feat: appプロトコルでfetch可能なディレクトリを制限する (#2153)

* feat: appプロトコルでfetch可能なディレクトリを制限する * fix: 参考URL追加 * fix: メンテナンス性向上のため条件を簡略化 Co-authored-by: Hiroshiba <[email protected]> --------- Co-authored-by: Hiroshiba <[email protected]>
VOICEVOX · Jul 6, 2024 · 3ce6c7e · 3ce6c7e
1 parent 8a4cdd2
commit 3ce6c7e
Showing 1 changed file with 18 additions and 2 deletions.
diff --git a/src/backend/electron/main.ts b/src/backend/electron/main.ts
@@ -3,6 +3,7 @@
 import path from "path";
 
 import fs from "fs";
+import { pathToFileURL } from "url";
 import {
   app,
   protocol,
@@ -428,8 +429,23 @@ async function createWindow() {
   // ソフトウェア起動時はプロトコルを app にする
   if (process.env.VITE_DEV_SERVER_URL == undefined) {
     protocol.handle("app", (request) => {
-      const filePath = path.join(__dirname, new URL(request.url).pathname);
-      return net.fetch(`file://${filePath}`);
+      // 読み取り先のファイルがインストールディレクトリ内であることを確認する
+      // ref: https://www.electronjs.org/ja/docs/latest/api/protocol#protocolhandlescheme-handler
+      const { pathname } = new URL(request.url);
+      const pathToServe = path.resolve(path.join(__dirname, pathname));
+      const relativePath = path.relative(__dirname, pathToServe);
+      const isUnsafe =
+        path.isAbsolute(relativePath) ||
+        relativePath.startsWith("..") ||
+        relativePath === "";
+      if (isUnsafe) {
+        log.error(`Bad Request URL: ${request.url}`);
+        return new Response("bad", {
+          status: 400,
+          headers: { "content-type": "text/html" },
+        });
+      }
+      return net.fetch(pathToFileURL(pathToServe).toString());
     });
   }