CalvinBackup/SpotiFLAC-Mobile
1
0
Fork 0
mirror of https://github.com/zarzet/SpotiFLAC-Mobile.git synced 2026-08-02 09:08:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(extensions): isolate invalid registry checksums

Browse Source
This commit is contained in:
zarzet
2026-07-26 12:29:28 +07:00
parent 5f5186a23e
commit 48f01ba146
2 changed files with 22 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go_backend/extension_package_security_test.go
+14 -11
View File
@@ -53,22 +53,25 @@ func TestWriteVerifiedExtensionPackageRejectsMismatchBeforeReplace(t *testing.T)
}
}
func TestRegistryRejectsMalformedExtensionChecksum(t *testing.T) {
_, err := parseRegistryBody([]byte(
`{"version":1,"extensions":[{"id":"ext","name":"ext","version":"1.0.0","sha256":"not-a-hash"}]}`,
))
if err == nil || !strings.Contains(err.Error(), "invalid SHA-256") {
t.Fatalf("expected invalid checksum error, got %v", err)
}
func TestRegistrySkipsOnlyExtensionWithMalformedChecksum(t *testing.T) {
checksum := strings.Repeat("a", sha256.Size*2)
registry, err := parseRegistryBody([]byte(
`{"version":1,"extensions":[{"id":"ext","name":"ext","version":"1.0.0","checksumSha256":"sha256:` +
`{"version":1,"extensions":[` +
`{"id":"bad","name":"bad","version":"1.0.0","sha256":"not-a-hash"},` +
`{"id":"verified","name":"verified","version":"1.0.0","checksumSha256":"sha256:` +
checksum +
`"}]}`,
`"},` +
`{"id":"legacy","name":"legacy","version":"1.0.0"}` +
`]}`,
))
if err != nil {
t.Fatalf("parse registry with checksum alias: %v", err)
t.Fatalf("parse registry: %v", err)
}
if len(registry.Extensions) != 2 {
t.Fatalf("registry extensions = %#v, want valid entries only", registry.Extensions)
}
if registry.Extensions[0].ID != "verified" || registry.Extensions[1].ID != "legacy" {
t.Fatalf("registry extension order = %#v", registry.Extensions)
}
if got := registry.Extensions[0].getSHA256(); got != checksum {
t.Fatalf("normalized checksum = %q, want %q", got, checksum)
go_backend/extension_repo.go
+8 -2
View File
@@ -331,16 +331,22 @@ func parseRegistryBody(body []byte) (*repoRegistry, error) {
}
return nil, fmt.Errorf("failed to parse registry: %w", err)
}
validExtensions := make([]repoExtension, 0, len(registry.Extensions))
for index := range registry.Extensions {
ext := &registry.Extensions[index]
rawChecksum := ext.getRawSHA256()
if rawChecksum != "" && normalizeSHA256(rawChecksum) == "" {
return nil, fmt.Errorf(
"extension %q has an invalid SHA-256 checksum",
LogWarn(
"ExtensionRepo",
"Skipping registry extension %q at index %d: invalid SHA-256 checksum",
ext.ID,
index,
)
continue
}
validExtensions = append(validExtensions, *ext)
}
registry.Extensions = validExtensions
return &registry, nil
}