Harden Windows DLP enforcement and Electron runtime packaging

apps/browser/startup-security.cjs

@@ -2,18 +2,28 @@
 // Check only switch names. Arguments, paths, credentials and agent payloads never enter errors.
 const BLOCKED_SWITCHES=Object.freeze([
   'no-sandbox','disable-gpu-sandbox','disable-web-security','allow-running-insecure-content',
+  'ignore-certificate-errors','ignore-certificate-errors-spki-list','allow-insecure-localhost',
+  'reduce-security-for-testing','unsafely-treat-insecure-origin-as-secure',
   'remote-debugging-port','remote-debugging-pipe','remote-debugging-socket-name',
   'load-extension','disable-extensions-except','disable-site-isolation-trials','disable-site-isolation-for-policy',
   'single-process','in-process-gpu','renderer-cmd-prefix','utility-cmd-prefix','gpu-launcher',
   'inspect','inspect-brk','inspect-wait','inspect-port','debug','debug-brk','debug-port'
 ]);
 const failure=()=>{throw new Error('Unsafe browser startup configuration');};
-function assertSecureStartup(commandLine,nodeExecArgv=process.execArgv){
+function assertSecureStartup(commandLine,nodeExecArgv=process.execArgv,applicationArgv=process.argv){
   try{
-    if(!commandLine||typeof commandLine.hasSwitch!=='function'||!Array.isArray(nodeExecArgv))return failure();
+    if(!commandLine||typeof commandLine.hasSwitch!=='function'||!Array.isArray(nodeExecArgv)||!Array.isArray(applicationArgv))return failure();
     for(const name of BLOCKED_SWITCHES){const present=commandLine.hasSwitch(name);if(typeof present!=='boolean'||present)return failure();}
     // Electron/Node can consume inspector flags before they reach Chromium's CommandLine.
     for(const argument of nodeExecArgv){if(typeof argument!=='string'||/^--(?:inspect(?:-brk|-wait|-port)?|debug(?:-brk|-port)?)(?:=|$)/.test(argument))return failure();}
+    // User feature overrides can disable native enforcement. Inspect original argv,
+    // not Electron's internally populated disable-features switch.
+    for(const argument of applicationArgv){
+      if(typeof argument!=='string')return failure();
+      // Chromium trims Unicode whitespace before recognizing Windows switches.
+      const normalized=argument.replace(/^[\s\p{White_Space}]+|[\s\p{White_Space}]+$/gu,'');
+      if(/^(?:--?|\/)(?:disable-features|enable-features|disable-blink-features|enable-blink-features|enable-experimental-web-platform-features)(?:=|$)/i.test(normalized))return failure();
+    }
     // NODE_OPTIONS can activate Node's inspector without appearing in process.execArgv.
     if(require('node:inspector').url())return failure();
     return true;