fix(runtime): reject non-object E2EE handshake JSON (#35583)

Co-authored-by: OrcaWin <293788423+OrcaWin@users.noreply.github.com>

src/main/runtime/rpc/e2ee-channel.test.ts

@@ -192,9 +192,9 @@ describe('E2EEChannel', () => {
       expect(ctx.onReady).not.toHaveBeenCalled()
     })
 
-    it('rejects malformed JSON', () => {
+    it.each(['not json', 'null'])('rejects invalid handshake JSON: %s', (raw) => {
       const ctx = setup()
-      ctx.channel.handleRawMessage('not json')
+      ctx.channel.handleRawMessage(raw)
 
       expect(ctx.onError).toHaveBeenCalledWith(4001, 'Invalid handshake message')
     })

src/main/runtime/rpc/e2ee-channel.ts

@@ -188,7 +188,12 @@ export class E2EEChannel {
   private handleHello(raw: string): void {
     let hello: Record<string, unknown>
     try {
-      hello = parseRemoteRuntimeJsonText(raw) as Record<string, unknown>
+      const parsed = parseRemoteRuntimeJsonText(raw)
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        this.onError(4001, 'Invalid handshake message')
+        return
+      }
+      hello = { ...parsed }
     } catch {
       this.onError(4001, 'Invalid handshake message')
       return