github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-07 05:18:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

✨ Require re-confirmation when plugin manifest differs on open

Browse Source 
When the fetched manifest differs from the stored manifest (code, name, etc.), show the permissions dialog instead of silently updating — preventing execution of tampered/injected plugins.

On fetch error, show a warning notification instead of loading with the old manifest.

Bundled plugins (no URL) skip validation as they are trusted with no remote source.

Completes the 3-layer defense for T3-N1-02: (1) closed permission schema, (2) dedicated RPC methods, (3) integrity validation on open.

AI-assisted-by: qwen3.7-plus
This commit is contained in:
Andrey Antukh 2026-07-30 09:54:57 +00:00
parent f79c18fcb7
commit a575ba1199
1 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
frontend/src/app/main/data/plugins.cljs
View File

@ -114,7 +114,7 @@
[{:keys [url] :as manifest} user-can-edit?] [{:keys [url] :as manifest} user-can-edit?]
(if url (if url
;; If the saved manifest has a URL we fetch the manifest to check ;; If the saved manifest has a URL we fetch the manifest to check
;; for updates ;; for updates and validate integrity
(->> (fetch-manifest url) (->> (fetch-manifest url)
(rx/subs! (rx/subs!
(fn [new-manifest] (fn [new-manifest]
@ -126,6 +126,8 @@
(cond (cond
(and is-edition-plugin? (not user-can-edit?)) (and is-edition-plugin? (not user-can-edit?))
(st/emit! (ntf/warn (tr "workspace.plugins.error.need-editor"))) (st/emit! (ntf/warn (tr "workspace.plugins.error.need-editor")))
;; Permissions changed - show permissions dialog
(not= (:permissions new-manifest) (:permissions manifest)) (not= (:permissions new-manifest) (:permissions manifest))
(modal/show! (modal/show!
:plugin-permissions-update :plugin-permissions-update
@ -135,15 +137,25 @@
(preg/install-plugin! new-manifest) (preg/install-plugin! new-manifest)
(load-plugin! new-manifest))}) (load-plugin! new-manifest))})
;; Manifest changed (code, name, etc.) - require re-confirmation
;; This prevents execution of tampered/injected plugins
(not= new-manifest manifest) (not= new-manifest manifest)
(do (preg/install-plugin! new-manifest) (modal/show!
(load-plugin! manifest)) :plugin-permissions-update
{:plugin new-manifest
:on-accept
#(do
(preg/install-plugin! new-manifest)
(load-plugin! new-manifest))})
;; Manifests match exactly - safe to load
:else :else
(load-plugin! manifest)))) (load-plugin! manifest))))
(fn [] (fn [_err]
;; Error fetching the manifest we'll load the plugin with the ;; Error fetching the manifest - can't verify integrity
;; old manifest ;; Show error instead of loading potentially tampered code
(load-plugin! manifest)))) (st/emit! (ntf/warn (tr "workspace.plugins.error.unreachable"))))))
;; Bundled plugins (no URL) - trusted, load directly
(load-plugin! manifest))) (load-plugin! manifest)))
(defn close-plugin! (defn close-plugin!