From 95dc9e6a8fcbcb46e0db56c385120cb9efe9a19d Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 03:10:34 +0100 Subject: [PATCH 01/16] use much stricter, whitelist based CSP --- src/main/csp.ts | 109 ++++++++++++++++++++++++++++++++++++++++++++++ src/main/index.ts | 68 ++--------------------------- 2 files changed, 112 insertions(+), 65 deletions(-) create mode 100644 src/main/csp.ts diff --git a/src/main/csp.ts b/src/main/csp.ts new file mode 100644 index 000000000..332de08d7 --- /dev/null +++ b/src/main/csp.ts @@ -0,0 +1,109 @@ +/* + * Vencord, a Discord client mod + * Copyright (c) 2025 Vendicated and contributors + * SPDX-License-Identifier: GPL-3.0-or-later + */ + +import { session } from "electron"; + +const findHeader = (headers: Record, headerName: Lowercase) => { + return Object.keys(headers).find(h => h.toLowerCase() === headerName); +}; + +const MediaSrc = ["connect-src", "img-src", "media-src"]; +const CssSrc = ["style-src", "font-src"]; +const MediaAndCssSrc = [...MediaSrc, ...CssSrc]; +const MediaScriptsAndCssSrc = [...MediaAndCssSrc, "script-src", "worker-src"]; + +const Policies: Record = { + // Used by Themes + "*.github.io": MediaAndCssSrc, + "raw.githubusercontent.com": MediaAndCssSrc, + "*.githack.com": MediaAndCssSrc, + "jsdelivr.net": MediaAndCssSrc, + "fonts.googleapis.com": CssSrc, + + // Used by themes and some Vencord code + "cdn.discordapp.com": MediaAndCssSrc, + "media.discordapp.net": MediaSrc, + + // CDNs used for some things by Vencord. + // FIXME: we really should not be using CDNs anymore + "cdnjs.cloudflare.com": MediaScriptsAndCssSrc, + "unpkg.com": MediaScriptsAndCssSrc, + + // used for VenCloud (api.vencord.dev) and badges (badges.vencord.dev) + "*.vencord.dev": MediaSrc, +}; + +// Remove CSP +type PolicyResult = Record; + +const parsePolicy = (policy: string): PolicyResult => { + const result: PolicyResult = {}; + policy.split(";").forEach(directive => { + const [directiveKey, ...directiveValue] = directive.trim().split(/\s+/g); + if (directiveKey && !Object.prototype.hasOwnProperty.call(result, directiveKey)) { + result[directiveKey] = directiveValue; + } + }); + + return result; +}; +const stringifyPolicy = (policy: PolicyResult): string => + Object.entries(policy) + .filter(([, values]) => values?.length) + .map(directive => directive.flat().join(" ")) + .join("; "); + + +const patchCsp = (headers: Record) => { + const header = findHeader(headers, "content-security-policy"); + + if (header) { + const csp = parsePolicy(headers[header][0]); + + const pushDirective = (directive: string, ...values: string[]) => { + csp[directive] ??= []; + csp[directive].push(...values); + }; + + for (const directive of ["style-src", "connect-src", "img-src", "font-src", "media-src", "worker-src"]) { + pushDirective(directive, "blob:", "data:", "vencord:", "'unsafe-inline'"); + } + + pushDirective("script-src", "'unsafe-inline'", "'unsafe-eval'"); + + for (const [host, directives] of Object.entries(Policies)) { + for (const directive of directives) { + pushDirective(directive, host); + } + } + + headers[header] = [stringifyPolicy(csp)]; + } +}; + +export function initCsp() { + session.defaultSession.webRequest.onHeadersReceived(({ responseHeaders, resourceType }, cb) => { + if (responseHeaders) { + if (resourceType === "mainFrame") + patchCsp(responseHeaders); + + // Fix hosts that don't properly set the css content type, such as + // raw.githubusercontent.com + if (resourceType === "stylesheet") { + const header = findHeader(responseHeaders, "content-type"); + if (header) + responseHeaders[header] = ["text/css"]; + } + } + + cb({ cancel: false, responseHeaders }); + }); + + // assign a noop to onHeadersReceived to prevent other mods from adding their own incompatible ones. + // For instance, OpenAsar adds their own that doesn't fix content-type for stylesheets which makes it + // impossible to load css from github raw despite our fix above + session.defaultSession.webRequest.onHeadersReceived = () => { }; +} diff --git a/src/main/index.ts b/src/main/index.ts index 5519d47ac..a001a4900 100644 --- a/src/main/index.ts +++ b/src/main/index.ts @@ -16,9 +16,10 @@ * along with this program. If not, see . */ -import { app, protocol, session } from "electron"; +import { app, protocol } from "electron"; import { join } from "path"; +import { initCsp } from "./csp"; import { ensureSafePath } from "./ipcMain"; import { RendererSettings } from "./settings"; import { IS_VANILLA, THEMES_DIR } from "./utils/constants"; @@ -63,70 +64,7 @@ if (IS_VESKTOP || !IS_VANILLA) { } catch { } - const findHeader = (headers: Record, headerName: Lowercase) => { - return Object.keys(headers).find(h => h.toLowerCase() === headerName); - }; - - // Remove CSP - type PolicyResult = Record; - - const parsePolicy = (policy: string): PolicyResult => { - const result: PolicyResult = {}; - policy.split(";").forEach(directive => { - const [directiveKey, ...directiveValue] = directive.trim().split(/\s+/g); - if (directiveKey && !Object.prototype.hasOwnProperty.call(result, directiveKey)) { - result[directiveKey] = directiveValue; - } - }); - - return result; - }; - const stringifyPolicy = (policy: PolicyResult): string => - Object.entries(policy) - .filter(([, values]) => values?.length) - .map(directive => directive.flat().join(" ")) - .join("; "); - - const patchCsp = (headers: Record) => { - const header = findHeader(headers, "content-security-policy"); - - if (header) { - const csp = parsePolicy(headers[header][0]); - - for (const directive of ["style-src", "connect-src", "img-src", "font-src", "media-src", "worker-src"]) { - csp[directive] ??= []; - csp[directive].push("*", "blob:", "data:", "vencord:", "'unsafe-inline'"); - } - - // TODO: Restrict this to only imported packages with fixed version. - // Perhaps auto generate with esbuild - csp["script-src"] ??= []; - csp["script-src"].push("'unsafe-eval'", "https://unpkg.com", "https://cdnjs.cloudflare.com"); - headers[header] = [stringifyPolicy(csp)]; - } - }; - - session.defaultSession.webRequest.onHeadersReceived(({ responseHeaders, resourceType }, cb) => { - if (responseHeaders) { - if (resourceType === "mainFrame") - patchCsp(responseHeaders); - - // Fix hosts that don't properly set the css content type, such as - // raw.githubusercontent.com - if (resourceType === "stylesheet") { - const header = findHeader(responseHeaders, "content-type"); - if (header) - responseHeaders[header] = ["text/css"]; - } - } - - cb({ cancel: false, responseHeaders }); - }); - - // assign a noop to onHeadersReceived to prevent other mods from adding their own incompatible ones. - // For instance, OpenAsar adds their own that doesn't fix content-type for stylesheets which makes it - // impossible to load css from github raw despite our fix above - session.defaultSession.webRequest.onHeadersReceived = () => { }; + initCsp(); }); } From 5eb306f6d08adc2b1ae5725d22ad9be136c6a984 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 03:18:46 +0100 Subject: [PATCH 02/16] add more domains & document better --- src/main/csp.ts | 52 +++++++++++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 21 deletions(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 332de08d7..964cc5da5 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -6,41 +6,46 @@ import { session } from "electron"; -const findHeader = (headers: Record, headerName: Lowercase) => { - return Object.keys(headers).find(h => h.toLowerCase() === headerName); -}; +type PolicyMap = Record; const MediaSrc = ["connect-src", "img-src", "media-src"]; const CssSrc = ["style-src", "font-src"]; const MediaAndCssSrc = [...MediaSrc, ...CssSrc]; const MediaScriptsAndCssSrc = [...MediaAndCssSrc, "script-src", "worker-src"]; -const Policies: Record = { - // Used by Themes - "*.github.io": MediaAndCssSrc, - "raw.githubusercontent.com": MediaAndCssSrc, - "*.githack.com": MediaAndCssSrc, - "jsdelivr.net": MediaAndCssSrc, - "fonts.googleapis.com": CssSrc, +const Policies: PolicyMap = { + "*.github.io": MediaAndCssSrc, // github pages, used by most themes + "raw.githubusercontent.com": MediaAndCssSrc, // github raw, used by some themes + "*.gitlab.io": MediaAndCssSrc, // gitlab pages, used by some themes + "gitlab.com": MediaAndCssSrc, // gitlab raw, used by some themes + "*.codeberg.page": MediaAndCssSrc, // codeberg pages, used by some themes + "codeberg.org": MediaAndCssSrc, // codeberg raw, used by some themes - // Used by themes and some Vencord code - "cdn.discordapp.com": MediaAndCssSrc, - "media.discordapp.net": MediaSrc, + "*.githack.com": MediaAndCssSrc, // githack (namely raw.githack.com), used by some themes + "jsdelivr.net": MediaAndCssSrc, // jsdeliver, used by very few themes + + "fonts.googleapis.com": CssSrc, // google fonts, used by many themes + + "i.imgur.com": MediaSrc, // imgur, used by some themes + "i.ibb.co": MediaSrc, // imgbb, used by some themes + + "cdn.discordapp.com": MediaAndCssSrc, // Discord CDN, used by Vencord and some themes to load media + "media.discordapp.net": MediaSrc, // Discord media CDN, possible alternative to Discord CDN + + "*.vencord.dev": MediaSrc, // used for VenCloud (api.vencord.dev) and badges (badges.vencord.dev) // CDNs used for some things by Vencord. // FIXME: we really should not be using CDNs anymore "cdnjs.cloudflare.com": MediaScriptsAndCssSrc, "unpkg.com": MediaScriptsAndCssSrc, - - // used for VenCloud (api.vencord.dev) and badges (badges.vencord.dev) - "*.vencord.dev": MediaSrc, }; -// Remove CSP -type PolicyResult = Record; +const findHeader = (headers: PolicyMap, headerName: Lowercase) => { + return Object.keys(headers).find(h => h.toLowerCase() === headerName); +}; -const parsePolicy = (policy: string): PolicyResult => { - const result: PolicyResult = {}; +const parsePolicy = (policy: string): PolicyMap => { + const result: PolicyMap = {}; policy.split(";").forEach(directive => { const [directiveKey, ...directiveValue] = directive.trim().split(/\s+/g); if (directiveKey && !Object.prototype.hasOwnProperty.call(result, directiveKey)) { @@ -50,7 +55,8 @@ const parsePolicy = (policy: string): PolicyResult => { return result; }; -const stringifyPolicy = (policy: PolicyResult): string => + +const stringifyPolicy = (policy: PolicyMap): string => Object.entries(policy) .filter(([, values]) => values?.length) .map(directive => directive.flat().join(" ")) @@ -58,6 +64,10 @@ const stringifyPolicy = (policy: PolicyResult): string => const patchCsp = (headers: Record) => { + const reportOnlyHeader = findHeader(headers, "content-security-policy-report-only"); + if (reportOnlyHeader) + delete headers[reportOnlyHeader]; + const header = findHeader(headers, "content-security-policy"); if (header) { From 6166a1c1154a622e0c13f17ddaec3f211872ccc3 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 03:25:52 +0100 Subject: [PATCH 03/16] unbrick discord :sorrykirino: --- src/main/csp.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 964cc5da5..91ca3bec1 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -74,7 +74,7 @@ const patchCsp = (headers: Record) => { const csp = parsePolicy(headers[header][0]); const pushDirective = (directive: string, ...values: string[]) => { - csp[directive] ??= []; + csp[directive] ??= ["'self'"]; csp[directive].push(...values); }; @@ -90,6 +90,7 @@ const patchCsp = (headers: Record) => { } } + console.log(csp); headers[header] = [stringifyPolicy(csp)]; } }; From 11143adb02446aed2fc55e10b7071f976cfc45e4 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 03:32:15 +0100 Subject: [PATCH 04/16] whitelist plugin specific domains --- src/main/csp.ts | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 91ca3bec1..3e0dececf 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -32,12 +32,20 @@ const Policies: PolicyMap = { "cdn.discordapp.com": MediaAndCssSrc, // Discord CDN, used by Vencord and some themes to load media "media.discordapp.net": MediaSrc, // Discord media CDN, possible alternative to Discord CDN - "*.vencord.dev": MediaSrc, // used for VenCloud (api.vencord.dev) and badges (badges.vencord.dev) - // CDNs used for some things by Vencord. // FIXME: we really should not be using CDNs anymore "cdnjs.cloudflare.com": MediaScriptsAndCssSrc, "unpkg.com": MediaScriptsAndCssSrc, + + // Function Specific + "api.github.com": ["connect-src"], // used for updating Vencord itself + "ws.audioscrobbler.com": ["connect-src"], // last.fm API + "translate.googleapis.com": ["connect-src"], // Google Translate API + "*.vencord.dev": MediaSrc, // VenCloud (api.vencord.dev) and Badges (badges.vencord.dev) + "manti.vendicated.dev": MediaSrc, // ReviewDB API + "decor.fieryflames.dev": MediaSrc, // Decor API + "sponsor.ajay.app": MediaSrc, // Dearrow API + "usrbg.is-hardly.online": MediaSrc, // USRBG API }; const findHeader = (headers: PolicyMap, headerName: Lowercase) => { From 0336ea1cb29c918bc1c03cb4fd61e41e6304e8dc Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 03:33:29 +0100 Subject: [PATCH 05/16] export CspPolicies map so plugins can whitelist themselves --- src/main/csp.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 3e0dececf..44272fbcf 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -13,7 +13,7 @@ const CssSrc = ["style-src", "font-src"]; const MediaAndCssSrc = [...MediaSrc, ...CssSrc]; const MediaScriptsAndCssSrc = [...MediaAndCssSrc, "script-src", "worker-src"]; -const Policies: PolicyMap = { +export const CspPolicies: PolicyMap = { "*.github.io": MediaAndCssSrc, // github pages, used by most themes "raw.githubusercontent.com": MediaAndCssSrc, // github raw, used by some themes "*.gitlab.io": MediaAndCssSrc, // gitlab pages, used by some themes @@ -92,7 +92,7 @@ const patchCsp = (headers: Record) => { pushDirective("script-src", "'unsafe-inline'", "'unsafe-eval'"); - for (const [host, directives] of Object.entries(Policies)) { + for (const [host, directives] of Object.entries(CspPolicies)) { for (const directive of directives) { pushDirective(directive, host); } From f08ac7e506df03391d1dad2ddc2df419c00798e1 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 03:46:43 +0100 Subject: [PATCH 06/16] fix more plugins --- src/main/csp.ts | 15 ++++++++------- src/plugins/_api/badges/index.tsx | 2 +- src/plugins/devCompanion.dev/index.tsx | 2 +- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 44272fbcf..378f4b69a 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -8,7 +8,8 @@ import { session } from "electron"; type PolicyMap = Record; -const MediaSrc = ["connect-src", "img-src", "media-src"]; +const ConnectSrc = ["connect-src"]; +const MediaSrc = [...ConnectSrc, "img-src", "media-src"]; const CssSrc = ["style-src", "font-src"]; const MediaAndCssSrc = [...MediaSrc, ...CssSrc]; const MediaScriptsAndCssSrc = [...MediaAndCssSrc, "script-src", "worker-src"]; @@ -38,12 +39,13 @@ export const CspPolicies: PolicyMap = { "unpkg.com": MediaScriptsAndCssSrc, // Function Specific - "api.github.com": ["connect-src"], // used for updating Vencord itself - "ws.audioscrobbler.com": ["connect-src"], // last.fm API - "translate.googleapis.com": ["connect-src"], // Google Translate API + "api.github.com": ConnectSrc, // used for updating Vencord itself + "ws.audioscrobbler.com": ConnectSrc, // last.fm API + "translate.googleapis.com": ConnectSrc, // Google Translate API "*.vencord.dev": MediaSrc, // VenCloud (api.vencord.dev) and Badges (badges.vencord.dev) "manti.vendicated.dev": MediaSrc, // ReviewDB API - "decor.fieryflames.dev": MediaSrc, // Decor API + "decor.fieryflames.dev": ConnectSrc, // Decor API + "ugc.decor.fieryflames.dev": MediaSrc, // Decor CDN "sponsor.ajay.app": MediaSrc, // Dearrow API "usrbg.is-hardly.online": MediaSrc, // USRBG API }; @@ -82,7 +84,7 @@ const patchCsp = (headers: Record) => { const csp = parsePolicy(headers[header][0]); const pushDirective = (directive: string, ...values: string[]) => { - csp[directive] ??= ["'self'"]; + csp[directive] ??= [...csp["default-src"] ?? []]; csp[directive].push(...values); }; @@ -98,7 +100,6 @@ const patchCsp = (headers: Record) => { } } - console.log(csp); headers[header] = [stringifyPolicy(csp)]; } }; diff --git a/src/plugins/_api/badges/index.tsx b/src/plugins/_api/badges/index.tsx index 2a83809d6..58b2e32cb 100644 --- a/src/plugins/_api/badges/index.tsx +++ b/src/plugins/_api/badges/index.tsx @@ -33,7 +33,7 @@ import definePlugin from "@utils/types"; import { Forms, Toasts, UserStore } from "@webpack/common"; import { User } from "discord-types/general"; -const CONTRIBUTOR_BADGE = "https://vencord.dev/assets/favicon.png"; +const CONTRIBUTOR_BADGE = "https://cdn.discordapp.com/emojis/1092089799109775453.png?size=64"; const ContributorBadge: ProfileBadge = { description: "Vencord Contributor", diff --git a/src/plugins/devCompanion.dev/index.tsx b/src/plugins/devCompanion.dev/index.tsx index a495907b2..19d954460 100644 --- a/src/plugins/devCompanion.dev/index.tsx +++ b/src/plugins/devCompanion.dev/index.tsx @@ -91,7 +91,7 @@ function parseNode(node: Node) { function initWs(isManual = false) { let wasConnected = isManual; let hasErrored = false; - const ws = socket = new WebSocket(`ws://localhost:${PORT}`); + const ws = socket = new WebSocket(`ws://127.0.0.1:${PORT}`); ws.addEventListener("open", () => { wasConnected = true; From 4c379e590f9ebccdb4037fc898ce171811c30a1d Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 04:03:35 +0100 Subject: [PATCH 07/16] add note about unsafe-inline + strict-dynamic --- src/main/csp.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 378f4b69a..c85ec7d96 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -88,12 +88,16 @@ const patchCsp = (headers: Record) => { csp[directive].push(...values); }; - for (const directive of ["style-src", "connect-src", "img-src", "font-src", "media-src", "worker-src"]) { - pushDirective(directive, "blob:", "data:", "vencord:", "'unsafe-inline'"); - } - + pushDirective("style-src", "'unsafe-inline'"); + // we could make unsafe-inline safe by using strict-dynamic with a random nonce on our Vencord loader script https://content-security-policy.com/strict-dynamic/ + // HOWEVER, at the time of writing (24 Jan 2025), Discord is INSANE and also uses unsafe-inline + // Once they stop using it, we also should pushDirective("script-src", "'unsafe-inline'", "'unsafe-eval'"); + for (const directive of ["style-src", "connect-src", "img-src", "font-src", "media-src", "worker-src"]) { + pushDirective(directive, "blob:", "data:", "vencord:"); + } + for (const [host, directives] of Object.entries(CspPolicies)) { for (const directive of directives) { pushDirective(directive, host); From eb3351d7550143c31f22d12c30f23768aa28e95e Mon Sep 17 00:00:00 2001 From: Vendicated Date: Fri, 24 Jan 2025 23:02:37 +0100 Subject: [PATCH 08/16] fix dearrow --- src/main/csp.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index c85ec7d96..d1559525a 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -46,7 +46,8 @@ export const CspPolicies: PolicyMap = { "manti.vendicated.dev": MediaSrc, // ReviewDB API "decor.fieryflames.dev": ConnectSrc, // Decor API "ugc.decor.fieryflames.dev": MediaSrc, // Decor CDN - "sponsor.ajay.app": MediaSrc, // Dearrow API + "sponsor.ajay.app": ConnectSrc, // Dearrow API + "dearrow-thumb.ajay.app": MediaSrc, // Dearrow Thumbnail CDN "usrbg.is-hardly.online": MediaSrc, // USRBG API }; From 99cca05db868ccb40cae2a16f2509cf5e3bb0854 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 00:56:11 +0200 Subject: [PATCH 09/16] unpkg -> jsdelivr --- src/main/csp.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index d1559525a..a426c5530 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -36,7 +36,7 @@ export const CspPolicies: PolicyMap = { // CDNs used for some things by Vencord. // FIXME: we really should not be using CDNs anymore "cdnjs.cloudflare.com": MediaScriptsAndCssSrc, - "unpkg.com": MediaScriptsAndCssSrc, + "cdn.jsdelivr.net": MediaScriptsAndCssSrc, // Function Specific "api.github.com": ConnectSrc, // used for updating Vencord itself From 0e3e14cb36d96c466683ce7eb2833b55c3823f70 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 01:48:39 +0200 Subject: [PATCH 10/16] add card to theme settings --- src/components/VencordSettings/ThemesTab.tsx | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/components/VencordSettings/ThemesTab.tsx b/src/components/VencordSettings/ThemesTab.tsx index f718ab11f..7e2ec1932 100644 --- a/src/components/VencordSettings/ThemesTab.tsx +++ b/src/components/VencordSettings/ThemesTab.tsx @@ -206,6 +206,7 @@ function ThemesTab() { } function renderLocalThemes() { + return ( <> @@ -219,6 +220,12 @@ function ThemesTab() { If using the BD site, click on "Download" and place the downloaded .theme.css file into your themes folder. + + External Resources + For security reasons, loading resources (styles, fonts, images, ...) from most sites is blocked. + Make sure all your assets are hosted on GitHub, GitLab, Codeberg, Imgur, Discord or Gogle Fonts. + + <> From e55736b9322da0030cdf5cf9b216828437519da2 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 01:52:59 +0200 Subject: [PATCH 11/16] remove empty newline --- src/components/VencordSettings/ThemesTab.tsx | 1 - 1 file changed, 1 deletion(-) diff --git a/src/components/VencordSettings/ThemesTab.tsx b/src/components/VencordSettings/ThemesTab.tsx index 7e2ec1932..d05431007 100644 --- a/src/components/VencordSettings/ThemesTab.tsx +++ b/src/components/VencordSettings/ThemesTab.tsx @@ -206,7 +206,6 @@ function ThemesTab() { } function renderLocalThemes() { - return ( <> From f401e0db686549586b475ebb3aae1594f824ad38 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 02:01:14 +0200 Subject: [PATCH 12/16] Fix ReverseImageSearch icons --- src/main/csp.ts | 1 + src/plugins/reverseImageSearch/index.tsx | 6 ++---- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index a426c5530..66ef2f8f5 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -49,6 +49,7 @@ export const CspPolicies: PolicyMap = { "sponsor.ajay.app": ConnectSrc, // Dearrow API "dearrow-thumb.ajay.app": MediaSrc, // Dearrow Thumbnail CDN "usrbg.is-hardly.online": MediaSrc, // USRBG API + "icons.duckduckgo.com": MediaSrc, // DuckDuckGo Favicon API (Reverse Image Search) }; const findHeader = (headers: PolicyMap, headerName: Lowercase) => { diff --git a/src/plugins/reverseImageSearch/index.tsx b/src/plugins/reverseImageSearch/index.tsx index 17fdb1803..a2e7b7e66 100644 --- a/src/plugins/reverseImageSearch/index.tsx +++ b/src/plugins/reverseImageSearch/index.tsx @@ -53,14 +53,12 @@ function makeSearchItem(src: string) { = 3 // Do not round Google, Yandex & SauceNAO - ? "50%" - : void 0 + borderRadius: "50%", }} aria-hidden="true" height={16} width={16} - src={new URL("/favicon.ico", Engines[engine]).toString().replace("lens.", "")} + src={`https://icons.duckduckgo.com/ip3/${new URL(Engines[engine]).host}.ico`} /> {engine} From 694c31f28f01fdb2887af7518171a4ca415203be Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 02:01:32 +0200 Subject: [PATCH 13/16] Gogle --- src/components/VencordSettings/ThemesTab.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/components/VencordSettings/ThemesTab.tsx b/src/components/VencordSettings/ThemesTab.tsx index d05431007..b4e867f7a 100644 --- a/src/components/VencordSettings/ThemesTab.tsx +++ b/src/components/VencordSettings/ThemesTab.tsx @@ -222,7 +222,7 @@ function ThemesTab() { External Resources For security reasons, loading resources (styles, fonts, images, ...) from most sites is blocked. - Make sure all your assets are hosted on GitHub, GitLab, Codeberg, Imgur, Discord or Gogle Fonts. + Make sure all your assets are hosted on GitHub, GitLab, Codeberg, Imgur, Discord or Google Fonts. From ffd1bd2d6a43f0f35594e403e5b0956a0cf1e6b2 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 02:04:19 +0200 Subject: [PATCH 14/16] make intent clearer --- src/main/csp.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 66ef2f8f5..2b92ad577 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -86,7 +86,7 @@ const patchCsp = (headers: Record) => { const csp = parsePolicy(headers[header][0]); const pushDirective = (directive: string, ...values: string[]) => { - csp[directive] ??= [...csp["default-src"] ?? []]; + csp[directive] ??= [...(csp["default-src"] ?? [])]; csp[directive].push(...values); }; From eea3a443fadb59dcab8d1295e6e3ff434116804b Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 02:10:34 +0200 Subject: [PATCH 15/16] add comment thingie --- src/main/csp.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/main/csp.ts b/src/main/csp.ts index 2b92ad577..82f1dd92d 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -14,6 +14,9 @@ const CssSrc = ["style-src", "font-src"]; const MediaAndCssSrc = [...MediaSrc, ...CssSrc]; const MediaScriptsAndCssSrc = [...MediaAndCssSrc, "script-src", "worker-src"]; +// Plugins can whitelist their own domains by importing this object in their native.ts +// script and just adding to it + export const CspPolicies: PolicyMap = { "*.github.io": MediaAndCssSrc, // github pages, used by most themes "raw.githubusercontent.com": MediaAndCssSrc, // github raw, used by some themes From cbf32913d20e25e40e3a4eac6d81f124ba976c00 Mon Sep 17 00:00:00 2001 From: Vendicated Date: Tue, 8 Apr 2025 02:13:22 +0200 Subject: [PATCH 16/16] yup --- src/main/csp.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/csp.ts b/src/main/csp.ts index 82f1dd92d..a9cb635ac 100644 --- a/src/main/csp.ts +++ b/src/main/csp.ts @@ -15,7 +15,7 @@ const MediaAndCssSrc = [...MediaSrc, ...CssSrc]; const MediaScriptsAndCssSrc = [...MediaAndCssSrc, "script-src", "worker-src"]; // Plugins can whitelist their own domains by importing this object in their native.ts -// script and just adding to it +// script and just adding to it. But generally, you should just edit this file instead export const CspPolicies: PolicyMap = { "*.github.io": MediaAndCssSrc, // github pages, used by most themes