Skip to content

Commit 48bdaca

Browse files
ZhuchkaTriplesixZhuchkaTriplesix
committed
fix(marketplace): restrict extension download URLs (HTTPS allowlist)
Closes #397 — validate API base and download URLs against trusted hosts and block cleartext/private targets in release builds.
1 parent 2f75025 commit 48bdaca

4 files changed

Lines changed: 243 additions & 1 deletion

File tree

‎lib/core/market/http_marketplace_repository.dart‎

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import 'dart:convert';
33
import 'dart:io';
44
import 'package:archive/archive.dart';
55
import 'package:crypto/crypto.dart';
6+
import 'package:flutter/foundation.dart';
67
import 'package:http/http.dart' as http;
78
import 'package:path/path.dart' as p;
89
import 'package:querya_desktop/core/extensions/extension_support.dart';
@@ -11,6 +12,7 @@ import 'package:querya_desktop/core/extensions/sandbox/sandbox_policy.dart';
1112
import 'package:querya_desktop/core/extensions/local_extension_registry.dart';
1213
import 'package:querya_desktop/core/extensions/models/extension_manifest.dart';
1314
import 'package:querya_desktop/core/extensions/models/extension_type.dart';
15+
import 'marketplace_download_policy.dart';
1416
import 'marketplace_repository.dart';
1517

1618
/// HTTP implementation of [MarketplaceRepository] connecting to MarketApi backend.
@@ -21,13 +23,46 @@ class HttpMarketplaceRepository implements MarketplaceRepository {
2123
HttpMarketplaceRepository({
2224
this.baseUrl = 'http://localhost:8000/api/v1',
2325
http.Client? client,
24-
}) : _client = client ?? http.Client();
26+
Iterable<String> extraTrustedDownloadHosts = const [],
27+
bool allowLocalhostInDebug = kDebugMode,
28+
}) : _client = client ?? http.Client(),
29+
_allowLocalhostInDebug = allowLocalhostInDebug,
30+
_trustedDownloadHosts = MarketplaceDownloadPolicy.trustedHostsFor(
31+
apiBaseUrl: baseUrl,
32+
extraTrustedHosts: extraTrustedDownloadHosts,
33+
) {
34+
_validateApiBaseUrl();
35+
}
2536

2637
final String baseUrl;
2738
final http.Client _client;
39+
final bool _allowLocalhostInDebug;
40+
final Set<String> _trustedDownloadHosts;
41+
42+
void _validateApiBaseUrl() {
43+
if (!MarketplaceDownloadPolicy.isAllowedApiBaseUrl(
44+
baseUrl,
45+
allowLocalhostInDebug: _allowLocalhostInDebug,
46+
)) {
47+
throw MarketplaceException(
48+
'Marketplace API base URL is not allowed: $baseUrl',
49+
);
50+
}
51+
}
52+
53+
void _validateDownloadUrl(Uri uri) {
54+
if (!MarketplaceDownloadPolicy.isAllowedDownloadUrl(
55+
uri,
56+
trustedHosts: _trustedDownloadHosts,
57+
allowLocalhostInDebug: _allowLocalhostInDebug,
58+
)) {
59+
throw MarketplaceException('Download URL is not allowed: $uri');
60+
}
61+
}
2862

2963
@override
3064
Future<List<ExtensionManifest>> getTrending({ExtensionType? type}) async {
65+
_validateApiBaseUrl();
3166
final uri = Uri.parse('$baseUrl/extensions/trending').replace(
3267
queryParameters: type != null ? {'type': type.value} : null,
3368
);
@@ -41,6 +76,7 @@ class HttpMarketplaceRepository implements MarketplaceRepository {
4176

4277
@override
4378
Future<List<ExtensionManifest>> search(String query, {ExtensionType? type}) async {
79+
_validateApiBaseUrl();
4480
final uri = Uri.parse('$baseUrl/extensions/search').replace(
4581
queryParameters: {
4682
'q': query.trim(),
@@ -61,6 +97,7 @@ class HttpMarketplaceRepository implements MarketplaceRepository {
6197
if (uri == null) {
6298
throw MarketplaceException('Invalid download URL: $url');
6399
}
100+
_validateDownloadUrl(uri);
64101

65102
final request = http.Request('GET', uri);
66103
final response = await _client.send(request).timeout(const Duration(seconds: 30));

‎lib/core/market/marketplace_download_policy.dart‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
import 'package:flutter/foundation.dart';
2+
3+
import '../theme/theme_remote_install_policy.dart';
4+
5+
/// HTTPS and host allowlist rules for marketplace API and artifact downloads.
6+
abstract final class MarketplaceDownloadPolicy {
7+
/// Hosts permitted for extension archive downloads (API host + extras).
8+
static Set<String> trustedHostsFor({
9+
required String apiBaseUrl,
10+
Iterable<String> extraTrustedHosts = const [],
11+
}) {
12+
final hosts = <String>{};
13+
final apiHost = Uri.tryParse(apiBaseUrl.trim())?.host.toLowerCase();
14+
if (apiHost != null && apiHost.isNotEmpty) {
15+
hosts.add(apiHost);
16+
}
17+
for (final host in extraTrustedHosts) {
18+
final normalized = host.trim().toLowerCase();
19+
if (normalized.isNotEmpty) {
20+
hosts.add(normalized);
21+
}
22+
}
23+
return hosts;
24+
}
25+
26+
/// Whether [baseUrl] may be used for MarketApi REST calls.
27+
static bool isAllowedApiBaseUrl(
28+
String baseUrl, {
29+
bool allowLocalhostInDebug = kDebugMode,
30+
}) {
31+
final uri = Uri.tryParse(baseUrl.trim());
32+
if (uri == null || !uri.hasAuthority || uri.host.isEmpty) {
33+
return false;
34+
}
35+
36+
if (uri.scheme == 'https') {
37+
return ThemeRemoteInstallPolicy.isAllowedUrl(
38+
uri,
39+
allowLocalhostInDebug: allowLocalhostInDebug,
40+
);
41+
}
42+
43+
if (allowLocalhostInDebug && uri.scheme == 'http') {
44+
return _isDebugLocalHttpHost(uri.host);
45+
}
46+
47+
return false;
48+
}
49+
50+
/// Whether [uri] may be used to download an extension archive.
51+
static bool isAllowedDownloadUrl(
52+
Uri uri, {
53+
required Set<String> trustedHosts,
54+
bool allowLocalhostInDebug = kDebugMode,
55+
}) {
56+
if (!uri.hasAuthority || uri.host.isEmpty) {
57+
return false;
58+
}
59+
60+
final host = uri.host.toLowerCase();
61+
if (!trustedHosts.contains(host)) {
62+
return false;
63+
}
64+
65+
if (uri.scheme == 'https') {
66+
return ThemeRemoteInstallPolicy.isAllowedUrl(
67+
uri,
68+
allowLocalhostInDebug: allowLocalhostInDebug,
69+
);
70+
}
71+
72+
if (allowLocalhostInDebug && uri.scheme == 'http') {
73+
return _isDebugLocalHttpHost(host);
74+
}
75+
76+
return false;
77+
}
78+
79+
static bool _isDebugLocalHttpHost(String host) {
80+
final probe = Uri.parse('https://$host/');
81+
return ThemeRemoteInstallPolicy.isAllowedUrl(
82+
probe,
83+
allowLocalhostInDebug: true,
84+
);
85+
}
86+
}

‎test/core/market/marketplace_download_policy_test.dart‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
import 'package:flutter_test/flutter_test.dart';
2+
import 'package:querya_desktop/core/market/marketplace_download_policy.dart';
3+
4+
void main() {
5+
group('MarketplaceDownloadPolicy', () {
6+
test('trustedHostsFor includes API host and extras', () {
7+
expect(
8+
MarketplaceDownloadPolicy.trustedHostsFor(
9+
apiBaseUrl: 'https://api.example.com/api/v1',
10+
extraTrustedHosts: ['cdn.example.com'],
11+
),
12+
{'api.example.com', 'cdn.example.com'},
13+
);
14+
});
15+
16+
test('isAllowedApiBaseUrl allows public https API', () {
17+
expect(
18+
MarketplaceDownloadPolicy.isAllowedApiBaseUrl(
19+
'https://api.example.com/api/v1',
20+
allowLocalhostInDebug: false,
21+
),
22+
isTrue,
23+
);
24+
});
25+
26+
test('isAllowedApiBaseUrl rejects cleartext in release mode', () {
27+
expect(
28+
MarketplaceDownloadPolicy.isAllowedApiBaseUrl(
29+
'http://localhost:8000/api/v1',
30+
allowLocalhostInDebug: false,
31+
),
32+
isFalse,
33+
);
34+
});
35+
36+
test('isAllowedApiBaseUrl allows localhost http in debug mode', () {
37+
expect(
38+
MarketplaceDownloadPolicy.isAllowedApiBaseUrl(
39+
'http://localhost:8000/api/v1',
40+
allowLocalhostInDebug: true,
41+
),
42+
isTrue,
43+
);
44+
});
45+
46+
test('isAllowedDownloadUrl rejects untrusted host', () {
47+
expect(
48+
MarketplaceDownloadPolicy.isAllowedDownloadUrl(
49+
Uri.parse('https://evil.example.com/pkg.zip'),
50+
trustedHosts: {'api.example.com'},
51+
allowLocalhostInDebug: false,
52+
),
53+
isFalse,
54+
);
55+
});
56+
57+
test('isAllowedDownloadUrl rejects private IPs in release mode', () {
58+
expect(
59+
MarketplaceDownloadPolicy.isAllowedDownloadUrl(
60+
Uri.parse('https://192.168.1.10/pkg.zip'),
61+
trustedHosts: {'192.168.1.10'},
62+
allowLocalhostInDebug: false,
63+
),
64+
isFalse,
65+
);
66+
});
67+
68+
test('isAllowedDownloadUrl rejects file scheme', () {
69+
expect(
70+
MarketplaceDownloadPolicy.isAllowedDownloadUrl(
71+
Uri.parse('file:///etc/passwd'),
72+
trustedHosts: {'localhost'},
73+
allowLocalhostInDebug: true,
74+
),
75+
isFalse,
76+
);
77+
});
78+
79+
test('isAllowedDownloadUrl allows trusted public https host', () {
80+
expect(
81+
MarketplaceDownloadPolicy.isAllowedDownloadUrl(
82+
Uri.parse('https://cdn.example.com/pkg.zip'),
83+
trustedHosts: {'cdn.example.com'},
84+
allowLocalhostInDebug: false,
85+
),
86+
isTrue,
87+
);
88+
});
89+
});
90+
}

‎test/core/market/marketplace_repository_test.dart‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,35 @@ void main() {
294294
)),
295295
);
296296
});
297+
298+
test('download rejects disallowed URLs when release policy is enforced',
299+
() async {
300+
final repo = HttpMarketplaceRepository(
301+
baseUrl: 'https://cdn.example.com/api/v1',
302+
extraTrustedDownloadHosts: ['cdn.example.com'],
303+
allowLocalhostInDebug: false,
304+
client: MockClient((request) async => http.Response('', 200)),
305+
);
306+
307+
expect(
308+
() => repo.download('http://cdn.example.com/test.zip'),
309+
throwsA(isA<MarketplaceException>().having(
310+
(e) => e.message,
311+
'message',
312+
contains('Download URL is not allowed'),
313+
)),
314+
);
315+
316+
expect(
317+
() => repo.download('https://127.0.0.1/test.zip'),
318+
throwsA(isA<MarketplaceException>()),
319+
);
320+
321+
expect(
322+
() => repo.download('file:///tmp/test.zip'),
323+
throwsA(isA<MarketplaceException>()),
324+
);
325+
});
297326
});
298327
}
299328

0 commit comments

Comments
 (0)