From a2562d690b484db898021f1deabfca16efca4eed Mon Sep 17 00:00:00 2001 From: Ben Schwartz Date: Fri, 25 Mar 2022 13:44:36 -0400 Subject: [PATCH] Avoid passing objects across the boundary --- src/server_manager/electron_app/index.ts | 9 +++++---- src/server_manager/electron_app/preload.ts | 4 ++-- .../electron_app/start.action.sh | 3 ++- src/server_manager/tsconfig.json | 2 +- src/server_manager/types/preload.d.ts | 2 +- .../types/trust_certificate.d.ts | 19 ------------------- src/server_manager/web_app/browser_main.ts | 4 ++-- .../web_app/digitalocean_server.ts | 2 +- src/server_manager/web_app/gcp_server.ts | 2 +- src/server_manager/web_app/manual_server.ts | 2 +- 10 files changed, 16 insertions(+), 33 deletions(-) delete mode 100644 src/server_manager/types/trust_certificate.d.ts diff --git a/src/server_manager/electron_app/index.ts b/src/server_manager/electron_app/index.ts index 9782e667..aaf2838f 100644 --- a/src/server_manager/electron_app/index.ts +++ b/src/server_manager/electron_app/index.ts @@ -239,16 +239,17 @@ function main() { }); // Handle request to trust the certificate from the renderer process. - const trustedFingerprints = new Map(); - ipcMain.on('trust-certificate', (event: IpcEvent, anchor: HostAnchor) => { - trustedFingerprints.set(anchor.host, `sha256/${anchor.fingerprint}`); + const trustedFingerprints = new Set(); + const makeKey = (host: string, fingerprint: string) => `${host};${fingerprint}`; + ipcMain.on('trust-certificate', (event: IpcEvent, host: string, fingerprint: string) => { + trustedFingerprints.add(makeKey(host, `sha256/${fingerprint}`)); event.returnValue = true; }); app.on('certificate-error', (event, webContents, url, error, certificate, callback) => { event.preventDefault(); try { const parsed = new URL(url); - callback(trustedFingerprints.get(parsed.host) === certificate.fingerprint); + callback(trustedFingerprints.has(makeKey(parsed.host, certificate.fingerprint))); } catch (e) { console.error(e); callback(false); diff --git a/src/server_manager/electron_app/preload.ts b/src/server_manager/electron_app/preload.ts index 042a1390..f68f9950 100644 --- a/src/server_manager/electron_app/preload.ts +++ b/src/server_manager/electron_app/preload.ts @@ -47,8 +47,8 @@ if (sentryDsn) { }); } -contextBridge.exposeInMainWorld('trustCertificate', (anchor: HostAnchor) => { - return ipcRenderer.sendSync('trust-certificate', anchor); +contextBridge.exposeInMainWorld('trustCertificate', (host: string, fingerprint: string) => { + return ipcRenderer.sendSync('trust-certificate', host, fingerprint); }); contextBridge.exposeInMainWorld('openImage', (basename: string) => { diff --git a/src/server_manager/electron_app/start.action.sh b/src/server_manager/electron_app/start.action.sh index 77fe3ace..f915c294 100755 --- a/src/server_manager/electron_app/start.action.sh +++ b/src/server_manager/electron_app/start.action.sh @@ -14,7 +14,8 @@ # See the License for the specific language governing permissions and # limitations under the License. -run_action server_manager/electron_app/build linux +run_action server_manager/electron_app/build + cd "${BUILD_DIR}/server_manager/electron_app/static" OUTLINE_DEBUG='true' \ diff --git a/src/server_manager/tsconfig.json b/src/server_manager/tsconfig.json index 0cc57500..b7a46b21 100644 --- a/src/server_manager/tsconfig.json +++ b/src/server_manager/tsconfig.json @@ -7,7 +7,7 @@ "include": ["**/*.ts"], "exclude": [ "node_modules", - "web_app/galery_app", + "web_app/gallery_app", // FIXME: these tests fail with a runtime error because app.ts depends on // polymer, which targets the browser and uses ES6 imports. "web_app/app.spec.ts" diff --git a/src/server_manager/types/preload.d.ts b/src/server_manager/types/preload.d.ts index fb7896f6..c37d9754 100644 --- a/src/server_manager/types/preload.d.ts +++ b/src/server_manager/types/preload.d.ts @@ -14,7 +14,7 @@ // Functions made available to the renderer process via preload.ts. -declare function trustCertificate(anchor: HostAnchor): boolean; +declare function trustCertificate(host: string, fingerprint: string): boolean; declare function openImage(basename: string): void; declare function onUpdateDownloaded(callback: () => void): void; diff --git a/src/server_manager/types/trust_certificate.d.ts b/src/server_manager/types/trust_certificate.d.ts deleted file mode 100644 index c4d26672..00000000 --- a/src/server_manager/types/trust_certificate.d.ts +++ /dev/null @@ -1,19 +0,0 @@ -// Copyright 2022 The Outline Authors -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -/** Represents an additional trust anchor for a single host. */ -declare interface HostAnchor { - host: string; - fingerprint: string; -} diff --git a/src/server_manager/web_app/browser_main.ts b/src/server_manager/web_app/browser_main.ts index ac1bb3e0..233fcb2d 100644 --- a/src/server_manager/web_app/browser_main.ts +++ b/src/server_manager/web_app/browser_main.ts @@ -13,8 +13,8 @@ // limitations under the License. // eslint-disable-next-line @typescript-eslint/no-explicit-any -(window as any).trustCertificate = (anchor: HostAnchor) => { - console.log(`Requested to trust certificate: ${anchor}`); +(window as any).trustCertificate = (host: string, fingerprint: string) => { + console.log(`Requested to trust certificate for ${host}: ${fingerprint}`); }; // eslint-disable-next-line @typescript-eslint/no-explicit-any diff --git a/src/server_manager/web_app/digitalocean_server.ts b/src/server_manager/web_app/digitalocean_server.ts index 46c17784..9297c3c0 100644 --- a/src/server_manager/web_app/digitalocean_server.ts +++ b/src/server_manager/web_app/digitalocean_server.ts @@ -187,7 +187,7 @@ export class DigitalOceanServer extends ShadowboxServer implements server.Manage const apiAddress = this.getManagementApiAddress(); const parsed = new URL(apiAddress); // Loaded both the cert and url without exceptions, they can be set. - trustCertificate({host: parsed.host, fingerprint: certificateFingerprint}); + trustCertificate(parsed.host, certificateFingerprint); this.setManagementApiUrl(apiAddress); return true; } catch (e) { diff --git a/src/server_manager/web_app/gcp_server.ts b/src/server_manager/web_app/gcp_server.ts index aac1a844..84770dcc 100644 --- a/src/server_manager/web_app/gcp_server.ts +++ b/src/server_manager/web_app/gcp_server.ts @@ -180,7 +180,7 @@ export class GcpServer extends ShadowboxServer implements server.ManagedServer { const apiUrl = outlineGuestAttributes.get('apiUrl'); try { const parsed = new URL(apiUrl); - trustCertificate({host: parsed.host, fingerprint: certSha256}); + trustCertificate(parsed.host, certSha256); } catch (e) { console.error(e); this.setInstallState(InstallState.FAILED); diff --git a/src/server_manager/web_app/manual_server.ts b/src/server_manager/web_app/manual_server.ts index 9406c1e1..2d8bfa06 100644 --- a/src/server_manager/web_app/manual_server.ts +++ b/src/server_manager/web_app/manual_server.ts @@ -31,7 +31,7 @@ class ManualServer extends ShadowboxServer implements server.ManualServer { try { const parsed = new URL(manualServerConfig.apiUrl); const fingerprint = btoa(hexToString(manualServerConfig.certSha256)); - trustCertificate({host: parsed.host, fingerprint}); + trustCertificate(parsed.host, fingerprint); } catch (e) { // Error trusting certificate, may be due to bad user input. console.error('Error trusting certificate');