From 786c3cc1969770e15260b47e71558b51f3f88358 Mon Sep 17 00:00:00 2001
From: Vendicated <vendicated@riseup.net>
Date: Wed, 7 Jan 2026 22:57:23 +0100
Subject: [PATCH] security: don't let renderer know custom vencord path

It's best not to let the renderer know about the system's file structure.
In case of a vulnerability allowing arbitrary file writes, this would make it considerably easier to overwrite critical files
---
 src/main/ipc.ts                                   | 15 ++++++++++-----
 src/preload/VesktopNative.ts                      |  4 ++--
 .../components/settings/DeveloperOptions.tsx      |  8 ++++----
 src/shared/IpcEvents.ts                           |  4 ++--
 4 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/src/main/ipc.ts b/src/main/ipc.ts
index 41c9743..9a17526 100644
--- a/src/main/ipc.ts
+++ b/src/main/ipc.ts
@@ -19,7 +19,7 @@ import {
     shell
 } from "electron";
 import { readFileSync, watch } from "fs";
-import { readFile } from "fs/promises";
+import { readFile, stat } from "fs/promises";
 import { enableHardwareAcceleration } from "main";
 import { release } from "os";
 import { join } from "path";
@@ -91,8 +91,15 @@ handle(IpcEvents.RELAUNCH, async () => {
     app.exit();
 });
 
-handle(IpcEvents.SHOW_ITEM_IN_FOLDER, (_, path) => {
-    shell.showItemInFolder(path);
+handleSync(IpcEvents.IS_USING_CUSTOM_VENCORD_DIR, () => !!State.store.vencordDir);
+handle(IpcEvents.SHOW_CUSTOM_VENCORD_DIR, async () => {
+    const { vencordDir } = State.store;
+    if (!vencordDir) return;
+
+    const stats = await stat(vencordDir);
+    if (!stats.isDirectory()) return;
+
+    shell.openPath(vencordDir);
 });
 
 function getWindow(e: IpcMainInvokeEvent, key?: string) {
@@ -133,8 +140,6 @@ handle(IpcEvents.SPELLCHECK_ADD_TO_DICTIONARY, (e, word: string) => {
     e.sender.session.addWordToSpellCheckerDictionary(word);
 });
 
-handleSync(IpcEvents.GET_VENCORD_DIR, e => (e.returnValue = State.store.vencordDir));
-
 handle(IpcEvents.SELECT_VENCORD_DIR, async (_e, value?: null) => {
     if (value === null) {
         delete State.store.vencordDir;
diff --git a/src/preload/VesktopNative.ts b/src/preload/VesktopNative.ts
index 91f7103..e11fae7 100644
--- a/src/preload/VesktopNative.ts
+++ b/src/preload/VesktopNative.ts
@@ -49,8 +49,8 @@ export const VesktopNative = {
         disable: () => invoke<void>(IpcEvents.DISABLE_AUTOSTART)
     },
     fileManager: {
-        showItemInFolder: (path: string) => invoke<void>(IpcEvents.SHOW_ITEM_IN_FOLDER, path),
-        getVencordDir: () => sendSync<string | undefined>(IpcEvents.GET_VENCORD_DIR),
+        isUsingCustomVencordDir: () => sendSync<boolean>(IpcEvents.IS_USING_CUSTOM_VENCORD_DIR),
+        showCustomVencordDir: () => invoke<void>(IpcEvents.SHOW_CUSTOM_VENCORD_DIR),
         selectVencordDir: (value?: null) => invoke<"cancelled" | "invalid" | "ok">(IpcEvents.SELECT_VENCORD_DIR, value),
         chooseUserAsset: (asset: string, value?: null) =>
             invoke<"cancelled" | "invalid" | "ok" | "failed">(IpcEvents.CHOOSE_USER_ASSET, asset, value)
diff --git a/src/renderer/components/settings/DeveloperOptions.tsx b/src/renderer/components/settings/DeveloperOptions.tsx
index 55dacc7..87c69a8 100644
--- a/src/renderer/components/settings/DeveloperOptions.tsx
+++ b/src/renderer/components/settings/DeveloperOptions.tsx
@@ -56,21 +56,21 @@ function openDeveloperOptionsModal(settings: Settings) {
 
 const VencordLocationPicker: SettingsComponent = ({ settings }) => {
     const forceUpdate = useForceUpdater();
-    const vencordDir = VesktopNative.fileManager.getVencordDir();
+    const usingCustomVencordDir = VesktopNative.fileManager.isUsingCustomVencordDir();
 
     return (
         <>
             <Paragraph>
                 Vencord files are loaded from{" "}
-                {vencordDir ? (
+                {usingCustomVencordDir ? (
                     <TextButton
                         variant="link"
                         onClick={e => {
                             e.preventDefault();
-                            VesktopNative.fileManager.showItemInFolder(vencordDir!);
+                            VesktopNative.fileManager.showCustomVencordDir();
                         }}
                     >
-                        {vencordDir}
+                        a custom location
                     </TextButton>
                 ) : (
                     "the default location"
diff --git a/src/shared/IpcEvents.ts b/src/shared/IpcEvents.ts
index 95049b3..075ec14 100644
--- a/src/shared/IpcEvents.ts
+++ b/src/shared/IpcEvents.ts
@@ -23,11 +23,11 @@ export const enum IpcEvents {
     MINIMIZE = "VCD_MINIMIZE",
     MAXIMIZE = "VCD_MAXIMIZE",
 
-    SHOW_ITEM_IN_FOLDER = "VCD_SHOW_ITEM_IN_FOLDER",
     GET_SETTINGS = "VCD_GET_SETTINGS",
     SET_SETTINGS = "VCD_SET_SETTINGS",
 
-    GET_VENCORD_DIR = "VCD_GET_VENCORD_DIR",
+    IS_USING_CUSTOM_VENCORD_DIR = "VCD_IS_USING_CUSTOM_VENCORD_DIR",
+    SHOW_CUSTOM_VENCORD_DIR = "VCD_SHOW_CUSTOM_VENCORD_DIR",
     SELECT_VENCORD_DIR = "VCD_SELECT_VENCORD_DIR",
 
     UPDATER_IS_OUTDATED = "VCD_UPDATER_IS_OUTDATED",