mirror of
https://github.com/storytold/figcraft.git
synced 2026-10-26 19:36:46 -06:00
skylar taylor-barrick
37419afe14
A document carries things the app acts on for whoever opens it. Three of them were taken as given. Prototype Open link and Dev Mode dev resources both reached the platform's opener with any scheme. In the web build the opener is window.open, so a saved document could run script in the app's own origin; on the desktop any scheme went to the system's handler. Both now pass through the new engine module `doc_urls`, which allows http, https and mailto and nothing else. It is an allow-list on purpose: a list of known-bad schemes is outgrown by every handler a platform adds. A figcraft:// invite link joined the session at once. The system hands the app whatever such link was followed, which may come from a page or a message, so the Join dialog now opens with the link filled in and the person confirms. A library link stored in a document was loaded from wherever it pointed. Only a path on this computer is followed now, so opening someone else's file cannot make the app contact their server (which on Windows would also send credentials). Tests: each change has one that fails without it, verified by reverting. The prototype test fires through an afterDelay trigger, since no click is needed, and keeps a positive case so a refusal cannot pass vacuously.
31 lines
1.3 KiB
Rust
31 lines
1.3 KiB
Rust
//! A library link is stored in the document, so it is followed only on this computer
|
|
//! ([`crate::library_server`]): a path on another server would make opening someone else's file
|
|
//! contact that server, and on Windows send the credentials of whoever opened it.
|
|
|
|
use crate::Session;
|
|
|
|
#[test]
|
|
fn a_library_is_opened_only_from_this_computer() {
|
|
let mut s = Session::new();
|
|
for path in [
|
|
r"\\attacker.example\share\lib.figcraft",
|
|
"//attacker.example/share/lib.figcraft",
|
|
"file://attacker.example/share/lib.figcraft",
|
|
r"\\?\UNC\attacker.example\share\lib.figcraft",
|
|
r"\\.\pipe\lib",
|
|
"https://attacker.example/lib.figcraft",
|
|
] {
|
|
let e = s.fetch_library(path, false).expect_err(&format!("{path} must be refused"));
|
|
assert!(e.to_string().contains("only from this computer"), "{path}: {e}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn a_local_library_path_is_still_followed() {
|
|
let mut s = Session::new();
|
|
// Refused for being absent, not for where it is: the gate let it through.
|
|
let missing = std::env::temp_dir().join("figcraft-no-such-library.figcraft");
|
|
let e = s.fetch_library(&missing.to_string_lossy(), false).expect_err("the file does not exist");
|
|
assert!(!e.to_string().contains("only from this computer"), "a local path must not be refused as remote: {e}");
|
|
}
|