Cmd click open finder

[DOsinga]

This is a dumb hidden feature that some people want and Goose could do while I made a coffee, but it fixes #3158

[zanesq]

Since this is exposed as an IPC the path can be compromised to show any directory on the machine. Maybe we should add an allowlist (or blocklist) so only appropriate files are opened? This and anywhere else that we open directories or list files through an IPC.

[michaelneale]

it is possible in electron to have ipc only available to the renderer so if so, that isn't an issue (checking)

[michaelneale]

yep seems ok: Electron's ipcMain and ipcRenderer communicate through Chromium's internal IPC system

## Security Analysis of Electron IPC Setup

### ✅ **Secure Configuration Found:**

1. **Context Isolation is Enabled** (`contextIsolation: true`)
   - This is the most critical security feature that prevents the renderer process from accessing Node.js APIs or Electron internals directly
   - The renderer can only access what's explicitly exposed through the context bridge

2. **Node Integration is Disabled** (`nodeIntegration: false`)
   - Prevents the renderer from having direct access to Node.js APIs
   - This is a crucial security measure to prevent arbitrary code execution

3. **Web Security is Enabled** (`webSecurity: true`)
   - Enforces same-origin policy and other web security features
   - Prevents loading of insecure content

4. **Preload Script with Context Bridge**
   - All IPC communication is channeled through a preload script (`preload.ts`)
   - Uses `contextBridge.exposeInMainWorld()` to expose only specific, controlled APIs
   - The exposed APIs are well-defined with type safety

5. **Controlled API Surface**
   - Only specific methods are exposed to the renderer through two APIs:
     - `window.electron`: Contains all IPC methods for file operations, settings, etc.
     - `window.appConfig`: Contains configuration data
   - Each exposed method is explicitly defined and typed

[zanesq]

Good call, I'll add some tests to ensure this never changes down the road also 👍

[michaelneale]

@zanesq oh yeah that would be stellar - as I am sure would be an easy mistake to make

[DOsinga]

Since this is exposed as an IPC the path can be compromised to show any directory on the machine

can you help me understand the line of attack here? even if an outside attacker would break into goose (at which point they have full control over the host machine anyway), if they would this trigger this end point, all it would do is start the finder in a particular directory. only the end user would be able to see that, no? not the attacker?

I'd love to understand security considerations with the electron app better as aI see some checks that I don't quite understand.

[michaelneale]

seems reasonable (and IPC thing doesn't look like it is an issue - good to check of course).