Enable process sandboxing (#1206)

src/preload/VesktopNative.ts

@@ -4,9 +4,9 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-import { Node } from "@vencord/venmic";
-import { ipcRenderer } from "electron";
-import { IpcMessage, IpcResponse } from "main/ipcCommands";
+import type { Node } from "@vencord/venmic";
+import { ipcRenderer } from "electron/renderer";
+import type { IpcMessage, IpcResponse } from "main/ipcCommands";
 import type { Settings } from "shared/settings";
 
 import { IpcEvents } from "../shared/IpcEvents";
@@ -34,7 +34,14 @@ export const VesktopNative = {
         supportsWindowsTransparency: () => sendSync<boolean>(IpcEvents.SUPPORTS_WINDOWS_TRANSPARENCY),
         getEnableHardwareAcceleration: () => sendSync<boolean>(IpcEvents.GET_ENABLE_HARDWARE_ACCELERATION),
         isOutdated: () => invoke<boolean>(IpcEvents.UPDATER_IS_OUTDATED),
-        openUpdater: () => invoke<void>(IpcEvents.UPDATER_OPEN)
+        openUpdater: () => invoke<void>(IpcEvents.UPDATER_OPEN),
+        // used by vencord
+        getRendererCss: () => invoke<string>(IpcEvents.GET_VESKTOP_RENDERER_CSS),
+        onRendererCssUpdate: (cb: (newCss: string) => void) => {
+            if (!IS_DEV) return;
+
+            ipcRenderer.on(IpcEvents.VESKTOP_RENDERER_CSS_UPDATE, (_e, newCss: string) => cb(newCss));
+        }
     },
     autostart: {
         isEnabled: () => sendSync<boolean>(IpcEvents.AUTOSTART_ENABLED),

src/preload/index.ts

@@ -4,39 +4,29 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-import { contextBridge, ipcRenderer, webFrame } from "electron";
-import { readFileSync, watch } from "fs";
+import { contextBridge, ipcRenderer, webFrame } from "electron/renderer";
 
 import { IpcEvents } from "../shared/IpcEvents";
 import { VesktopNative } from "./VesktopNative";
 
 contextBridge.exposeInMainWorld("VesktopNative", VesktopNative);
 
-require(ipcRenderer.sendSync(IpcEvents.GET_VENCORD_PRELOAD_FILE));
+// TODO: remove this legacy workaround once some time has passed
+const isSandboxed = typeof __dirname === "undefined";
+if (isSandboxed) {
+    // While sandboxed, Electron "polyfills" these APIs as local variables.
+    // We have to pass them as arguments as they are not global
+    Function(
+        "require",
+        "Buffer",
+        "process",
+        "clearImmediate",
+        "setImmediate",
+        ipcRenderer.sendSync(IpcEvents.GET_VENCORD_PRELOAD_SCRIPT)
+    )(require, Buffer, process, clearImmediate, setImmediate);
+} else {
+    require(ipcRenderer.sendSync(IpcEvents.DEPRECATED_GET_VENCORD_PRELOAD_SCRIPT_PATH));
+}
 
 webFrame.executeJavaScript(ipcRenderer.sendSync(IpcEvents.GET_VENCORD_RENDERER_SCRIPT));
-webFrame.executeJavaScript(ipcRenderer.sendSync(IpcEvents.GET_RENDERER_SCRIPT));
-
-// #region css
-const rendererCss = ipcRenderer.sendSync(IpcEvents.GET_RENDERER_CSS_FILE);
-
-const style = document.createElement("style");
-style.id = "vcd-css-core";
-style.textContent = readFileSync(rendererCss, "utf-8");
-
-if (document.readyState === "complete") {
-    document.documentElement.appendChild(style);
-} else {
-    document.addEventListener("DOMContentLoaded", () => document.documentElement.appendChild(style), {
-        once: true
-    });
-}
-
-if (IS_DEV) {
-    // persistent means keep process running if watcher is the only thing still running
-    // which we obviously don't want
-    watch(rendererCss, { persistent: false }, () => {
-        document.getElementById("vcd-css-core")!.textContent = readFileSync(rendererCss, "utf-8");
-    });
-}
-// #endregion
+webFrame.executeJavaScript(ipcRenderer.sendSync(IpcEvents.GET_VESKTOP_RENDERER_SCRIPT));

src/preload/splash.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-import { contextBridge, ipcRenderer } from "electron";
+import { contextBridge, ipcRenderer } from "electron/renderer";
 
 contextBridge.exposeInMainWorld("VesktopSplashNative", {
     onUpdateMessage(callback: (message: string) => void) {

src/preload/typedIpc.ts

@@ -4,8 +4,8 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-import { ipcRenderer } from "electron";
-import { IpcEvents, UpdaterIpcEvents } from "shared/IpcEvents";
+import { ipcRenderer } from "electron/renderer";
+import type { IpcEvents, UpdaterIpcEvents } from "shared/IpcEvents";
 
 export function invoke<T = any>(event: IpcEvents | UpdaterIpcEvents, ...args: any[]) {
     return ipcRenderer.invoke(event, ...args) as Promise<T>;

src/preload/updater.ts

@@ -4,7 +4,7 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-import { contextBridge, ipcRenderer } from "electron";
+import { contextBridge, ipcRenderer } from "electron/renderer";
 import type { UpdateInfo } from "electron-updater";
 import { UpdaterIpcEvents } from "shared/IpcEvents";