wireapp
diff --git a/‎.sonarcloud.properties‎
Lines changed: 10 additions & 0 deletions b/‎.sonarcloud.properties‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎bin/inject-version.js‎
Lines changed: 93 additions & 0 deletions b/‎bin/inject-version.js‎
Lines changed: 93 additions & 0 deletions
diff --git a/‎bin/sync-events.js‎
Lines changed: 261 additions & 0 deletions b/‎bin/sync-events.js‎
Lines changed: 261 additions & 0 deletions
@@ -0,0 +1,10 @@
+# SonarCloud Configuration for Wire Desktop
+# This file overrides parent-level SonarQube configuration
+
+# Context Isolation Security: Exclude files with necessary duplication due to Electron sandbox constraints
+# These files contain required duplication because sandboxed preload scripts cannot import from shared modules
+sonar.cpd.exclusions=electron/src/preload/preload-app.ts,electron/src/preload/preload-webview.ts,electron/src/shared/contextIsolationConstants.ts
+
+# Exclude e2e security test files from analysis entirely
+sonar.exclusions=test/e2e-security/**/*
+
@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+
+/*
+ * Wire
+ * Copyright (C) 2025 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ *
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Inject version from wire.json into preload scripts at build time
+ * 
+ * This script replaces process.env.DESKTOP_VERSION with the actual version
+ * from wire.json in the preload scripts before TypeScript compilation.
+ * This is necessary because preload scripts cannot use webpack DefinePlugin
+ * and need the version injected at build time for context isolation security.
+ */
+
+const WIRE_JSON_PATH = path.resolve(__dirname, '../electron/wire.json');
+const PRELOAD_WEBVIEW_PATH = path.resolve(__dirname, '../electron/src/preload/preload-webview.ts');
+
+function injectVersion() {
+  try {
+    const wireJson = JSON.parse(fs.readFileSync(WIRE_JSON_PATH, 'utf8'));
+    const version = wireJson.version || 'unknown';
+    
+    console.log(`Injecting version ${version} into preload scripts...`);
+    
+    let preloadContent = fs.readFileSync(PRELOAD_WEBVIEW_PATH, 'utf8');
+    
+    const originalPattern = /process\.env\.DESKTOP_VERSION \|\| 'unknown'/g;
+    const replacement = `'${version}'`;
+    
+    if (preloadContent.match(originalPattern)) {
+      preloadContent = preloadContent.replaceAll(originalPattern, replacement);
+      
+      fs.writeFileSync(PRELOAD_WEBVIEW_PATH, preloadContent, 'utf8');
+      console.log(`Successfully injected version ${version} into preload-webview.ts`);
+    } else {
+      console.log('No version injection pattern found in preload-webview.ts');
+    }
+    
+  } catch (error) {
+    console.error('Error injecting version:', error.message);
+    process.exit(1);
+  }
+}
+
+function restoreVersion() {
+  try {
+    console.log('Restoring original version pattern in preload scripts...');
+
+    let preloadContent = fs.readFileSync(PRELOAD_WEBVIEW_PATH, 'utf8');
+
+    const desktopVersionLine = /DESKTOP_VERSION: '[^']+'/g;
+
+    if (preloadContent.match(desktopVersionLine)) {
+      preloadContent = preloadContent.replaceAll(desktopVersionLine, "DESKTOP_VERSION: process.env.DESKTOP_VERSION || 'unknown'");
+
+      fs.writeFileSync(PRELOAD_WEBVIEW_PATH, preloadContent, 'utf8');
+      console.log('Successfully restored original version pattern in preload-webview.ts');
+    } else {
+      console.log('No hardcoded version found to restore in preload-webview.ts');
+    }
+
+  } catch (error) {
+    console.error('Error restoring version:', error.message);
+    process.exit(1);
+  }
+}
+
+const command = process.argv[2];
+
+if (command === 'restore') {
+  restoreVersion();
+} else {
+  injectVersion();
+}
@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+
+/*
+ * Wire
+ * Copyright (C) 2025 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ *
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+/**
+ * Automated Event Type Synchronization
+ * 
+ * This script automatically synchronizes EVENT_TYPE constants from the main process
+ * to preload scripts that cannot import them directly due to context isolation.
+ * 
+ * Source of truth: electron/src/lib/eventType.ts
+ * Targets:
+ * - electron/src/shared/contextIsolationConstants.ts
+ * - electron/src/preload/preload-app.ts
+ * - electron/src/preload/preload-webview.ts (if needed)
+ */
+
+const SOURCE_FILE = path.resolve(__dirname, '../electron/src/lib/eventType.ts');
+const SHARED_CONSTANTS_FILE = path.resolve(__dirname, '../electron/src/shared/contextIsolationConstants.ts');
+const PRELOAD_APP_FILE = path.resolve(__dirname, '../electron/src/preload/preload-app.ts');
+
+/**
+ * Extract EVENT_TYPE object from the source TypeScript file
+ * @param {string} sourceContent - Content of the source file
+ * @returns {string} The EVENT_TYPE object as a string
+ */
+function extractEventType(sourceContent) {
+  const regex = /export const EVENT_TYPE = \{/;
+  const startMatch = regex.exec(sourceContent);
+  if (!startMatch) {
+    throw new Error('Could not find EVENT_TYPE export in source file');
+  }
+
+  const startIndex = startMatch.index;
+  let braceCount = 0;
+  let endIndex = startIndex;
+  
+  for (let i = startIndex; i < sourceContent.length; i++) {
+    const char = sourceContent[i];
+    if (char === '{') {
+      braceCount++;
+    } else if (char === '}') {
+      braceCount--;
+      if (braceCount === 0) {
+        endIndex = i + 1;
+        break;
+      }
+    }
+  }
+  
+  if (braceCount !== 0) {
+    throw new Error('Could not find matching closing brace for EVENT_TYPE');
+  }
+  
+  return sourceContent.substring(startIndex, endIndex);
+}
+
+/**
+ * Generate the shared constants file content
+ * @param {string} eventTypeObject - The EVENT_TYPE object string
+ * @returns {string} Complete file content
+ */
+function generateSharedConstantsContent(eventTypeObject) {
+  return `/*
+ * Wire
+ * Copyright (C) 2018 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ *
+ */
+
+/**
+ * Shared Context Isolation Constants
+ *
+ * This file contains constants and utilities that are shared between renderer and preload
+ * processes due to context isolation security requirements. With context isolation enabled,
+ * these processes cannot directly import modules from the main process, so we need to
+ * redefine these constants locally.
+ *
+ * Security Context: These constants are safe to duplicate because they are just string
+ * literals that define event types and logging interfaces. No sensitive functionality
+ * is exposed.
+ *
+ * IMPORTANT: These constants are automatically generated from their main process
+ * counterparts using the 'yarn sync:events' command. Do not edit manually.
+ * - EVENT_TYPE is automatically generated from electron/src/lib/eventType.ts
+ * - WebAppEvents must match @wireapp/webapp-events
+ */
+
+/**
+ * Event type constants for IPC communication between main and renderer/preload processes.
+ * These are automatically generated from electron/src/lib/eventType.ts using 'yarn sync:events'.
+ *
+ * Context Isolation Security: Due to context isolation, we cannot import the main process
+ * eventType module directly in renderer/preload, so we maintain this automatically generated copy.
+ */
+// NOSONAR - Duplication required for context isolation, automatically generated
+${eventTypeObject};
+
+/**
+ * WebApp events constants for preload scripts.
+ * These must match the constants from @wireapp/webapp-events.
+ */
+export const WebAppEvents = {
+  CONVERSATION: {
+    JOIN: 'wire.webapp.conversation.join',
+  },
+  LIFECYCLE: {
+    CHANGE_ENVIRONMENT: 'wire.webapp.lifecycle.change_environment',
+    SSO_WINDOW_CLOSED: 'wire.webapp.lifecycle.sso_window_closed',
+  },
+  PROPERTIES: {
+    UPDATE: {
+      INTERFACE: {
+        THEME: 'wire.webapp.properties.update.interface.theme',
+      },
+    },
+    UPDATED: 'wire.webapp.properties.updated',
+  },
+} as const;
+
+/**
+ * Simple logger implementation for preload scripts.
+ *
+ * Context Isolation Security: Main process getLogger cannot be imported in preload
+ * scripts. This provides a safe logging interface using console methods.
+ *
+ * @param {string} name - The name/prefix for the logger
+ * @returns {Object} Logger object with info, log, warn, and error methods
+ */
+export const createSandboxLogger = (name: string) => ({
+  info: (message: string, ...args: any[]) =>
+    // eslint-disable-next-line no-console
+    console.info(\`[\${name}] \${message}\`, ...args),
+  log: (message: string, ...args: any[]) =>
+    // eslint-disable-next-line no-console
+    console.log(\`[\${name}] \${message}\`, ...args),
+  warn: (message: string, ...args: any[]) =>
+    // eslint-disable-next-line no-console
+    console.warn(\`[\${name}] \${message}\`, ...args),
+  error: (message: string, ...args: any[]) =>
+    // eslint-disable-next-line no-console
+    console.error(\`[\${name}] \${message}\`, ...args),
+});
+
+// Export this to make the file a module and prevent global scope pollution
+export {};
+`;
+}
+
+/**
+ * Update preload-app.ts to sync the duplicated EVENT_TYPE constants
+ * Note: Preload scripts cannot import from relative paths due to Electron sandbox limitations,
+ * so we maintain synchronized duplicates instead.
+ * @param {string} filePath - Path to the preload file
+ * @param {string} eventTypeObject - The EVENT_TYPE object string
+ */
+function updatePreloadAppFile(filePath, eventTypeObject) {
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  const eventTypeStart = content.indexOf('const EVENT_TYPE = {');
+  if (eventTypeStart === -1) {
+    console.log('No EVENT_TYPE duplication found in preload-app.ts');
+    return;
+  }
+
+  let braceCount = 0;
+  let eventTypeEnd = eventTypeStart;
+  for (let i = eventTypeStart; i < content.length; i++) {
+    const char = content[i];
+    if (char === '{') {
+      braceCount++;
+    } else if (char === '}') {
+      braceCount--;
+      if (braceCount === 0) {
+        let endPos = i;
+        while (endPos < content.length && content[endPos] !== '\n') {
+          endPos++;
+        }
+        eventTypeEnd = endPos;
+        break;
+      }
+    }
+  }
+
+  const beforeEventType = content.substring(0, eventTypeStart);
+  const afterEventType = content.substring(eventTypeEnd + 1);
+
+  const updatedEventType = `/**
+ * Event type constants for IPC communication
+ *
+ * IMPORTANT: This is automatically synchronized from ../shared/contextIsolationConstants.ts
+ * using 'yarn sync:events'. Do not edit manually - run the sync command instead.
+ *
+ * Context Isolation Security: Due to Electron sandbox limitations, preload scripts cannot
+ * import from relative paths, so we maintain this synchronized duplicate.
+ */
+const EVENT_TYPE = ${eventTypeObject.replace('export const EVENT_TYPE = ', '')};`;
+
+  content = beforeEventType + updatedEventType + afterEventType;
+
+  fs.writeFileSync(filePath, content, 'utf8');
+  console.log('Updated preload-app.ts with synchronized EVENT_TYPE constants');
+}
+
+function syncEvents() {
+  try {
+    console.log('Synchronizing EVENT_TYPE constants...');
+    
+    const sourceContent = fs.readFileSync(SOURCE_FILE, 'utf8');
+    
+    const eventTypeObject = extractEventType(sourceContent);
+    
+    const sharedContent = generateSharedConstantsContent(eventTypeObject);
+    fs.writeFileSync(SHARED_CONSTANTS_FILE, sharedContent, 'utf8');
+    console.log('✓ Updated shared/contextIsolationConstants.ts');
+    
+    updatePreloadAppFile(PRELOAD_APP_FILE, eventTypeObject);
+    console.log('✓ Updated preload/preload-app.ts');
+    
+    console.log('\nEvent type synchronization completed successfully!');
+    console.log('All EVENT_TYPE constants are now in sync with the main process.');
+    
+  } catch (error) {
+    console.error('Error synchronizing events:', error.message);
+    process.exit(1);
+  }
+}
+
+syncEvents();