Secure IPC Communication

Technical Deep Dive & Specifications

Evolution of Electron Security Defaults

The 3-Tier Security Architecture

+-------------------------------------------------------------------------------+
|                               RENDERER CONTEXT                                |
|  - Sandboxed DOM & Window Scope                                               |
|  - Accessible APIs: `window.electronAPI.saveFile(content)`                   |
|  - Inaccessible: `require()`, `process`, `Buffer`, Node modules               |
+-------------------------------------------------------------------------------+
                                      |
                                      | (Structured Clone IPC)
                                      v
+-------------------------------------------------------------------------------+
|                           PRELOAD SCRIPT (Bridge)                             |
|  - Runs before DOM loads in isolated context                                  |
|  - Uses `contextBridge.exposeInMainWorld('electronAPI', { ... })`             |
|  - Mediates `ipcRenderer.invoke('channel', payload)`                          |
+-------------------------------------------------------------------------------+
                                      |
                                      | (Asynchronous IPC Pipe)
                                      v
+-------------------------------------------------------------------------------+
|                             MAIN PROCESS (Node.js)                            |
|  - Handles `ipcMain.handle('channel', (event, payload) => { ... })`           |
|  - Performs parameter validation, authorization, and OS Syscalls (fs, DB)     |
+-------------------------------------------------------------------------------+

Complete Implementation Blueprint

1. Main Process (main.js)

const { app, BrowserWindow, ipcMain, dialog } = require('electron');
const path = require('path');
const fs = require('fs/promises');

function createWindow() {
  const win = new BrowserWindow({
    width: 900,
    height: 600,
    webPreferences: {
      preload: path.join(__dirname, 'preload.js'),
      contextIsolation: true, // ALWAYS TRUE
      nodeIntegration: false, // ALWAYS FALSE
      sandbox: true           // ENFORCES OS SANDBOX
    }
  });

  win.loadFile('index.html');
}

// Secure IPC Handler with input validation
ipcMain.handle('fs:save-document', async (event, { filename, content }) => {
  // Validate sender
  if (!filename || typeof filename !== 'string') {
    throw new Error('Invalid filename argument.');
  }

  // Prevent path traversal attacks
  const safeFilename = path.basename(filename);
  const targetPath = path.join(app.getPath('documents'), safeFilename);

  await fs.writeFile(targetPath, content, 'utf8');
  return { success: true, savedPath: targetPath };
});

app.whenReady().then(createWindow);

2. Preload Bridge (preload.js)

const { contextBridge, ipcRenderer } = require('electron');

// Expose a strictly typed, limited API to the renderer
contextBridge.exposeInMainWorld('electronAPI', {
  saveDocument: (filename, content) => {
    return ipcRenderer.invoke('fs:save-document', { filename, content });
  },
  onSystemNotification: (callback) => {
    const subscription = (event, val) => callback(val);
    ipcRenderer.on('system-notify', subscription);
    // Return unsubscribe cleaner
    return () => ipcRenderer.removeListener('system-notify', subscription);
  }
});

💻 Interactive Code Playground

Below is an interactive IPC simulation sandbox modeling secure asynchronous message passing between a sandboxed HTML frontend and a mock main process.

Starter Code

Line-by-Line Code Breakdown

• Lines 144–157 (window.electronAPI.saveDocument): Implements the client-side bridge contract. Invokes a structured IPC channel rather than exposing raw filesystem handles.
• Lines 151–154 (Defensive Validation): Verifies that filenames do not contain relative directory hops (../), thwarting path traversal attacks.
• Lines 172–179 (Exploit Simulation): Demonstrates that when nodeIntegration: false is active, any injected script attempting typeof require evaluates safely to undefined.

Expected Browser Render Output

+-------------------------------------------------------------------------------+
| Secure IPC Bridge Simulator                                                   |
| Context Isolation: ACTIVE | Node Integration: DISABLED                        |
|                                                                               |
| RENDERER PROCESS (Sandboxed DOM)     | MAIN PROCESS SECURITY AUDIT LOG        |
| Target Document Name:                | [10:30:12 PM] [INFO] IPC_INVOKE:       |
| [ user_profile.json ]                | Channel: "fs:save-document"            |
| Payload Data:                        | [10:30:12 PM] [SUCCESS] MAIN_PROCESS:  |
| [ {"username": "ada_lovelace"} ]     | Wrote 46 bytes to storage              |
|                                      |                                        |
| [🔒 Call Bridge]  [⚠️ Attempt require] |                                        |
+-------------------------------------------------------------------------------+