Confusing and Misleading Results When Scanning Packaged .app Bundles

[AvishkaG]

I have an Electron + Vue.js application where the main process code (main.js) is bundled and minified during the production build process (a common setup in modern boilerplates).

1. I implement security controls like a Content Security Policy (CSP) and a PermissionRequestHandler in my main.js source file.
2. When I run Electronegativity on my project's source code root (electronegativity -i .), the scan passes correctly. It successfully detects the CSP and permission handlers.

  session.defaultSession.webRequest.onHeadersReceived((details, callback) => {
    callback({
      responseHeaders: {
        ...details.responseHeaders,
        "Content-Security-Policy": ["default-src 'none'"],
      },
    });
  });

  session.defaultSession.setPermissionRequestHandler(
    (webContents, permission, callback) => {
      const requestingUrl = new URL(webContents.getURL());
      logAction(
        `Permission request for '${permission}' from '${requestingUrl.origin}' was denied.`,
      );
      return callback(false);
    },
  );

4. I then package my application into a .app bundle using electron-builder.
5. When I run Electronegativity on the final BrinkAgent.app file (electronegativity -i ./dist/mac/BrinkAgent.app), it incorrectly reports that these checks are failing (e.g., CSP_GLOBAL_CHECK fails with "No CSP has been detected").

[ikkisoft]

Unfortunately, we're no longer supporting this software and it will be soon archived.