diff options
| author | Vendicated <vendicated@riseup.net> | 2022-10-03 19:17:54 +0200 |
|---|---|---|
| committer | Vendicated <vendicated@riseup.net> | 2022-10-03 19:17:54 +0200 |
| commit | 8fe60971f5939876da1cf228a3bb27c0e627c5ac (patch) | |
| tree | 01f0116c3f661a38ac376fce726cc44bfe7465e4 /src/ipcMain/index.ts | |
| parent | 71a59f4020c089fcff1d20fb0bff00f765c83500 (diff) | |
| download | Vencord-8fe60971f5939876da1cf228a3bb27c0e627c5ac.tar.gz Vencord-8fe60971f5939876da1cf228a3bb27c0e627c5ac.tar.bz2 Vencord-8fe60971f5939876da1cf228a3bb27c0e627c5ac.zip | |
security: remove openPath, restrict openExternal
Now only allows opening http urls.
Diffstat (limited to 'src/ipcMain/index.ts')
| -rw-r--r-- | src/ipcMain/index.ts | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/src/ipcMain/index.ts b/src/ipcMain/index.ts index 92d25fe..22f05fd 100644 --- a/src/ipcMain/index.ts +++ b/src/ipcMain/index.ts @@ -29,8 +29,19 @@ function readSettings() { // Fix for screensharing in Electron >= 17 ipcMain.handle(IpcEvents.GET_DESKTOP_CAPTURE_SOURCES, (_, opts) => desktopCapturer.getSources(opts)); -ipcMain.handle(IpcEvents.OPEN_PATH, (_, ...pathElements) => shell.openPath(join(...pathElements))); -ipcMain.handle(IpcEvents.OPEN_EXTERNAL, (_, url) => shell.openExternal(url)); +ipcMain.handle(IpcEvents.OPEN_QUICKCSS, () => shell.openPath(QUICKCSS_PATH)); + +ipcMain.handle(IpcEvents.OPEN_EXTERNAL, (_, url) => { + try { + var { protocol } = new URL(url); + } catch { + throw "Malformed URL"; + } + if (protocol !== "https:" && protocol !== "http:") + throw "Disallowed protocol."; + + shell.openExternal(url); +}); ipcMain.handle(IpcEvents.GET_QUICK_CSS, () => readCss()); |