No Sandbox – Applications That Run Chromium Without the Sandbox

Wait.. why is it significant that vscode has the sandbox disabled? Isn't executing (curated) arbitrary code part of its core functionality as an IDE? I am thinking extensions and ability to define tasks including arbitrary commands and so on.

Response from Signal Desktop developer on an insufficient Signal PR I posted a while ago: https://github.com/signalapp/Signal-Desktop/pull/4381

Is there not a switch that you can flip in electron saying "only run JS code from external files where URL origin == app archive"? Limiting external web requests to only your own domains would also fix this for the "basically Mozilla Prism" class of electron apps.

That seems like it would make XSS basically impossible for these apps and surely easier to adapt to than a full sandbox. Pretty much the only attack vector left then is exploiting various media/data formats to gain proper RCE - but how is that any different than a usual desktop app?

Something to note here is, that you can get the "source" from most of the non-free electron app by extracting the asar file.

Makes it probably even easier to find bugs in them.

Signal and Discord seem pretty high risk programs there, handling network input from strangers.

Thing is that whole point of the local applications as opposed to running it off from a browser, is that it can do things sandbox would prevent, like in case for VSCode.

Though, I guess it is beneficial if it is sandboxes where any of those "special" access is not needed, but then if that's the case, it just as well can be a applications that runs off from the browser or PWA...

How bad is it for programs like vscode, that is used by a lot of developers?