jgraph/drawio-desktop v31.4.4 on GitHub

Release Notes for 31.4.4

ChangeLog:

Uses electron 44.2.0
Restricts renderer file reads to paths the user has authorised, so opening and exporting a crafted diagram can no longer read arbitrary local files through the file IPC [GHSA-fjgc-8xgj-rvh4]
Corrects the AppImage compression method, so AppImageLauncher and other tools that expect gzip can read the image again [#2538]
Updates to draw.io core 31.4.4. All changes from 31.4.2 to 31.4.4 are added in this build.

Testing:

Verified against the packaged, signed macOS build. Linux and Windows packaging changes were verified from the produced release artifacts.

Base checks

Launch, open a file passed on the command line, add and edit shapes, undo and redo, save, insert and delete pages
Copy and paste through the system clipboard, which changed with Electron 44
Export to PNG, SVG and PDF from the app and from the command line
Diagram round trip in exported PNG, SVG and PDF, including reopening an exported PDF
Command line page selection with -p, and --size page against the default --size diagram
Quick Look preview on macOS renders the diagram
The macOS bundle is signed with a Developer ID certificate under the hardened runtime and is notarised, and the Quick Look app extension is sandboxed and separately signed
The x86_64 and arm64 AppImages are gzip compressed
153 unit tests pass

Read authorisation [GHSA-fjgc-8xgj-rvh4]

readFile, fileStat, isFileWritable, watchFile, getFileDrafts, getBkpFile and checkFileExists all refuse paths the user has not authorised, including a symlink planted inside an authorised folder
A crafted diagram whose font source points at a local file exports with nothing embedded, checked by scanning the export for the file contents in both plain and base64 form
The font URL check rejects the evasions the URL parser would otherwise strip, being leading spaces, tabs and newlines in the scheme, uppercase schemes, and absolute, UNC and protocol relative paths, while still accepting http(s), data: and relative URLs

Checks around the read authorisation change

Libraries and templates declared in the configuration still load, and their shapes still appear in the sidebar
The configuration widens what may be read and not what may be written, checked by a write to a configured path being refused
Custom libraries added in earlier versions keep working after upgrading to this build
Drafts, backups, external change detection and the save conflict check still work
Authorisations survive a restart, so Recent Files keeps working
Saving a shape library opened from a file still writes without reopening the save dialog [#2518] [#2521]