Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

JBang does not trust http sources #1696

Closed
DyspC opened this issue Oct 16, 2023 · 5 comments
Closed

JBang does not trust http sources #1696

DyspC opened this issue Oct 16, 2023 · 5 comments
Labels
bug Something isn't working

Comments

@DyspC
Copy link

DyspC commented Oct 16, 2023

Describe the bug

Running jbang http://my.server/static/script.jsh always says the url is untrusted

Selecting 2 to add the domain to trusted sources adds 'http://my.server/static/' to the trusted array (or says it's already present)

To Reproduce
Steps to reproduce the behavior:

  1. Expose a script on an unsecure http remote
  2. Try to run it

Expected behavior
The user should not be asked again and again to add an already trusted source

JBang version

[jbang] [0:349] jbang version 0.110.1
Cache: /home/Clement.Descamps/.jbang/cache
Config: /home/Clement.Descamps/.jbang
Repository:/home/Clement.Descamps/.m2/repository
0.110.1

Additional context
I suppose this is because the trust evaluation prefixes it with "https://" and messes the URI parser

			URI parsedTrustedSource;
			if (trustedSource.startsWith("https://")) {
				parsedTrustedSource = new URI(trustedSource);
				if (!url.getScheme().equals(parsedTrustedSource.getScheme())) {
					continue;
				}
			} else {
				parsedTrustedSource = new URI("https://" + trustedSource);
			}

			if (url.getAuthority().equals(parsedTrustedSource.getAuthority())) {
				if (pathMatches(url.getPath(), parsedTrustedSource.getPath())) {
					return true;
				} else {
					continue;
				}
			}
jshell> new URI("https://http://my.server/static/generate-software-secret.jsh").getPath()
$4 ==> "//my.server/static/generate-software-secret.jsh"

jshell> new URI("http://my.server/static/generate-software-secret.jsh").getPath()
$5 ==> "/static/generate-software-secret.jsh"

jshell> new URI("http://my.server/static/generate-software-secret.jsh").getAuthority()
$6 ==> "my.server"

jshell> new URI("https://http://my.server/static/generate-software-secret.jsh").getAuthority()
$7 ==> "http:"
@DyspC DyspC added the bug Something isn't working label Oct 16, 2023
@ritikverma2000
Copy link
Contributor

Hi @DyspC I would like to work on this issue.

@DyspC
Copy link
Author

DyspC commented Oct 16, 2023

Hello, no problem!

@maxandersen
Copy link
Collaborator

yeah; seems like a simple fix of allowing http too...not sure why we even try add https:// if it does not start with https to start with.

@ritikverma2000 or @DyspC if either of you are up for it feel free to open a PR!

@ritikverma2000
Copy link
Contributor

ritikverma2000 commented Oct 21, 2023

Hi @DyspC can you pls check this pull request once. I have done the required code fix. Also one more request can you add hacktoberfest label in it as well.
#1698

@quintesse
Copy link
Contributor

Fixed by #1698

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants