fix: enforce File System Access .git/hooks write block and hypervisor UNC shares (44-x-y) by claude[bot] · Pull Request #55330 · electron/electron

claude · 2026-10-25T23:01:46Z

This is the 44-x-y counterpart of #55328. Electron's own copy of Chrome's File System Access path matcher never checked the suffix rules, so Chrome's kBlockWrite rule for .git/hooks was not enforced, and it did not treat the hypervisor host-share UNC servers (mac, psf, vmware-host, .host, vboxsvr, vboxsrv) or trailing-dot server names as local. Unlike main, which switches Electron to upstream's matcher, this branch keeps Electron's own matcher and makes the smaller change of adding the missing checks. Following CL 8376681, suffix components are compared case-insensitively, and the UNC server handling follows CL 8424981. At this branch's Chromium version upstream applies the .git/hooks write block only to the save picker (UserAction::kSave), and the rule is Windows-only, so the practical effect here is the Windows save picker plus UNC paths. A new spec in spec/chromium.spec.ts checks that reading .git/hooks stays allowed, since the save picker cannot be driven from tests.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx

Generated by Claude Code

Notes: Fixed File System Access blocklist gaps for .git/hooks writes and hypervisor UNC shares.

claude · 2026-10-25T23:23:14Z

The latest run on 195c6e1 (40368092608) has finished. Every build and every Electron test shard passed. Only two jobs are red, and neither is caused by this PR:

lint: it failed before linting started. In "Download GN Binary", fetching Chromium's DEPS from api.github.com got curl: (22) The requested URL returned error: 429 four times, then exit code 22. I re-ran it once and it failed the same way, with four more 429s in the same step. This is branch-wide rate limiting, not a lint finding. Today's other PR runs hit it too: 44-x-y 40369870014 and 46-x-y 40368112560 show the same 429s, and in 43-x-y 40369720324 the downloaded src/DEPS contains 429: Too Many Requests. I'm not re-running it again.
linux-x64 nn-test (Run Node.js Tests): only parallel/test-datetime-change-notify fails. It expects /Irish Standard Time|Greenwich Mean Time/ and gets '10/26/2026, 5:37:43 PM GMT+00:00'. It's intermittent across today's runs: this PR's 43-x-y sibling 40368085243 fails it the same way, but other runs today pass it. I re-ran it once and it failed the same way again ('10/26/2026, 6:38:11 PM GMT+00:00'). This test doesn't touch anything this PR changes.

The new "applies Chrome's local UNC path rules" spec passed on both Windows shards that run chromium.spec.ts: windows-x64 test 2 (2672ms) and windows-arm64 test 2 (3005ms). On both, the trailing-dot \\localhost.\<share> sub-check was skipped with Skipping \\localhost.\efsa…, it does not resolve here, because that name doesn't resolve on the runners. All five "File System Access permission scope" tests passed on linux-x64 test 3, linux-arm64 test 3, linux-x64-asan test 3, windows-x64 and windows-arm64 test 2, macos-arm64 darwin 2 and mas 1, and macos-x64 darwin 1 and mas 1.

The asan, content-tracing, crash-reporter, app.relaunch, js2c and macOS build failures from the earlier runs did not happen on this run.

Generated by Claude Code

claude

I reviewed this backport and didn't find any bugs. It changes the File System Access blocklist, which is a security boundary, and I couldn't read the upstream Chrome code it copies, so a maintainer who knows the upstream matcher should also look at it.

What was reviewed (standalone clone, no Chromium tree available):

The suffix-rule loop in ShouldBlockAccessToPath: matching ignores case, every match is checked, and the rebuilt prefix path goes through the same nearest-ancestor logic as the regular rules.
The user_action parameter is passed through CheckPathAgainstBlocklist, both the immediate path and the deferred block_rules_check_callbacks_ path, down to the kBlockWrite filter. One consequence: a kBlockWrite rule outside the save picker no longer counts as a nearest ancestor that blocks access.
IsLocalUNCServer strips one trailing dot and then compares case-insensitively. The new spec collects events in its listener and only asserts afterwards.

Extended reasoning...

The change edits the File System Access permission context in shell/browser/file_system_access, the blocklist that decides which local paths a renderer may get file handles for. That makes it a permission-related security surface. The code says it mirrors Chrome CLs 8424981 and 8376681, but this checkout has no Chromium source, so I could not check the behavior against upstream's ShouldBlockAccessToPath. The C++ wiring looks consistent, and the new spec only covers reading a .git/hooks path, not the Windows save-picker or UNC cases. Because this is security-sensitive and the upstream match can't be verified here, it should get a human look rather than an automatic approval.

claude

Code review found no issues

No high-confidence issues detected in this change.

jkleinsc

failing CI test is fixed via #55335

… shares Electron's copy of ShouldBlockAccessToPath() never consulted suffix_block_path_rules_, so Chrome's Windows-only kBlockWrite rule for */.git/hooks was not enforced. Match Chrome's matcher at this branch's Chromium version: plumb the UserAction into the blocklist check, apply kBlockWrite rules only for UserAction::kSave, and evaluate suffix rules. Suffix components are compared case-insensitively, as Chrome does since crrev.com/c/8376681, because the rule targets Windows' case-insensitive file system. Also port IsLocalUNCServer() so that hypervisor host-share UNC servers (\\Mac, \\psf, \\vmware-host, \\.host, \\vboxsvr, \\vboxsrv) and trailing-dot server names are treated as local UNC paths on Windows. Upstream: - https://chromium-review.googlesource.com/c/chromium/src/+/8376681 - https://chromium-review.googlesource.com/c/chromium/src/+/8424981 Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx

…klist Shares a fixture directory over loopback SMB and pastes it under different UNC server and share names, checking that local server names (127.0.0.1, and a trailing-dot localhost when it resolves) and shares ending in '$', including drive admin shares, are blocked while other servers are not. The trailing-dot case pins down the intentional change from Electron's previous matcher. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01MtuMgvwAcw7t9Q6HEB31Vx

release-clerk · 2026-10-26T22:10:09Z

Release Notes Persisted

Fixed File System Access blocklist gaps for .git/hooks writes and hypervisor UNC shares.

##### [v44.10.1](https://github.com/electron/electron/releases/tag/v44.10.1) ### Release Notes for v44.10.1 #### Fixes - Fixed DevTools "Save" prompting for a location every time instead of reusing the previously chosen file. [#55484](electron/electron#55484) - Fixed DevTools "Save As" using the old file and Linux cancels treated as saved. - Fixed `webContents.adjustSelection()` ignoring the `end` option. [#55461](electron/electron#55461) (Also in [45](electron/electron#55462), [46](https://github.com/electron/electron/pull/55463)) #### Performance Improvements - Improved performance of `net.fetch()` requests without a body. [#55445](electron/electron#55445) (Also in [43](electron/electron#55447), [45](electron/electron#55446), [46](https://github.com/electron/electron/pull/55444)) - Improved performance of repeated `net.fetch()` calls for `file:` URLs. [#55458](electron/electron#55458) (Also in [45](electron/electron#55459), [46](https://github.com/electron/electron/pull/55457)) #### Other Changes - Backported fixes from upstream Chromium, Dawn, Skia and V8. [#55492](electron/electron#55492) ##### [v44.10.0](https://github.com/electron/electron/releases/tag/v44.10.0) ### Release Notes for v44.10.0 #### Features - Added filtering options to `session.registerPreloadScript` - `matches`, `excludeMatches`, `includeGlobs`, `excludeGlobs`, `matchOriginAsFallback`. [#55182](electron/electron#55182) (Also in [45](https://github.com/electron/electron/pull/55181)) #### Fixes - Fixed a crash on Linux when a D-Bus method call was made on a disconnected bus. [#55290](electron/electron#55290) (Also in [45](electron/electron#55292), [46](https://github.com/electron/electron/pull/55289)) - Fixed a main process crash when `onSendHeaders` observed Blob uploads. [#55168](electron/electron#55168) (Also in [45](https://github.com/electron/electron/pull/55169)) - Fixed `app.getLoginItemSettings()` not finding login items on Windows when the executable path contains spaces. [#55207](electron/electron#55207) (Also in [45](https://github.com/electron/electron/pull/54419)) - Fixed Europe/London and Europe/Dublin time zone names showing as "GMT+00:00" in winter by updating ICU to tzdata 2026e. [#55335](electron/electron#55335) - Fixed File System Access blocklist gaps for `.git/hooks` writes and hypervisor UNC shares. [#55330](electron/electron#55330) - Fixed handling of malformed asar archives whose size fields do not match the file length. [#55176](electron/electron#55176) (Also in [43](electron/electron#55179), [45](https://github.com/electron/electron/pull/55175)) - Fixed inconsistent handling of asar archive paths between the main process and child processes. [#55183](electron/electron#55183) (Also in [43](electron/electron#55185), [45](https://github.com/electron/electron/pull/55184)) - Fixed `Menu.popup()` on macOS sometimes not showing a menu after another closed. [#55325](electron/electron#55325) (Also in [45](electron/electron#55326), [46](https://github.com/electron/electron/pull/55324)) - Fixed MV3 extension events not arriving to background service workers. [#55152](electron/electron#55152) (Also in [43](electron/electron#55153), [45](https://github.com/electron/electron/pull/55154)) - Fixed paste hanging indefinitely on Linux X11 until the app was restarted. [#55327](electron/electron#55327) - Fixed `protocol.registerSource` schemes not applying the same fetch rules as `protocol.handle` schemes. [#55177](electron/electron#55177) (Also in [45](https://github.com/electron/electron/pull/55178)) - Fixed `utilityProcess` not emitting an `exit` event when the app quit while the process was still launching. [#55273](electron/electron#55273) (Also in [43](electron/electron#55272), [45](electron/electron#55274), [46](https://github.com/electron/electron/pull/55264)) #### Other Changes - Updated Chromium to 152.0.7977.169. [#55033](electron/electron#55033) - Updated Node.js to v24.22.1. [#55162](electron/electron#55162) ##### [v44.9.3](https://github.com/electron/electron/releases/tag/v44.9.3) ### Release Notes for v44.9.3 #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium, Skia and V8. [#55149](electron/electron#55149) ##### [v44.9.2](https://github.com/electron/electron/releases/tag/v44.9.2) ### Release Notes for v44.9.2 ##### [v44.9.1](https://github.com/electron/electron/releases/tag/v44.9.1) ### Release Notes for v44.9.1 > \[!NOTE] > This release contains the fix for <GHSA-jr5w-w6x2-84p9>, the mitigation for compromised eMudhra intermediate certificates ##### [v44.9.0](https://github.com/electron/electron/releases/tag/v44.9.0) ### Release Notes for v44.9.0 #### Features - Added app shims on macOS to show windows under another app's Dock icon. [#55073](electron/electron#55073) (Also in [45](https://github.com/electron/electron/pull/55072)) #### Fixes - Fixed link-opened windows not using the opener's session and `webPreferences`. [#55048](electron/electron#55048) (Also in [42](electron/electron#55050), [43](electron/electron#55049), [45](https://github.com/electron/electron/pull/55051)) - Fixed `setCertificateVerifyProc` occasionally not being applied to a request issued concurrently with the first request to a host. [#55046](electron/electron#55046) (Also in [42](electron/electron#55054), [43](electron/electron#55047), [45](https://github.com/electron/electron/pull/55045)) ##### [v44.8.0](https://github.com/electron/electron/releases/tag/v44.8.0) ### Release Notes for v44.8.0 #### Features - Added support for `Notification` action buttons on Linux. [#54890](electron/electron#54890) (Also in [45](https://github.com/electron/electron/pull/54889)) #### Fixes - Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. [#54987](electron/electron#54987) - Fixed `net.fetch` and `session.fetch` failing permanently with `net::ERR_FAILED` after the Network Service process restarts. [#54909](electron/electron#54909) (Also in [42](electron/electron#54925), [43](electron/electron#54908), [45](https://github.com/electron/electron/pull/54910)) - Fixed `utilityProcess` dropping messages posted with `process.parentPort.postMessage()` right before the process exits. [#54960](electron/electron#54960) (Also in [42](electron/electron#55000), [43](electron/electron#54962), [45](https://github.com/electron/electron/pull/54956)) - Fixed `win.isFullScreen()` being stale in fullscreen events on Windows. [#55009](electron/electron#55009) (Also in [45](https://github.com/electron/electron/pull/55008)) #### Other Changes - Backported fixes from upstream Chromium and V8. [#55034](electron/electron#55034) - Updated Chromium to 152.0.7977.167. [#54928](electron/electron#54928) - Updated Node.js to v24.22.0. [#55004](electron/electron#55004) ##### [v44.7.2](https://github.com/electron/electron/releases/tag/v44.7.2) ### Release Notes for v44.7.2 #### Fixes - Fixed an issue where clicks posted to a background app were dropped on macOS. [#54819](electron/electron#54819) (Also in [45](https://github.com/electron/electron/pull/54818)) - Fixed interrupted macOS updates leaving a broken app behind. [#54844](electron/electron#54844) (Also in [45](https://github.com/electron/electron/pull/54843)) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, PDFium and V8. [#54898](electron/electron#54898) #### Documentation - Documentation changes: [#54880](electron/electron#54880) ##### [v44.7.1](https://github.com/electron/electron/releases/tag/v44.7.1) ### Release Notes for v44.7.1 #### Fixes - Fixed a crash when starting without an available display server on Linux. [#54794](electron/electron#54794) (Also in [45](https://github.com/electron/electron/pull/54781)) - Fixed a Linux crash creating a window with a menu bar when GTK failed to load. [#54859](electron/electron#54859) (Also in [45](https://github.com/electron/electron/pull/54846)) - Fixed a `WebContentsView` that was removed with `removeChildView()` and re-added with `addChildView()` staying hidden behind its sibling views on Linux. [#54798](electron/electron#54798) - Fixed asar archives in non-ASCII folders failing to load on Linux. [#54849](electron/electron#54849) (Also in [45](https://github.com/electron/electron/pull/54848)) - Fixed renderer crashes during garbage collection inside ShadowRealms. [#54865](electron/electron#54865) (Also in [45](https://github.com/electron/electron/pull/54864)) #### Other Changes - Refactored mouse forwarding on Windows to fix `setIgnoreMouseEvents(true, { forward: true })` related issues. [#54802](electron/electron#54802) (Also in [45](https://github.com/electron/electron/pull/54803)) - Updated Chromium to 152.0.7977.149. [#54085](electron/electron#54085) ##### [v44.7.0](https://github.com/electron/electron/releases/tag/v44.7.0) ### Release Notes for v44.7.0 #### Features - The macOS `autoUpdater` now streams update downloads to disk, resumes an interrupted download on the next check instead of starting over, and applies a binary delta when the update feed offers one for the running version. [#54204](electron/electron#54204) #### Fixes - Fixed an uncatchable TypeError in `net.fetch` when receiving response headers with non-ASCII characters, and preserved multiple Set-Cookie headers. [#54672](electron/electron#54672) #### Other Changes - Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. [#54666](electron/electron#54666) - Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. [#54657](electron/electron#54657) ##### [v44.6.0](https://github.com/electron/electron/releases/tag/v44.6.0) ### Release Notes for v44.6.0 #### Features - Added the experimental `protocol.registerSource()` to serve a custom scheme from directories on disk without a JavaScript handler. [#54522](electron/electron#54522) (Also in [45](https://github.com/electron/electron/pull/54521)) #### Fixes - Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. [#54596](electron/electron#54596) - Fixed a crash on `navigator.usb.requestDevice()` in in-memory sessions. [#54616](electron/electron#54616) (Also in [45](https://github.com/electron/electron/pull/54615)) - Fixed `webview.findInPage()` hanging when the host page also has an iframe. [#54586](electron/electron#54586) (Also in [43](electron/electron#54584), [45](https://github.com/electron/electron/pull/54585)) - Updated time zone data to tzdata 2026d, including British Columbia's move to permanent UTC-7. [#54623](electron/electron#54623) #### Documentation - Documentation changes: [#54589](electron/electron#54589)

claude Bot added 44-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes labels Oct 25, 2026

claude Bot marked this pull request as ready for review October 26, 2026 00:44

claude Bot commented Oct 26, 2026

View reviewed changes

MarshallOfSound approved these changes Oct 26, 2026

View reviewed changes

claude Bot commented Oct 26, 2026

View reviewed changes

jkleinsc approved these changes Oct 26, 2026

View reviewed changes

claude added 2 commits October 26, 2026 20:57

claude Bot force-pushed the security-fix/44-x-y/fsa-upstream-matcher branch from 195c6e1 to 1309f8f Compare October 26, 2026 20:59

jkleinsc enabled auto-merge (squash) October 26, 2026 21:09

jkleinsc merged commit dce120a into 44-x-y Oct 26, 2026
67 checks passed

jkleinsc deleted the security-fix/44-x-y/fsa-upstream-matcher branch October 26, 2026 22:10

electron-release-board Bot added this to 44-x-y Oct 26, 2026

matbrgz mentioned this pull request Nov 3, 2026

Desktop Plus 3.6.10 ships Electron 44.9.1; please bump to 44.10.1 (Chromium security backports) desktop-plus/desktop-plus#308

Closed

1 task done

Navigation Menu

Repository navigation

fix: enforce File System Access .git/hooks write block and hypervisor UNC shares (44-x-y) - #55330

fix: enforce File System Access .git/hooks write block and hypervisor UNC shares (44-x-y)#55330
jkleinsc merged 2 commits into
44-x-yfrom
security-fix/44-x-y/fsa-upstream-matcher

claude Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

claude Bot commented Oct 25, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot left a comment

Uh oh!

jkleinsc left a comment

Uh oh!

Uh oh!

release-clerk Bot commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

claude Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Oct 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jkleinsc left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

release-clerk Bot commented Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

claude Bot commented Oct 25, 2026 •

edited

Loading

claude Bot commented Oct 25, 2026 •

edited

Loading