safetynet/apps/browser/startup-security.cjs

'use strict';
// Check only switch names. Arguments, paths, credentials and agent payloads never enter errors.
const BLOCKED_SWITCHES=Object.freeze([
  'no-sandbox','disable-gpu-sandbox','disable-web-security','allow-running-insecure-content',
  'ignore-certificate-errors','ignore-certificate-errors-spki-list','allow-insecure-localhost',
  'reduce-security-for-testing','unsafely-treat-insecure-origin-as-secure',
  'remote-debugging-port','remote-debugging-pipe','remote-debugging-socket-name',
  'load-extension','disable-extensions-except','disable-site-isolation-trials','disable-site-isolation-for-policy',
  'single-process','in-process-gpu','renderer-cmd-prefix','utility-cmd-prefix','gpu-launcher',
  'inspect','inspect-brk','inspect-wait','inspect-port','debug','debug-brk','debug-port'
]);
const failure=()=>{throw new Error('Unsafe browser startup configuration');};
function assertSecureStartup(commandLine,nodeExecArgv=process.execArgv,applicationArgv=process.argv){
  try{
    if(!commandLine||typeof commandLine.hasSwitch!=='function'||!Array.isArray(nodeExecArgv)||!Array.isArray(applicationArgv))return failure();
    for(const name of BLOCKED_SWITCHES){const present=commandLine.hasSwitch(name);if(typeof present!=='boolean'||present)return failure();}
    // Electron/Node can consume inspector flags before they reach Chromium's CommandLine.
    for(const argument of nodeExecArgv){if(typeof argument!=='string'||/^--(?:inspect(?:-brk|-wait|-port)?|debug(?:-brk|-port)?)(?:=|$)/.test(argument))return failure();}
    // User feature overrides can disable native enforcement. Inspect original argv,
    // not Electron's internally populated disable-features switch.
    for(const argument of applicationArgv){
      if(typeof argument!=='string')return failure();
      // Chromium trims Unicode whitespace before recognizing Windows switches.
      const normalized=argument.replace(/^[\s\p{White_Space}]+|[\s\p{White_Space}]+$/gu,'');
      if(/^(?:--?|\/)(?:disable-features|enable-features|disable-blink-features|enable-blink-features|enable-experimental-web-platform-features)(?:=|$)/i.test(normalized))return failure();
    }
    // NODE_OPTIONS can activate Node's inspector without appearing in process.execArgv.
    if(require('node:inspector').url())return failure();
    return true;
  }catch{return failure();}
}
module.exports={assertSecureStartup,BLOCKED_SWITCHES};