search

SpacingBat3 / WebCord

A Discord and SpaceBar :electron:-based client implemented without Discord API.
MIT License
1.92k stars 95 forks source link

Custom CSP configurable by the user #532

Open Janrupf opened 6 months ago

Janrupf commented 6 months ago

Description

At the moment WebCord provides a reasonable set of builtin CSP to be enabled and disabled. However, when adding custom themes, one may want to allow further domains.

Suggestions

Add the option to write custom CSP rules in order to add more domains to the allowlist.

This should probably clearly warn the user that they reduce the security and should never paste in random stuff.

Alternatives

The theme could be patched as to not require online resources.

Additional Context

Clear Vision is a custom Discord theme which claims to be "auto updating" - in reality this means they @import the actual theme, and the CSS file you download is just a kind of configuration file. Additionally it also loads some icons from custom domains.

Janrupf commented 6 months ago

After a bit of reading through WebCord's source code I noticed it actually handles @imports. So the theme actually broke because of url(...) referencing external images. Maybe these could be substituted in a similar way as imports by converting them to data uri's?