Merge branch 'master' into master

michalzaq12 · web-flow · commit d62549ac420d · 2025-08-07T17:55:30.000+02:00
diff --git a/.changeset/brown-boxes-know.md b/.changeset/brown-boxes-know.md
@@ -0,0 +1,5 @@
+---
+"app-builder-lib": patch
+---
+
+fix: add quotation marks around variable in AppArmor profile
diff --git a/.changeset/long-wasps-divide.md b/.changeset/long-wasps-divide.md
@@ -0,0 +1,5 @@
+---
+"electron-builder": patch
+---
+
+fix: support option to override `PublishPolicy` in publish command
diff --git a/.changeset/lovely-moose-worry.md b/.changeset/lovely-moose-worry.md
@@ -0,0 +1,17 @@
+---
+"builder-util-runtime": minor
+---
+
+fix: implement industry-standard cross-origin redirect auth handling
+
+Replace hardcoded service-specific hostname checks with sophisticated cross-origin redirect detection that matches industry standards from Python requests library and Apache HttpClient.
+
+**Key improvements:**
+- **Case-insensitive hostname comparison** for robust origin detection
+- **HTTP→HTTPS upgrade allowance** on standard ports (80→443) for backward compatibility
+- **Proper default port handling** that treats implicit and explicit default ports as equivalent
+- **Standards-compliant cross-origin detection** following RFC specifications
+
+**Fixes GitHub issue #9207:** GitHub release asset downloads failing with 403 Forbidden when redirected from `api.github.com` to `release-assets.githubusercontent.com` (Azure backend) or other cloud storage services that don't accept GitHub tokens.
+
+The implementation now handles all cross-origin redirect scenarios while maintaining compatibility with legitimate same-origin redirects and industry-standard HTTP→HTTPS upgrades.
diff --git a/.changeset/rotten-bags-carry.md b/.changeset/rotten-bags-carry.md
@@ -0,0 +1,5 @@
+---
+"electron-builder": patch
+---
+
+fix: fix argument names mismatch in publish command to make it work
diff --git a/.changeset/selfish-trees-begin.md b/.changeset/selfish-trees-begin.md
@@ -0,0 +1,5 @@
+---
+"app-builder-lib": patch
+---
+
+fix(nsis): Fix file associations according to the Windows documentation
diff --git a/.changeset/shaggy-garlics-joke.md b/.changeset/shaggy-garlics-joke.md
@@ -0,0 +1,5 @@
+---
+"builder-util": patch
+---
+
+fix: scrubbing more aggressively anything in the logs that MIGHT be password affiliated (handling spaces in secrets)
diff --git a/.changeset/sixty-mice-accept.md b/.changeset/sixty-mice-accept.md
@@ -0,0 +1,5 @@
+---
+
+---
+
+fix(deps): update dependency form-data to v4.0.4 [security]
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -67,7 +67,7 @@ jobs:
       fail-fast: false
       matrix:
         testFiles:
-          - ArtifactPublisherTest,BuildTest,ExtraBuildTest,RepoSlugTest,binDownloadTest,configurationValidationTest,filenameUtilTest,filesTest,globTest,ignoreTest,macroExpanderTest,mainEntryTest,urlUtilTest,extraMetadataTest,linuxArchiveTest,linuxPackagerTest,HoistedNodeModuleTest,MemoLazyTest,HoistTest,ExtraBuildResourcesTest
+          - ArtifactPublisherTest,BuildTest,ExtraBuildTest,RepoSlugTest,binDownloadTest,configurationValidationTest,filenameUtilTest,filesTest,globTest,httpExecutorTest,ignoreTest,macroExpanderTest,mainEntryTest,urlUtilTest,extraMetadataTest,linuxArchiveTest,linuxPackagerTest,HoistedNodeModuleTest,MemoLazyTest,HoistTest,ExtraBuildResourcesTest,utilTest
           - snapTest,debTest,fpmTest,protonTest
           - winPackagerTest,winCodeSignTest,webInstallerTest
           - oneClickInstallerTest,assistedInstallerTest
diff --git a/packages/app-builder-lib/templates/linux/apparmor-profile.tpl b/packages/app-builder-lib/templates/linux/apparmor-profile.tpl
@@ -1,7 +1,7 @@
 abi <abi/4.0>,
 include <tunables/global>
 
-profile ${executable} "/opt/${sanitizedProductName}/${executable}" flags=(unconfined) {
+profile "${executable}" "/opt/${sanitizedProductName}/${executable}" flags=(unconfined) {
   userns,
 
   # Site-specific additions and overrides. See local/README for details.
diff --git a/packages/app-builder-lib/templates/nsis/include/FileAssociation.nsh b/packages/app-builder-lib/templates/nsis/include/FileAssociation.nsh
@@ -63,11 +63,8 @@
 ;
 
 !macro APP_ASSOCIATE EXT FILECLASS DESCRIPTION ICON COMMANDTEXT COMMAND
-  ; Backup the previously associated file class
-  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" ""
-  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "${FILECLASS}_backup" "$R0"
-
   WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "${FILECLASS}"
+  WriteRegNone SHELL_CONTEXT "Software\Classes\.${EXT}\OpenWithProgids" "${FILECLASS}"
 
   WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}" "" `${DESCRIPTION}`
   WriteRegStr SHELL_CONTEXT "Software\Classes\${FILECLASS}\DefaultIcon" "" `${ICON}`
@@ -77,11 +74,8 @@
 !macroend
 
 !macro APP_ASSOCIATE_EX EXT FILECLASS DESCRIPTION ICON VERB DEFAULTVERB SHELLNEW COMMANDTEXT COMMAND
-  ; Backup the previously associated file class
-  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" ""
-  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "${FILECLASS}_backup" "$R0"
-
   WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "${FILECLASS}"
+  WriteRegNone SHELL_CONTEXT "Software\Classes\.${EXT}\OpenWithProgids" "${FILECLASS}"
   StrCmp "${SHELLNEW}" "0" +2
   WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}\ShellNew" "NullFile" ""
 
@@ -103,10 +97,7 @@
 
 
 !macro APP_UNASSOCIATE EXT FILECLASS
-  ; Backup the previously associated file class
-  ReadRegStr $R0 SHELL_CONTEXT "Software\Classes\.${EXT}" `${FILECLASS}_backup`
-  WriteRegStr SHELL_CONTEXT "Software\Classes\.${EXT}" "" "$R0"
-
+  DeleteRegValue SHELL_CONTEXT "Software\Classes\.${EXT}\OpenWithProgids" "${FILECLASS}"
   DeleteRegKey SHELL_CONTEXT `Software\Classes\${FILECLASS}`
 !macroend
 
@@ -129,4 +120,4 @@
 ; Using the system.dll plugin to call the SHChangeNotify Win32 API function so we
 ; can update the shell.
   System::Call "shell32::SHChangeNotify(i,i,i,i) (${SHCNE_ASSOCCHANGED}, ${SHCNF_FLUSH}, 0, 0)"
-!macroend
+!macroend
diff --git a/packages/builder-util-runtime/src/httpExecutor.ts b/packages/builder-util-runtime/src/httpExecutor.ts
@@ -319,14 +319,69 @@ Please double check that your authentication token is correct. Due to security r
     const newOptions = configureRequestOptionsFromUrl(redirectUrl, { ...options })
     const headers = newOptions.headers
     if (headers?.authorization) {
-      const parsedNewUrl = parseUrl(redirectUrl, options)
-      if (parsedNewUrl.hostname.endsWith(".amazonaws.com") || parsedNewUrl.searchParams.has("X-Amz-Credential")) {
+      // Parse original and redirect URLs to compare origins
+      const originalUrl = HttpExecutor.reconstructOriginalUrl(options)
+      const parsedRedirectUrl = parseUrl(redirectUrl, options)
+
+      // Strip authorization header on cross-origin redirects (different protocol, hostname, or port)
+      if (HttpExecutor.isCrossOriginRedirect(originalUrl, parsedRedirectUrl)) {
+        if (debug.enabled) {
+          debug(`Given the cross-origin redirect (from ${originalUrl.host} to ${parsedRedirectUrl.host}), the Authorization header will be stripped out.`)
+        }
         delete headers.authorization
       }
     }
     return newOptions
   }
 
+  private static reconstructOriginalUrl(options: RequestOptions): URL {
+    const protocol = options.protocol || "https:"
+    if (!options.hostname) {
+      throw new Error("Missing hostname in request options")
+    }
+    const hostname = options.hostname
+    const port = options.port ? `:${options.port}` : ""
+    const path = options.path || "/"
+    return new URL(`${protocol}//${hostname}${port}${path}`)
+  }
+
+  private static isCrossOriginRedirect(originalUrl: URL, redirectUrl: URL): boolean {
+    // Case-insensitive hostname comparison
+    if (originalUrl.hostname.toLowerCase() !== redirectUrl.hostname.toLowerCase()) {
+      return true
+    }
+
+    // Special case: allow http -> https redirect on same host with standard ports
+    // This matches the behavior of Python requests library for backward compatibility
+    // url.port returns an empty string if the port is omitted
+    // or explicitly set to the default port for a given protocol. 
+    if (
+      originalUrl.protocol === "http:" &&
+      // This can be replaced with `!originalUrl.port`, but for the sake of clarity.
+      ["80", ""].includes(originalUrl.port) &&
+      redirectUrl.protocol === "https:" &&
+      // This can be replaced with `!redirectUrl.port`, but for the sake of clarity.
+      ["443", ""].includes(redirectUrl.port)
+    ) {
+      return false
+    }
+
+    // According to RFC 7235, a change in protocol or port constitutes a cross-origin request.
+    // Forwarding authentication headers to a different origin can be a security risk.
+    // For example, https://example.com:443 and http://example.com:80 are different origins.
+    // We only make an exception for HTTP -> HTTPS upgrades on standard ports for backward compatibility.
+
+    // Strip auth on any other protocol change
+    if (originalUrl.protocol !== redirectUrl.protocol) {
+      return true
+    }
+
+    // Strip auth on port change (accounting for default ports)
+    const originalPort = originalUrl.port
+    const redirectPort = redirectUrl.port
+    return originalPort !== redirectPort
+  }
+
   static retryOnServerError(task: () => Promise<any>, maxRetries = 3) {
     for (let attemptNumber = 0; ; attemptNumber++) {
       try {
diff --git a/packages/builder-util/src/util.ts b/packages/builder-util/src/util.ts
@@ -42,13 +42,29 @@ export function serializeToYaml(object: any, skipInvalid = false, noRefs = false
   })
 }
 
-export function removePassword(input: string) {
-  return input.replace(/(-String |-P |pass:| \/p |-pass |--secretKey |--accessKey |-p )([^ ]+)/g, (match, p1, p2) => {
-    if (p1.trim() === "/p" && p2.startsWith("\\\\Mac\\Host\\\\")) {
-      // appx /p
-      return `${p1}${p2}`
+export function removePassword(input: string): string {
+  const blockList = ["--accessKey", "--secretKey", "-P", "-p", "-pass", "-String", "/p", "pass:"]
+
+  // Create a regex pattern that supports:
+  //   - space-separated unquoted values: --key value
+  //   - quoted values: --key "value with spaces" or 'value with spaces'
+  const blockPattern = new RegExp(`(${blockList.map(s => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\s*(?:(["'])(.*?)\\2|([^\\s]+))`, "g")
+
+  input = input.replace(blockPattern, (_match, prefix, quote, quotedVal, unquotedVal) => {
+    const value = quotedVal ?? unquotedVal
+
+    if (prefix.trim() === "/p" && value.startsWith("\\\\Mac\\Host\\\\")) {
+      return `${prefix} ${quote ?? ""}${value}${quote ?? ""}`
     }
-    return `${p1}${createHash("sha256").update(p2).digest("hex")} (sha256 hash)`
+
+    const hashed = createHash("sha256").update(value).digest("hex")
+    return `${prefix} ${quote ?? ""}${hashed} (sha256 hash)${quote ?? ""}`
+  })
+
+  // Also handle `/b ... /c` block format
+  return input.replace(/(\/b\s+)(.*?)(\s+\/c)/g, (_match, p1, p2, p3) => {
+    const hashed = createHash("sha256").update(p2).digest("hex")
+    return `${p1}${hashed} (sha256 hash)${p3}`
   })
 }
 
diff --git a/packages/electron-builder/src/publish.ts b/packages/electron-builder/src/publish.ts
@@ -5,6 +5,7 @@ import { Publish } from "app-builder-lib/out/core"
 import { computeSafeArtifactNameIfNeeded } from "app-builder-lib/out/platformPackager"
 import { getConfig } from "app-builder-lib/out/util/config/config"
 import { InvalidConfigurationError, archFromString, log, printErrorAndExit } from "builder-util"
+import { PublishPolicy } from "electron-publish"
 import * as chalk from "chalk"
 import * as path from "path"
 import * as yargs from "yargs"
@@ -15,6 +16,7 @@ export function configurePublishCommand(yargs: yargs.Argv): yargs.Argv {
   // https://github.com/yargs/yargs/issues/760
   // demandOption is required to be set
   return yargs
+    .version(false)
     .parserConfiguration({
       "camel-case-expansion": false,
     })
@@ -31,34 +33,41 @@ export function configurePublishCommand(yargs: yargs.Argv): yargs.Argv {
       description: "The app/build version used when searching for an upload release (used by some Publishers)",
     })
     .option("config", {
-      alias: ["c"],
+      alias: ["c", "configurationFilePath"],
       type: "string",
       description:
         "The path to an electron-builder config. Defaults to `electron-builder.yml` (or `json`, or `json5`, or `js`, or `ts`), see " + chalk.underline("https://goo.gl/YFRJOM"),
     })
+    .option("policy", {
+      alias: ["p"],
+      type: "string",
+      description: `Publish trigger policy, see ${chalk.underline("https://www.electron.build/publish")}`,
+      choices: ["onTag", "onTagOrDraft", "always", "never", undefined as any],
+    })
     .demandOption("files")
 }
 
-export async function publish(args: { files: string[]; version: string | undefined; configurationFilePath: string | undefined }) {
+export async function publish(args: { files: string[]; version: string | undefined; configurationFilePath: string | undefined; policy: PublishPolicy }) {
   const uploadTasks = args.files.map(f => {
     return {
       file: path.resolve(f),
       arch: null,
     }
   })
-  return publishArtifactsWithOptions(uploadTasks, args.version, args.configurationFilePath)
+  return publishArtifactsWithOptions(uploadTasks, args.version, args.configurationFilePath, undefined, { publish: args.policy })
 }
 
 export async function publishArtifactsWithOptions(
   uploadOptions: { file: string; arch: string | null }[],
   buildVersion?: string,
   configurationFilePath?: string,
-  publishConfiguration?: Publish
+  publishConfiguration?: Publish,
+  publishOptions?: PublishOptions
 ) {
   const projectDir = process.cwd()
   const config = await getConfig(projectDir, configurationFilePath || null, { publish: publishConfiguration, detectUpdateChannel: false })
 
-  const buildOptions: BuildOptions = normalizeOptions({ config })
+  const buildOptions: BuildOptions = normalizeOptions({ config, publish: publishOptions?.publish })
   checkBuildRequestOptions(buildOptions)
 
   const uniqueUploads = Array.from(new Set(uploadOptions))
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/test/snapshots/builder-util/utilTest.js.snap b/test/snapshots/builder-util/utilTest.js.snap
diff --git a/test/src/builder-util/utilTest.ts b/test/src/builder-util/utilTest.ts
diff --git a/test/src/httpExecutorTest.ts b/test/src/httpExecutorTest.ts

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"app-builder-lib": patch
 +---
++
 +fix: add quotation marks around variable in AppArmor profile