Skip to content

Commit d20306c

Browse files
fix(electron): resolve CodeQL alerts #22 and #25 in electron.js (#4136)
I reviewed the CodeQL alerts for `js/electron.js`: - [#25](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/25) https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/25 - [#22](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/22) https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/22 Both point to real bugs. - [#25](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/25): The window size fallback was written as a comma expression (`(800, 600)`), so it did not produce the expected object structure `{ width, height }`. I am not surprised it went unnoticed because it sits in a fallback path. - [#22](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/22): `...new Set(electronSwitchesDefaults, config.electronSwitches)` silently ignored the second parameter. As a result, custom `electronSwitches` were never applied. I am wondering: this has been broken since PR #2643 introduced it, so I'm quite sure it could not have worked as intended in that form. Why didn't anyone (not even @eouia) notice that? 🤔 ## Changes - Fix for [#25](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/25): - Corrects the fallback from `(800, 600)` to a valid size object `{ width: 800, height: 600 }`. - Fix for [#22](https://github.com/MagicMirrorOrg/MagicMirror/security/code-scanning/22): - Sets the default switch explicitly as a correct key-value pair: - `app.commandLine.appendSwitch("autoplay-policy", "no-user-gesture-required")` - Applies custom `config.electronSwitches` individually afterward.
1 parent 3335781 commit d20306c

1 file changed

Lines changed: 5 additions & 3 deletions

File tree

js/electron.js

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,17 @@ function createWindow () {
3636
* see https://www.electronjs.org/docs/latest/api/screen
3737
* Create a window that fills the screen's available work area.
3838
*/
39-
let electronSize = (800, 600);
39+
let electronSize = { width: 800, height: 600 };
4040
try {
4141
electronSize = electron.screen.getPrimaryDisplay().workAreaSize;
4242
} catch {
4343
Log.warn("Could not get display size, using defaults ...");
4444
}
4545

46-
let electronSwitchesDefaults = ["autoplay-policy", "no-user-gesture-required"];
47-
app.commandLine.appendSwitch(...new Set(electronSwitchesDefaults, config.electronSwitches));
46+
app.commandLine.appendSwitch("autoplay-policy", "no-user-gesture-required");
47+
for (const electronSwitch of (config.electronSwitches || [])) {
48+
app.commandLine.appendSwitch(electronSwitch);
49+
}
4850
let electronOptionsDefaults = {
4951
width: electronSize.width,
5052
height: electronSize.height,

0 commit comments

Comments
 (0)