Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop

An attacker can craft a malicious Scratch project (`.sb3` file) or a custom extension. When a user opens this project or loads the extension within the affected TurboWarp Desktop application, the project can initiate requests to arbitrary local files or remote servers. This bypasses standard web security restrictions, allowing the malicious content to read and upload sensitive data from the user's disk to a location controlled by the attacker. The only user interaction required is opening the project file or loading the extension [ref_id=1].

The vulnerability lies within the web request handling logic in the Electron application, specifically in how it manages CORS policies for requests originating from file:// URIs. The changes in `desktop-settings.js` and `main.js` address this by introducing a bypass CORS feature and modifying the `onHeadersReceived` and `onBeforeRequest` event handlers to enforce these policies more strictly [ref_id=1].

The patch introduces a new setting and logic to control CORS bypass for extensions. Specifically, it adds a `bypass_cors` setting and associated IPC handlers to manage its state [ref_id=1]. The `session.webRequest.onHeadersReceived` handler is modified to check this bypass setting. If CORS bypass is enabled, it allows requests from file:// URIs to any origin; otherwise, it enforces stricter CORS checks, preventing unauthorized access to external resources [ref_id=1].