",
     "open": "8.4.0",
     "ora": "5.4.1",
-    "parse-url": "8.1.0",
     "php-escape-shell": "1.0.0",
     "react": "17.0.2",
     "react-deep-force-update": "2.1.3",
@@ -76,6 +75,7 @@
     "@babel/plugin-proposal-optional-chaining": "7.18.9",
     "@babel/preset-react": "7.18.6",
     "@babel/preset-typescript": "7.18.6",
+    "@electron/rebuild": "^3.3.0",
     "@types/args": "5.0.0",
     "@types/async-retry": "1.4.3",
     "@types/color": "3.0.3",
@@ -103,13 +103,11 @@
     "copy-webpack-plugin": "11.0.0",
     "cpy-cli": "^3.1.1",
     "cross-env": "7.0.3",
-    "electron": "20.3.6",
-    "electron-builder": "^23.3.3",
+    "electron": "22.3.25",
+    "electron-builder": "^24.6.4",
     "electron-devtools-installer": "3.2.0",
     "electron-link": "^0.6.0",
-    "electron-mksnapshot": "22.0.0",
-    "electron-notarize": "1.2.2",
-    "electron-rebuild": "3.2.9",
+    "electron-mksnapshot": "22.3.25",
     "electronmon": "^2.0.2",
     "eslint": "7.32.0",
     "eslint-config-prettier": "8.5.0",
@@ -119,8 +117,8 @@
     "husky": "8.0.2",
     "inquirer": "9.1.4",
     "node-addon-api": "5.0.0",
-    "node-gyp": "9.3.0",
     "null-loader": "4.0.1",
+    "parse-url": "8.1.0",
     "playwright": "1.27.1",
     "plist": "3.0.6",
     "prettier": "2.8.1",