Changeset 94807 in vbox

Timestamp:

May 4, 2022 8:13:06 AM (3 years ago)

Author:

vboxsync

Message:

Main/Update check: Added sanity checks for repository URLs. bugref:7983

Location:

trunk/src/VBox/Main

Files:

• include/UpdateAgentImpl.h (modified) (1 diff)
• src-server/UpdateAgentImpl.cpp (modified) (4 diffs)

trunk/src/VBox/Main/include/UpdateAgentImpl.h

@@ -75 +75 @@
      * @{ */
     static Utf8Str i_getPlatformInfo(void);
-    const char *i_proxyModeToStr(ProxyMode_T enmMode);
+    const char    *i_proxyModeToStr(ProxyMode_T enmMode);
+    bool           i_urlSchemeIsSupported(const Utf8Str &strUrl) const;
     /** @} */
 

trunk/src/VBox/Main/src-server/UpdateAgentImpl.cpp

@@ -287 +287 @@
 }
 
+/**
+ * Returns whether a given URL's scheme is supported or not.
+ *
+ * @returns \c true if scheme is supported, or \c false if not.
+ * @param   strUrl              URL to check scheme for.
+ *
+ * @note Empty URL are considered as being supported for convenience.
+ */
+bool UpdateAgentBase::i_urlSchemeIsSupported(const Utf8Str &strUrl) const
+{
+    if (strUrl.isEmpty())
+        return true;
+    return strUrl.startsWith("https://", com::Utf8Str::CaseInsensitive);
+}
+
 
 /*********************************************************************************************************************************
@@ -534 +549 @@
 HRESULT UpdateAgent::setRepositoryURL(const com::Utf8Str &aRepo)
 {
-    if (!aRepo.startsWith("https://", com::Utf8Str::CaseInsensitive))
-        return setError(E_INVALIDARG, tr("Invalid URL scheme specified; only https:// is supported."));
+    if (!i_urlSchemeIsSupported(aRepo))
+        return setError(E_INVALIDARG, tr("Invalid URL scheme specified!"));
 
     AutoWriteLock alock(this COMMA_LOCKVAL_SRC_POS);
@@ -664 +679 @@
  *
  * @returns HRESULT
+ * @retval  E_INVALIDARG if to-load settings are invalid / not supported.
  * @param   data                Where to load the settings from.
  */
@@ -679 +695 @@
         m->strRepoUrl    = data.strRepoUrl;
     m->enmProxyMode      = data.enmProxyMode;
-    m->strProxyUrl       = data.strProxyUrl;
+    if (data.strProxyUrl.isNotEmpty()) /* Explicitly set (and mark) an own proxy? */
+    {
+        m->strProxyUrl   = data.strProxyUrl;
+        mData.m_fUseOwnProxy = true;
+    }
     m->strLastCheckDate  = data.strLastCheckDate;
     m->uCheckCount       = data.uCheckCount;
+
+    /* Sanity checks. */
+    if (!i_urlSchemeIsSupported(data.strRepoUrl))
+        return setError(E_INVALIDARG, tr("Invalid URL scheme specified!"));
 
     return S_OK;