GHSA-v64r-4m7r-3mvq Electron: HTTP redirect followed into local file loader

• npm electron: < 39.8.8 → fixed in 39.8.8 • npm electron: >= 40.0.0-alpha.1, < 40.9.1 → fixed in 40.9.1 • npm electron: >= 41.0.0-alpha.1, < 41.2.1 → fixed in 41.2.1 • npm electron: >= 42.0.0-alpha.1, < 42.0.0-beta.3 → fixed in 42.0.0-beta.3

Impact When following HTTP redirects, `net.fetch()` and `net.request()` did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make `net` requests to attacker-influenced URLs with redirects followed (the default) and expose the response body. Apps that only request fixed, trusted URLs are not affected. Workarounds Set `redirect: 'error'` or `redirect: 'manual'` on requests to untrusted URLs and validate any redirect target before following it. Fixed Versions • `42.0.0-beta.3` • `41.2.1` • `40.9.0` • `39.8.8` For more information If you have any questions or comments about this advisory, email Electron at [email protected]