Pascal THUET
|
118062eac4
|
harden: secure extension and preset archive downloads (#3141)
* harden: secure extension and preset archive downloads
Adopt the shared download-security primitives from #3140 across extension and
preset catalog, package, direct-URL, and ZIP-install flows:
- bound catalog, package, and inline manifest reads;
- verify catalog SHA-256 values when present;
- replace path-only extraction with bounded traversal/symlink-safe extraction;
- validate malformed hosts and ports before opening download URLs;
- handle normalized trailing-backslash directory entries consistently.
Redirect enforcement and checksum verification remain owned by the shared
helpers already on main; this commit wires them into extension and preset
behavior.
Assisted-by: OpenAI Codex (model: GPT-5, autonomous)
* harden: close archive and catalog download edge cases
Preflight ZIP central directories before ZipFile allocates them, bound both
declared and actual payload sizes, and reject ambiguous or non-portable archive
paths before extraction.
Keep extension update manifest selection consistent with extraction, reject
unsafe catalog-derived output filenames and malformed URL types, and escape
untrusted values in download errors.
Add regression coverage for parser differentials, collisions, platform-specific
filenames, bounded call sites, and failure ordering.
Assisted-by: OpenAI Codex (model: GPT-5, autonomous)
* harden: address download security review feedback
Assisted-by: OpenAI Codex (model: GPT-5, autonomous)
* harden: close ZIP preflight review gaps
Assisted-by: OpenAI Codex (model: GPT-5, autonomous)
* fix: harden extension update preflight and rollback
Assisted-by: OpenAI Codex (model: GPT-5, autonomous)
* fix: harden extension update rollback
Assisted-by: OpenAI Codex (model: GPT-5, autonomous)
|
2026-07-28 07:52:07 -05:00 |
|
Pascal THUET
|
5601830ba3
|
harden: bound HTTP reads and enforce strict redirects (#3140)
* harden: bound HTTP reads and enforce strict redirects
Add a shared _download_security module (read_response_limited,
is_https_or_localhost_http, size constants) and route the GitHub release
and Azure DevOps token network reads through bounded reads so an oversized
response can't exhaust memory.
Add a strict_redirects mode to authentication.open_url: the redirect handler
now rejects any redirect whose target isn't HTTPS (or HTTP to localhost),
composing with the existing per-hop redirect_validator and auth-stripping.
The Azure DevOps token POST is routed through that handler so a 307/308
cannot forward the client_secret body to a non-HTTPS host.
Assisted-by: Codex (model: GPT-5, autonomous)
* test: align HTTP fakes with bounded reads
Assisted-by: Codex (model: GPT-5, autonomous)
* fix: tolerate invalid token response encoding
Assisted-by: Codex (model: GPT-5, autonomous)
* test: align GHES fakes with bounded reads
Assisted-by: Codex (model: GPT-5, autonomous)
* test: reuse shared upgrade HTTP response helper
Assisted-by: Codex (model: GPT-5, autonomous)
* fix: include rejected redirect target in error
Assisted-by: Codex (model: GPT-5, autonomous)
* fix: enforce strict redirects by default
Assisted-by: Codex (model: GPT-5, autonomous)
* fix: close redirect credential and SSRF gaps
Assisted-by: Codex (model: GPT-5, autonomous)
|
2026-07-22 11:08:32 -05:00 |
|