From d057ec4736739281624e33c43758ae565737e955 Mon Sep 17 00:00:00 2001 From: Lucas Fernandes Nogueira Date: Sun, 11 Oct 2026 16:11:41 -0300 Subject: [PATCH] fix(updater): warn when the update download URL is not https (#3694) * fix(updater): warn when the update download URL is not https `validate_endpoints` enforces `https` for the endpoints, but not for the `url` of the manifest, so the artifact can be downloaded in plaintext. Enforcing it would break existing releases (left for v3); `Update::download` now logs a warning instead, unless `dangerousInsecureTransportProtocol` is enabled. plugins/updater/src/updater.rs * Apply suggestion from @lucasfernog --- .changes/updater-warn-insecure-download.md | 6 ++++++ plugins/updater/src/updater.rs | 12 ++++++++++++ 2 files changed, 18 insertions(+) create mode 100644 .changes/updater-warn-insecure-download.md diff --git a/.changes/updater-warn-insecure-download.md b/.changes/updater-warn-insecure-download.md new file mode 100644 index 000000000..5b5448a11 --- /dev/null +++ b/.changes/updater-warn-insecure-download.md @@ -0,0 +1,6 @@ +--- +updater: patch +updater-js: patch +--- + +Log a warning when the download URL of an update does not use `https` and `dangerousInsecureTransportProtocol` is not enabled. diff --git a/plugins/updater/src/updater.rs b/plugins/updater/src/updater.rs index 71e124b0e..ca456b0a8 100644 --- a/plugins/updater/src/updater.rs +++ b/plugins/updater/src/updater.rs @@ -821,6 +821,18 @@ impl Update { mut on_chunk: C, on_download_finish: D, ) -> Result> { + // not enforced (unlike for the endpoints) as that would break existing releases, but the + // artifact then travels in plaintext: only its signature protects it + // TODO(v3): enforce it + if self.download_url.scheme() != "https" + && !self.context.config.dangerous_insecure_transport_protocol + { + log::warn!( + "the update download URL {} does not use the `https` protocol", + self.download_url + ); + } + // set our headers let mut headers = self.headers.clone(); if !headers.contains_key(ACCEPT) {