From 8fe60971f5939876da1cf228a3bb27c0e627c5ac Mon Sep 17 00:00:00 2001
From: Vendicated <vendicated@riseup.net>
Date: Mon, 3 Oct 2022 19:17:54 +0200
Subject: [PATCH] security: remove openPath, restrict openExternal

Now only allows opening http urls.
---
 src/components/Settings.tsx |  2 +-
 src/ipcMain/index.ts        | 15 +++++++++++++--
 src/utils/IpcEvents.ts      |  2 +-
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/components/Settings.tsx b/src/components/Settings.tsx
index bc44e26b..d4a3dcae 100644
--- a/src/components/Settings.tsx
+++ b/src/components/Settings.tsx
@@ -88,7 +88,7 @@ export default ErrorBoundary.wrap(function Settings() {
                     Launch Directory
                 </Button>
                 <Button
-                    onClick={() => VencordNative.ipc.invoke(IpcEvents.OPEN_PATH, settingsDir, "quickCss.css")}
+                    onClick={() => VencordNative.ipc.invoke(IpcEvents.OPEN_QUICKCSS)}
                     size={Button.Sizes.SMALL}
                     disabled={settingsDir === "Loading..."}
                 >
diff --git a/src/ipcMain/index.ts b/src/ipcMain/index.ts
index 92d25fef..22f05fdd 100644
--- a/src/ipcMain/index.ts
+++ b/src/ipcMain/index.ts
@@ -29,8 +29,19 @@ function readSettings() {
 // Fix for screensharing in Electron >= 17
 ipcMain.handle(IpcEvents.GET_DESKTOP_CAPTURE_SOURCES, (_, opts) => desktopCapturer.getSources(opts));
 
-ipcMain.handle(IpcEvents.OPEN_PATH, (_, ...pathElements) => shell.openPath(join(...pathElements)));
-ipcMain.handle(IpcEvents.OPEN_EXTERNAL, (_, url) => shell.openExternal(url));
+ipcMain.handle(IpcEvents.OPEN_QUICKCSS, () => shell.openPath(QUICKCSS_PATH));
+
+ipcMain.handle(IpcEvents.OPEN_EXTERNAL, (_, url) => {
+    try {
+        var { protocol } = new URL(url);
+    } catch {
+        throw "Malformed URL";
+    }
+    if (protocol !== "https:" && protocol !== "http:")
+        throw "Disallowed protocol.";
+
+    shell.openExternal(url);
+});
 
 
 ipcMain.handle(IpcEvents.GET_QUICK_CSS, () => readCss());
diff --git a/src/utils/IpcEvents.ts b/src/utils/IpcEvents.ts
index 3ceaa9f1..b96abdc4 100644
--- a/src/utils/IpcEvents.ts
+++ b/src/utils/IpcEvents.ts
@@ -18,7 +18,7 @@ export default strEnum({
     GET_SETTINGS: "VencordGetSettings",
     SET_SETTINGS: "VencordSetSettings",
     OPEN_EXTERNAL: "VencordOpenExternal",
-    OPEN_PATH: "VencordOpenPath",
+    OPEN_QUICKCSS: "VencordOpenQuickCss",
     GET_UPDATES: "VencordGetUpdates",
     GET_REPO: "VencordGetRepo",
     GET_HASHES: "VencordGetHashes",