Skip to content
This repository was archived by the owner on Nov 15, 2017. It is now read-only.

Commit 0200aa1

Browse files
gorhillgorhill
committed
hardening update code for #334 
1 parent a88723e commit 0200aa1

File tree

3 files changed

+52
-25
lines changed

3 files changed

+52
-25
lines changed

‎background.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
<body>
77
<script src="lib/punycode.min.js"></script>
88
<script src="lib/publicsuffixlist.min.js"></script>
9+
<script src="lib/md5omatic.min.js"></script>
910
<script src="js/types.js"></script>
1011
<script src="js/usersettings.js"></script>
1112
<script src="js/lists.js"></script>

‎js/asset-updater.js‎

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,13 @@ var getUpdateList = function(msg) {
3939
}
4040
switch ( request.what ) {
4141
case 'assetManagerLocalChecksumsLoaded':
42-
localChecksumsText = request.error ? 'Error' : request.content;
42+
localChecksumsText = validateChecksums(request);
4343
if ( remoteChecksumsText !== '' ) {
4444
compareChecksums();
4545
}
4646
break;
4747
case 'assetManagerRemoteChecksumsLoaded':
48-
remoteChecksumsText = request.error ? 'Error' : request.content;
48+
remoteChecksumsText = validateChecksums(request);
4949
if ( localChecksumsText !== '' ) {
5050
compareChecksums();
5151
}
@@ -55,6 +55,16 @@ var getUpdateList = function(msg) {
5555
}
5656
};
5757

58+
var validateChecksums = function(request) {
59+
if ( request.error || request.content === '' ) {
60+
return 'Error';
61+
}
62+
if ( /^(?:[0-9a-f]{32}\s+\S+(\s+|$))+/.test(request.content) ) {
63+
return request.content;
64+
}
65+
return 'Error';
66+
};
67+
5868
var compareChecksums = function() {
5969
chrome.runtime.onMessage.removeListener(onMessage);
6070

@@ -179,9 +189,7 @@ var updateList = function(list) {
179189

180190
var onAllLocalAssetUpdated = function(details) {
181191
chrome.runtime.onMessage.removeListener(onMessage);
182-
chrome.runtime.sendMessage({
183-
'what': 'allLocalAssetsUpdated'
184-
});
192+
chrome.runtime.sendMessage({ 'what': 'allLocalAssetsUpdated' });
185193
};
186194

187195
chrome.runtime.onMessage.addListener(onMessage);
@@ -193,13 +201,19 @@ var updateList = function(list) {
193201
}
194202
entry = list[path];
195203
if ( entry.status === 'Added' || entry.status === 'Changed' ) {
196-
HTTPSB.assets.update(path, 'assetManagerLocalAssetUpdated');
197-
} else {
198-
if ( entry.status === 'Unchanged' ) {
199-
updatedAssetChecksums.push(entry.localChecksum + ' ' + path);
200-
}
201-
assetToUpdateCount -= 1;
204+
HTTPSB.assets.update(
205+
{
206+
path: path,
207+
md5: entry.remoteChecksum
208+
},
209+
'assetManagerLocalAssetUpdated'
210+
);
211+
continue;
202212
}
213+
if ( entry.status === 'Unchanged' ) {
214+
updatedAssetChecksums.push(entry.localChecksum + ' ' + path);
215+
}
216+
assetToUpdateCount -= 1;
203217
}
204218
};
205219

‎js/assets.js‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ File system structure:
6161
/******************************************************************************/
6262

6363
var fileSystem;
64-
var fileSystemQuota = 30 * 1024 * 1024;
64+
var fileSystemQuota = 40 * 1024 * 1024;
6565
var remoteRoot = HTTPSB.projectServerRoot;
6666

6767
/******************************************************************************/
@@ -359,33 +359,45 @@ var writeLocalFile = function(path, content, msg) {
359359

360360
/******************************************************************************/
361361

362-
var updateFromRemote = function(path, msg) {
362+
var updateFromRemote = function(details, msg) {
363363
// 'httpsb=...' is to skip browser cache
364-
var remoteURL = remoteRoot + path + '?httpsb=' + Date.now();
364+
var remoteURL = remoteRoot + details.path + '?httpsb=' + Date.now();
365+
366+
var sendErrorMessage = function() {
367+
chrome.runtime.sendMessage({
368+
'what': msg,
369+
'path': details.path,
370+
'error': 'Error'
371+
});
372+
};
365373

366374
var onRemoteFileLoaded = function() {
367-
// console.log('HTTP Switchboard> updateFromRemote() / onRemoteFileLoaded()');
368-
if ( this.responseText && this.responseText.length ) {
369-
writeLocalFile(path, this.responseText, msg);
370-
}
371375
this.onload = this.onerror = null;
376+
// console.log('HTTPSB> updateFromRemote("%s") / onRemoteFileLoaded()', remoteURL);
377+
if ( typeof this.responseText !== 'string' ) {
378+
console.error('HTTPSB> updateFromRemote("%s") / onRemoteFileLoaded(): no response', remoteURL);
379+
sendErrorMessage();
380+
return;
381+
}
382+
if ( typeof details.md5 === 'string' && details.md5 !== md5omatic(this.responseText) ) {
383+
console.error('HTTPSB> updateFromRemote("%s") / onRemoteFileLoaded(): bad md5 checksum', remoteURL);
384+
sendErrorMessage();
385+
return;
386+
}
387+
writeLocalFile(details.path, this.responseText, msg);
372388
};
373389

374390
var onRemoteFileError = function(ev) {
375-
console.error('HTTP Switchboard> updateFromRemote() / onRemoteFileError("%s"):', remoteURL, this.statusText);
376-
chrome.runtime.sendMessage({
377-
'what': msg,
378-
'path': path,
379-
'error': 'Error'
380-
});
381391
this.onload = this.onerror = null;
392+
console.error('HTTPSB> updateFromRemote() / onRemoteFileError("%s"):', remoteURL, this.statusText);
393+
sendErrorMessage();
382394
};
383395

384396
getTextFileFromURL(
385397
remoteURL,
386398
onRemoteFileLoaded,
387399
onRemoteFileError
388-
);
400+
);
389401
};
390402

391403
/******************************************************************************/

0 commit comments

Comments
 (0)