fix(security): sandbox vikingdb:// protocol to userData directory (#363)

The renderer-loadable `vikingdb://` protocol read any local file the
main-process had access to: the handler ran `path.resolve(filePath)` and
passed the result straight to `fs.readFileSync` with no allow-list. A
markdown image such as `![](vikingdb:///Users/<u>/.ssh/id_rsa)` rendered
in any vault note, chat reply, or LLM response would have caused the main
process to read that file and stream the bytes back into the renderer.

This is amplified by two adjacent settings:

  * `webPreferences.webSecurity` is `false`, so the renderer can `fetch()`
    a custom-protocol URL and read the response body in JS.
  * `renderer/index.html`'s CSP allows `connect-src *` and
    `script-src 'unsafe-inline' 'unsafe-eval' *`, so any future renderer
    XSS — including a stored one in vault content — has unrestricted
    network egress.

Combined, the original handler turned even a minor renderer XSS into a
full local-file exfiltration primitive.

Fix: constrain the resolved path to the directory the backend writes its
data into. In production this is `app.getPath('userData')`, which mirrors
`CONTEXT_PATH` in `backend.ts` (the env var the backend uses for its own
storage root). In dev the backend is launched with `CONTEXT_PATH='.'`, so
we mirror that and allow the project working directory.

We also `fs.realpathSync` the resolved path before the under-root check,
so a symlink planted inside userData (e.g. by another local process) can't
be used to escape the sandbox.

The MIME-type table, error codes, and callback shape are unchanged, so
legitimate image loads under userData continue to work.

Author: Chen17-sq

frontend/src/main/index.ts

@@ -198,28 +198,50 @@ app.whenReady().then(() => {
       let filePath = request.url.replace('vikingdb://', '')
       filePath = decodeURIComponent(filePath)
 
-      const fullPath = path.resolve(filePath)
+      const resolved = path.resolve(filePath)
 
-      console.log('Reading file:', fullPath)
+      if (!fs.existsSync(resolved)) {
+        callback({ error: -6 /* net::ERR_FILE_NOT_FOUND */ })
+        return
+      }
 
-      if (fs.existsSync(fullPath)) {
-        const data = fs.readFileSync(fullPath)
-        const extension = path.extname(fullPath).toLowerCase()
+      // Constrain reads to the directory the backend writes its data into
+      // (mirrors `CONTEXT_PATH` in backend.ts). Without this, the renderer
+      // can read arbitrary local files via e.g. `vikingdb:///Users/<u>/.ssh/id_rsa`,
+      // which combined with `webSecurity: false` and the permissive CSP
+      // (`connect-src *`) makes any future renderer XSS a full local-file
+      // exfiltration primitive. We also realpath() the resolved path so a
+      // symlink planted inside userData cannot be used to escape the sandbox.
+      const allowedRoot =
+        !app.isPackaged && is.dev
+          ? path.resolve('.')
+          : path.resolve(app.getPath('userData'))
+      const realPath = fs.realpathSync(resolved)
+      const isUnderRoot =
+        realPath === allowedRoot || realPath.startsWith(allowedRoot + path.sep)
+
+      if (!isUnderRoot) {
+        console.error(
+          `vikingdb:// blocked path outside allowed root: ${realPath} (root: ${allowedRoot})`
+        )
+        callback({ error: -10 /* net::ERR_ACCESS_DENIED */ })
+        return
+      }
 
-        // Set MIME type based on file extension
-        let mimeType = 'application/octet-stream'
-        if (extension === '.png') mimeType = 'image/png'
-        else if (extension === '.jpg' || extension === '.jpeg') mimeType = 'image/jpeg'
-        else if (extension === '.gif') mimeType = 'image/gif'
-        else if (extension === '.svg') mimeType = 'image/svg+xml'
+      const data = fs.readFileSync(realPath)
+      const extension = path.extname(realPath).toLowerCase()
 
-        callback({
-          mimeType: mimeType,
-          data: data
-        })
-      } else {
-        callback({ error: -6 })
-      }
+      // Set MIME type based on file extension
+      let mimeType = 'application/octet-stream'
+      if (extension === '.png') mimeType = 'image/png'
+      else if (extension === '.jpg' || extension === '.jpeg') mimeType = 'image/jpeg'
+      else if (extension === '.gif') mimeType = 'image/gif'
+      else if (extension === '.svg') mimeType = 'image/svg+xml'
+
+      callback({
+        mimeType: mimeType,
+        data: data
+      })
     } catch (error) {
       console.error('Error reading file:', error)
       callback({ error: -2 })