Skip to content

Commit fbb9566

Browse files
committed
remove url/checksum arguments from /v2/pkgs/tools/installed endpoint
This is a security risk. They were overriding packager,toolname,version from package index.
1 parent 4c7a478 commit fbb9566

File tree

2 files changed

+7
-61
lines changed

2 files changed

+7
-61
lines changed

v2/pkgs/tools.go

+7-12
Original file line numberDiff line numberDiff line change
@@ -133,12 +133,6 @@ func (c *Tools) Installed(ctx context.Context) (tools.ToolCollection, error) {
133133
// Install crawles the Index folder, downloads the specified tool, extracts the archive in the Tools Folder.
134134
// It checks for the Signature specified in the package index.
135135
func (c *Tools) Install(ctx context.Context, payload *tools.ToolPayload) (*tools.Operation, error) {
136-
path := filepath.Join(payload.Packager, payload.Name, payload.Version)
137-
138-
if payload.URL != nil {
139-
return c.install(ctx, path, *payload.URL, *payload.Checksum)
140-
}
141-
142136
list, err := c.Indexes.List(ctx)
143137
if err != nil {
144138
return nil, err
@@ -159,9 +153,7 @@ func (c *Tools) Install(ctx context.Context, payload *tools.ToolPayload) (*tools
159153
if tool.Name == payload.Name &&
160154
tool.Version == payload.Version {
161155

162-
sys := tool.GetFlavourCompatibleWith(runtime.GOOS, runtime.GOARCH)
163-
164-
return c.install(ctx, path, sys.URL, sys.Checksum)
156+
return c.install(ctx, payload.Packager, tool)
165157
}
166158
}
167159
}
@@ -172,9 +164,12 @@ func (c *Tools) Install(ctx context.Context, payload *tools.ToolPayload) (*tools
172164
payload.Packager, payload.Name, payload.Version))
173165
}
174166

175-
func (c *Tools) install(ctx context.Context, path, url, checksum string) (*tools.Operation, error) {
167+
func (c *Tools) install(ctx context.Context, packager string, tool Tool) (*tools.Operation, error) {
168+
sys := tool.GetFlavourCompatibleWith(runtime.GOOS, runtime.GOARCH)
169+
path := filepath.Join(packager, tool.Name, tool.Version)
170+
176171
// Download
177-
res, err := http.Get(url)
172+
res, err := http.Get(sys.URL)
178173
if err != nil {
179174
return nil, err
180175
}
@@ -199,7 +194,7 @@ func (c *Tools) install(ctx context.Context, path, url, checksum string) (*tools
199194
sum := sha256.Sum256(buffer.Bytes())
200195
sumString := "SHA-256:" + hex.EncodeToString(sum[:sha256.Size])
201196

202-
if sumString != checksum {
197+
if sumString != sys.Checksum {
203198
os.RemoveAll(path)
204199
return nil, errors.New("checksum doesn't match")
205200
}

v2/pkgs/tools_test.go

-49
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import (
2020
"net/http"
2121
"net/http/httptest"
2222
"os"
23-
"runtime"
2423
"strings"
2524
"testing"
2625

@@ -130,52 +129,4 @@ func TestTools(t *testing.T) {
130129
if len(installed) != 0 {
131130
t.Fatalf("expected %d == %d (%s)", len(installed), 0, "len(installed)")
132131
}
133-
134-
// Install a tool by specifying url and checksum
135-
_, err = service.Install(ctx, &tools.ToolPayload{
136-
Packager: "arduino",
137-
Name: "avrdude",
138-
Version: "6.0.1-arduino2",
139-
URL: strpoint(url()),
140-
Checksum: strpoint(checksum()),
141-
})
142-
if err != nil {
143-
t.Fatal(err)
144-
}
145-
146-
installed, err = service.Installed(ctx)
147-
if err != nil {
148-
t.Fatal(err)
149-
}
150-
if len(installed) != 1 {
151-
t.Fatalf("expected %d == %d (%s)", len(installed), 1, "len(installed)")
152-
}
153-
}
154-
155-
func strpoint(s string) *string {
156-
return &s
157-
}
158-
159-
func url() string {
160-
urls := map[string]string{
161-
"linuxamd64": "https://downloads.arduino.cc/tools/avrdude-6.0.1-arduino2-x86_64-pc-linux-gnu.tar.bz2",
162-
"linux386": "https://downloads.arduino.cc/tools/avrdude-6.0.1-arduino2-i686-pc-linux-gnu.tar.bz2",
163-
"darwinamd64": "https://downloads.arduino.cc/tools/avrdude-6.0.1-arduino2-i386-apple-darwin11.tar.bz2",
164-
"windows386": "https://downloads.arduino.cc/tools/avrdude-6.0.1-arduino2-i686-mingw32.zip",
165-
"windowsamd64": "https://downloads.arduino.cc/tools/avrdude-6.0.1-arduino2-i686-mingw32.zip",
166-
}
167-
168-
return urls[runtime.GOOS+runtime.GOARCH]
169-
}
170-
171-
func checksum() string {
172-
checksums := map[string]string{
173-
"linuxamd64": "SHA-256:2489004d1d98177eaf69796760451f89224007c98b39ebb5577a9a34f51425f1",
174-
"linux386": "SHA-256:6f633dd6270ad0d9ef19507bcbf8697b414a15208e4c0f71deec25ef89cdef3f",
175-
"darwinamd64": "SHA-256:71117cce0096dad6c091e2c34eb0b9a3386d3aec7d863d2da733d9e5eac3a6b1",
176-
"windows386": "SHA-256:6c5483800ba753c80893607e30cade8ab77b182808fcc5ea15fa3019c63d76ae",
177-
"windowsamd64": "SHA-256:6c5483800ba753c80893607e30cade8ab77b182808fcc5ea15fa3019c63d76ae",
178-
}
179-
return checksums[runtime.GOOS+runtime.GOARCH]
180-
181132
}

0 commit comments

Comments
 (0)