Security hardening and codebase cleanup

Security fixes:
- Replace Caesar cipher with electron.safeStorage for account credentials
- Validate shell.openExternal URLs (allow only http/https protocols)
- Remove rejectUnauthorized:false from all HTTPS calls
- Add redirect domain validation to auto-updater
- Fix XSS in matchmaker popup (innerHTML → textContent/createTextNode)
- Add IPC config key whitelist to prevent arbitrary store access
- Credentials never sent to renderer; decrypted on-demand via IPC

Optimizations and cleanup:
- Simplify onBeforeRequest from double-registration to single handler
- Lazy-init matchmaker popup DOM (defer until first use)
- Invalidate game config cache immediately on write, not on flush
- Remove unused STANDARD_ASSET_RE and KeybindDef exports
- Deduplicate Keybind type (import from config.ts)
- Replace custom hasOwn wrapper with Object.hasOwn

Bug fix:
- Stop Krunker's global keydown handler from eating keystrokes in
  alt manager input fields (stopPropagation)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

This commit is contained in:

bigjakk

2026-03-01 08:54:52 -08:00

parent 96e0cbfc07

commit 819caea65a

7 changed files with 218 additions and 108 deletions

									
										src/preload/utils.ts
									
		-7
	
												View File
												
				@@ -9,13 +9,6 @@ export interface SavedConsole {

				  error: (...args: unknown[]) => void;

				}

				export interface KeybindDef {

				  key: string;

				  ctrl: boolean;

				  shift: boolean;

				  alt: boolean;

				}

				// ── HTML escaping ──

				const HTML_ESCAPE_MAP: Record<string, string> = {