Interactive_Data_Editor

Interactive_Data_Editor copied to clipboard

Summary: Thank you for designing the Interactive Data Editor Desktop Application making it open-source and available. The application is very useful in managing data files and editing graphs. We list pointers that can be taken as precautionary measures and help make the application more secure.

1. [Preventing In-app Navigation] Since the app does not need to support navigation, it will be useful to prevent all attempts at in-app navigation by adding a listener on will-navigate and a handler function on setWindowOpenHandler.
2. [Keeping up-to-date w/ Electron.js]: The application uses an old version of Electron.js (v16.0.5) and Chromium which is vulnerable to numerous known V8 and Blink attacks. Upgrading to an even newer version will be a great idea as well [Link]

Thank you!

Platform(s) Affected: Linux

– Mir Masood Ali, PhD student, University of Illinois Chicago Mohammad Ghasemisharif, PhD Candidate, University of Illinois Chicago Chris Kanich, Associate Professor, University of Illinois Chicago Jason Polakis, Associate Professor, University of Illinois Chicago