fix loading themes with spaces in their name

This commit is contained in:
Vendicated 2025-06-09 01:56:04 +02:00
parent b19bb2b7af
commit 18f2b49b67
No known key found for this signature in database
GPG key ID: D66986BAF75ECF18
2 changed files with 21 additions and 13 deletions

View file

@ -16,8 +16,9 @@
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
import { app, protocol } from "electron";
import { app, net, protocol } from "electron";
import { join } from "path";
import { pathToFileURL } from "url";
import { initCsp } from "./csp";
import { ensureSafePath } from "./ipcMain";
@ -27,21 +28,27 @@ import { installExt } from "./utils/extensions";
if (IS_VESKTOP || !IS_VANILLA) {
app.whenReady().then(() => {
// Source Maps! Maybe there's a better way but since the renderer is executed
// from a string I don't think any other form of sourcemaps would work
protocol.registerFileProtocol("vencord", ({ url: unsafeUrl }, cb) => {
let url = unsafeUrl.slice("vencord://".length);
protocol.handle("vencord", ({ url: unsafeUrl }) => {
let url = decodeURI(unsafeUrl).slice("vencord://".length).replace(/\?v=\d+$/, "");
if (url.endsWith("/")) url = url.slice(0, -1);
if (url.startsWith("/themes/")) {
const theme = url.slice("/themes/".length);
const safeUrl = ensureSafePath(THEMES_DIR, theme);
if (!safeUrl) {
cb({ statusCode: 403 });
return;
return new Response(null, {
status: 404
});
}
cb(safeUrl.replace(/\?v=\d+$/, ""));
return;
return net.fetch(pathToFileURL(safeUrl).toString());
}
// Source Maps! Maybe there's a better way but since the renderer is executed
// from a string I don't think any other form of sourcemaps would work
switch (url) {
case "renderer.js.map":
case "vencordDesktopRenderer.js.map":
@ -49,10 +56,11 @@ if (IS_VESKTOP || !IS_VANILLA) {
case "vencordDesktopPreload.js.map":
case "patcher.js.map":
case "vencordDesktopMain.js.map":
cb(join(__dirname, url));
break;
return net.fetch(pathToFileURL(join(__dirname, url)).toString());
default:
cb({ statusCode: 403 });
return new Response(null, {
status: 404
});
}
});

View file

@ -35,7 +35,7 @@ import { makeLinksOpenExternally } from "./utils/externalLinks";
mkdirSync(THEMES_DIR, { recursive: true });
export function ensureSafePath(basePath: string, path: string) {
const normalizedBasePath = normalize(basePath);
const normalizedBasePath = normalize(basePath + "/");
const newPath = join(basePath, path);
const normalizedPath = normalize(newPath);
return normalizedPath.startsWith(normalizedBasePath) ? normalizedPath : null;