SpacingBat3 / WebCord

A Discord and SpaceBar :electron:-based client implemented without Discord API.
MIT License
1.88k stars 93 forks source link

Wrong Website popup #462

Closed MarkusTieger closed 11 months ago

MarkusTieger commented 11 months ago

Acknowledgements

Operating System / Platform

🐧️ Linux

Operating system architecture

x64 (64-bit Intel/AMD)

Electron version

25.6.0

Application version

4.4.0

Bug description

When opening a link in a chat, this popup appears: image

In an about me or with markdown hidden: image

Send these two messages in an temporary channel: [test](https://google.com) https://google.com

You will see, that the first one, has the official discord warning and the second one in gtk. (i prefer the gtk one btw)

Additional context

"This issue is confirmed to be reproducible when WebCord is packaged on at least all three latest supported Electron major releases." and "This issue is reproducible in Chrome, Chromium or any Chromium-based browser, e.g Brave or Edge (please write in Additional Context which browser you have used if it is neither Chrome nor unmodified Chromium)." are not checked, not because it is there not reproducible, but because i didn't test it.

Tested on: aur/webcord-vencord-git

SpacingBat3 commented 11 months ago

Send these two messages in an temporary channel: [test](https://google.com/) https://google.com/

You will see, that the first one, has the official discord warning and the second one in gtk. (i prefer the gtk one btw)

This is not a bug, actually. The reason there are two pop-ups is that there are two protections for URIs: Discord built-in ones and WebCord ones. I've added an additional layer of protection into the client, just so we don't have to rely on Discord assumptions. You might even see that the GTK popup will always occur on any link being opened externally, outside of the links with the same website origin (//discord.com in case of Discord). The filter in WebCord also denies the use of some protocols and warns about insecure protocols (like http:) in URIs. The popup will also freeze the application so spamming the URL redirections isn't really that possible in case of Discord or any other script capable of doing that (possibly even Discord dependencies could you to any domain they want).

You might disable GTK dialogs if you really want to, but this way you rely on Discord and everything it loads to not to be evil and to not do any kind of spam or automatic link opening.

Anyway, I'll close this issue as invalid (since this is not a bug). You're still free to comment here though if you want to.