diegosouzapw
|
d624ddde03
|
fix(electron): code review hardening — 16 fixes for security, performance, robustness
## Critical Fixes
- #1: Server readiness — waitForServer() polls before loading window
- #2: Restart timeout — 5s + SIGKILL prevents IPC handler from hanging
- #3: changePort — now stops/restarts server on new port
## Important Fixes
- #4: Tray cleanup — destroy old Tray before recreating
- #5: IPC emission — server-status & port-changed events
- #6: Disposer pattern — replaces removeAllListeners
- #7: useSyncExternalStore — eliminates 5x re-renders
## Minor: #8-#16 (dead code, CSP, platform titlebar, types, errors, version)
Tests: 76 / 15 suites (was 64/9)
|
2026-02-28 08:15:04 -03:00 |
|
diegosouzapw
|
d3ace8d611
|
fix: security hardening, tests, docs for Electron desktop & memory optimization
## Security Fixes
- Sanitize OMNIROUTE_MEMORY_MB with parseInt + range validation (64-16384)
to prevent command injection via spawn() args
- Validate URL protocol in shell.openExternal (http/https only)
to prevent RCE in Electron renderer compromise
- Bump default memory from 256MB to 512MB
## Electron package-lock.json
- Added to .gitignore (5278 lines removed from tracking)
## Test Suite (64 tests, 9 suites)
- electron-main.test.mjs: URL validation, IPC channels, window handler
- electron-preload.test.mjs: channel whitelist, API surface, open-external
- cli-memory.test.mjs: injection prevention, boundary values, .env parsing
## Documentation
- Desktop App section added to all 30 READMEs (9 fully translated)
- USER_GUIDE.md updated with 512MB default
- .env.example reflects new defaults
|
2026-02-28 07:59:38 -03:00 |
|