Pass a local file safely across an Electron boundary

An Electron renderer that needs to inspect one chosen video does not need unrestricted filesystem access. Let the main process own file selection and return an opaque identifier. A narrow preload method can request one operation with that identifier while the main process validates the request.

Expose one operation

This preload fragment is an illustrative interface. It assumes the application has already configured context isolation and a suitable sandbox policy.

const { contextBridge, ipcRenderer } = require('electron');
contextBridge.exposeInMainWorld('media', {
  probeSelectedFile: (selectionId) =>
    ipcRenderer.invoke('media:probe-selected', selectionId)
});

The main-process handler must verify the sender frame and the argument before looking up the identifier. Keep a main-owned map from selection identifiers to approved paths. Reject unknown, expired or wrong-window identifiers. A string's resemblance to a UUID does not establish that its holder is allowed to access a file.

The renderer passes an opaque selection ID; the main process validates authority before resolving the local path.

Keep path authority in the main process

If the renderer can supply an arbitrary absolute path, a compromised renderer can try files the user never selected. A main-owned selection record narrows that authority. Restrict records to the window or operation that created them, and clear them when the workflow ends.

Return only the metadata that the UI needs, such as a duration and dimensions. Avoid returning an entire probe result if it can include local paths or unrelated metadata. Handle file deletion between selection and probing as an expected error. An opaque identifier cannot prevent that ordinary filesystem race.

Exercise rejected requests

In a local Electron test, invoke the operation with a missing identifier, an identifier from another window and an unexpected object. Also test an untrusted frame attempting the IPC channel directly. Confirm that the main process refuses the action and returns a controlled failure without disclosing the mapped path.

Electron's security guidance calls for validating IPC senders and limiting exposed APIs. The fragment above was reviewed against that guidance but was not run in an Electron application during authoring. Sender-validation details depend on the application's trusted origins and window design, so they must be implemented at the main handler rather than assumed by the preload wrapper.

Reference: Electron security recommendations. ShortForge is a related local-media application; this example does not claim its current IPC implementation has been audited.