use custom protocol instead of file:// for better security

src/main/utils/ipcWrappers.ts

@@ -18,7 +18,7 @@ export function validateSender(frame: WebFrameMain | null, event: string) {
         throw new Error(`ipc[${event}]: Invalid URL ${frame.url}`);
     }
 
-    if (protocol === "file:") return;
+    if (protocol === "file:" || protocol === "vesktop:") return;
 
     if (!DISCORD_HOSTNAMES.includes(hostname)) {
         throw new Error(`ipc[${event}]: Disallowed hostname ${hostname}`);

src/main/utils/isPathInDirectory.ts

@@ -0,0 +1,16 @@
+/*
+ * Vesktop, a desktop app aiming to give you a snappier Discord Experience
+ * Copyright (c) 2025 Vendicated and Vesktop contributors
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+import { resolve, sep } from "path";
+
+export function isPathInDirectory(filePath: string, directory: string) {
+    const resolvedPath = resolve(filePath);
+    const resolvedDirectory = resolve(directory);
+
+    const normalizedDirectory = resolvedDirectory.endsWith(sep) ? resolvedDirectory : resolvedDirectory + sep;
+
+    return resolvedPath.startsWith(normalizedDirectory) || resolvedPath === resolvedDirectory;
+}