@@ -4,7 +4,7 @@ import path from "node:path";
44
55import fs from "node:fs" ;
66import { pathToFileURL } from "node:url" ;
7- import { app , dialog , Menu , net , protocol , shell } from "electron" ;
7+ import { app , dialog , Menu , net , protocol , session , shell } from "electron" ;
88import installExtension , { VUEJS_DEVTOOLS } from "electron-devtools-installer" ;
99
1010import electronLog from "electron-log/main" ;
@@ -22,6 +22,7 @@ import { registerIpcMainHandle, ipcMainSendProxy, IpcMainHandle } from "./ipc";
2222import { getConfigManager } from "./electronConfig" ;
2323import { getEngineAndVvppController } from "./engineAndVvppController" ;
2424import { getIpcMainHandle } from "./ipcMainHandle" ;
25+ import { assertNonNullable } from "@/type/utility" ;
2526import { EngineInfo } from "@/type/preload" ;
2627import { isMac , isProduction } from "@/helpers/platform" ;
2728import { createLogger } from "@/helpers/log" ;
@@ -163,6 +164,28 @@ void app.whenReady().then(() => {
163164 } ) ;
164165} ) ;
165166
167+ // 信頼できるオリジン(開発サーバーまたは app プロトコル)からのセッション権限リクエストのみ許可し、それ以外は拒否
168+ void app . whenReady ( ) . then ( ( ) => {
169+ session . defaultSession . setPermissionRequestHandler (
170+ ( webContents , permission , callback , { requestingUrl } ) => {
171+ const parsedUrl = new URL ( webContents . getURL ( ) ) ;
172+ const parsedRequestingUrl = new URL ( requestingUrl ) ;
173+ let isAllowedResource : boolean ;
174+ if ( isDevelopment ) {
175+ assertNonNullable ( import . meta. env . VITE_DEV_SERVER_URL ) ;
176+ const { origin } = new URL ( import . meta. env . VITE_DEV_SERVER_URL ) ;
177+ isAllowedResource =
178+ parsedUrl . origin === origin && parsedRequestingUrl . origin === origin ;
179+ } else {
180+ isAllowedResource =
181+ parsedUrl . protocol === "app:" &&
182+ parsedRequestingUrl . protocol === "app:" ;
183+ }
184+ return callback ( isAllowedResource ) ;
185+ } ,
186+ ) ;
187+ } ) ;
188+
166189// engine
167190const vvppEngineDir = path . join ( app . getPath ( "userData" ) , "vvpp-engines" ) ;
168191
0 commit comments