doyensec / electronegativity

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron applications.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Implement a new check related to Electron versioning

0xibram opened this issue · comments

what i have in mind is: if package.json is found in a directory or asar archive, use the check, otherwise, skip it. it would look for electron in the dependencies and then compare it to the latest version. the only thing we need to figure out is a way to fetch the latest electron version, any ideas?

Agree that it's ok implemented in this way:

  • Look in both dependencies and devDependencies
  • You can scrape it from https://electronjs.org/ or get it as they do

https://github.com/electron/electronjs.org/blob/02e0fda100e0a12913a90408abdb5eec546d7de4/middleware/context-builder.js

const stableRelease = releases.find(release => release.npm_dist_tag === 'latest')
 const betaRelease = releases.find(release => release.npm_dist_tag === 'beta')

I didnt know electron-releases existed, but looks like it’s gonna do the job. Do you know if the data get updated automatically or would i have to update the package itsef everytime to check for new releases?

No idea.

implemented in 56213fd