desktop: per-window permission handler on a shared Electron session gets overwritten #51748

Activity

1. github-actions

   assigned

   Brendonovich

   on Sep 28, 2026
2. github-actions commented on Sep 28, 2026

   

   github-actionsBot

   on Sep 28, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be related to an existing multi-window Electron issue. Please check:

   • #20371: It covers duplicate notifications across multiple Electron windows; this report describes a separate permission-handler overwrite, but both involve per-window handling in the multi-window desktop app.
3. opencodejr commented on Oct 28, 2026

   

   opencodejrBot

   on Oct 28, 2026

   Contributor

   More actions

   Thanks for the detailed source review. I can confirm the bug in 2.0.18, and it still happens on the latest dev (86ce19d96ecc).

   allowRendererPermissions(win) in packages/desktop/src/main/windows/security.ts sets the permission request handler and the permission check handler on win.webContents.session. Both only allow that window's webContents.id. Every window uses the default session, since none sets a partition. Each new window therefore replaces the previous handlers, and only the newest window passes the id check.

   The script below tests the real allowRendererPermissions against a stand-in for Electron's shared session and registers two windows. The second window gets notifications and clipboard-sanitized-write. The first window is refused both. I checked this with that stand-in only, not in the running desktop app, so a maintainer may still want to confirm it there with two windows open.

   Reproduction script (permissions.test.ts)

   // Reproduces #51748: allowRendererPermissions() installs per-window handlers on the
   // shared Electron session; Electron keeps only the last handler (set* replaces), so
   // earlier windows lose renderer permissions.
   // Run: SRC=/path/to/checkout bun test /workspace/repro/permissions.test.ts
   import { expect, mock, test } from "bun:test"
   
   mock.module("electron", () => ({ protocol: { registerSchemesAsPrivileged() {}, handle() {} }, app: {}, net: {} }))
   
   const src = process.env.SRC ?? "/workspace/repo"
   const { allowRendererPermissions } = await import(`${src}/packages/desktop/src/main/windows/security.ts`)
   
   // Fake of the shared default session: like Electron, setting a handler replaces the previous one.
   const session: any = {
     request: undefined as any,
     check: undefined as any,
     setPermissionRequestHandler(fn: any) { this.request = fn },
     setPermissionCheckHandler(fn: any) { this.check = fn },
   }
   const makeWin = (id: number) => ({ webContents: { id, session } }) as any
   
   const url = "oc://renderer/index.html"
   const ask = (id: number, permission: string) =>
     new Promise<boolean>((resolve) => session.request({ id }, permission, resolve, { requestingUrl: url, isMainFrame: true }))
   const check = (id: number, permission: string) => session.check({ id }, permission, url, { requestingUrl: url, isMainFrame: true })
   
   test("both renderer windows keep notification/clipboard permission", async () => {
     allowRendererPermissions(makeWin(1)) // first window
     allowRendererPermissions(makeWin(2)) // second window on the same session
     const result = {
       win1_request_notifications: await ask(1, "notifications"),
       win2_request_notifications: await ask(2, "notifications"),
       win1_check_clipboard: check(1, "clipboard-sanitized-write"),
       win2_check_clipboard: check(2, "clipboard-sanitized-write"),
     }
     console.log(src, result)
     expect(result).toEqual({
       win1_request_notifications: true,
       win2_request_notifications: true,
       win1_check_clipboard: true,
       win2_check_clipboard: true,
     })
   })

   Run it: bun permissions.test.ts
4. opencodejr

   added

   reproduced

   on Oct 28, 2026
5. Hona

   closed this as completedin #60458on Oct 30, 2026