From fa46c4c4d2f19114bc87842ae46b988e39e6a0e7 Mon Sep 17 00:00:00 2001
From: Vendicated <vendicated@riseup.net>
Date: Sat, 6 Dec 2025 21:33:58 +0100
Subject: [PATCH] settings sync: disallow possibly insecure settings

realistically this shouldn't matter too much, but still good to have
---
 src/api/SettingsSync/offline.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/api/SettingsSync/offline.ts b/src/api/SettingsSync/offline.ts
index aced11e81..5ff509caf 100644
--- a/src/api/SettingsSync/offline.ts
+++ b/src/api/SettingsSync/offline.ts
@@ -24,6 +24,21 @@ const toastFailure = (err: any) =>
 
 const logger = new Logger("SettingsSync:Offline", "#39b7e0");
 
+function isSafeObject(obj: any) {
+    if (obj == null || typeof obj !== "object") return true;
+
+    for (const key in obj) {
+        if (["__proto__", "constructor", "prototype"].includes(key)) {
+            return false;
+        }
+        if (!isSafeObject(obj[key])) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 export async function importSettings(data: string) {
     try {
         var parsed = JSON.parse(data);
@@ -32,6 +47,9 @@ export async function importSettings(data: string) {
         throw new Error("Failed to parse JSON: " + String(err));
     }
 
+    if (!isSafeObject(parsed))
+        throw new Error("Unsafe Settings");
+
     if ("settings" in parsed && "quickCss" in parsed) {
         Object.assign(PlainSettings, parsed.settings);
         await VencordNative.settings.set(parsed.settings);