Skip to content

Commit

Permalink
rem - sec - Removed addon metadata
Browse files Browse the repository at this point in the history
---

For security reasons, we've removed the addon metadata JSON file. This is
so that the addon system would be improved security-wise. The
AddonMetadata.json file didn't hold anything other than DllPath, which
could be anything, when unauthorized forks would make their own "addons"
that would influence the kernel negatively.

---

Type: rem
Breaking: False
Doc Required: False
Backport Required: False
Part: 1/1
  • Loading branch information
AptiviCEO committed Jan 3, 2025
1 parent d57bf7e commit d0ab3f7
Showing 1 changed file with 4 additions and 19 deletions.
23 changes: 4 additions & 19 deletions public/Nitrocid/Kernel/Extensions/AddonTools.cs
Original file line number Diff line number Diff line change
Expand Up @@ -100,25 +100,10 @@ internal static void ProcessAddon(string addon, ModLoadPriority type, int curren
return;
}

// Now, verify that we have the addon metadata
string metadataPath = $"{addon}/AddonMetadata.json";
DebugWriter.WriteDebug(DebugLevel.I, "Verifying addon folder {0} for metadata...", addon);
if (!(Checking.FileExists(metadataPath) && Parsing.IsJson(metadataPath)))
{
DebugWriter.WriteDebug(DebugLevel.W, "Skipping addon entry {0} because of invalid metadata [{1}]...", addon, metadataPath);
return;
}

// Read the metadata
DebugWriter.WriteDebug(DebugLevel.I, "Metadata {0} found!", metadataPath);
string metadataContents = Reading.ReadContentsText(metadataPath);
JToken metadataToken = JToken.Parse(metadataContents) ??
throw new KernelException(KernelExceptionType.AddonManagement, Translate.DoTranslation("Failed to get addon metadata"));

// Check the metadata value
string addonPath = $"{addon}/{(string?)(metadataToken["DllPath"] ?? Path.GetFileName($"{addon}.dll"))}";

// Now, check the addon path
// Now, guess and check the addon path
DebugWriter.WriteDebug(DebugLevel.I, "Guessing addon path {0}...", addon);
string addonPath = $"{addon}/Nitrocid.{Path.GetFileName($"{addon}.dll")}";
DebugWriter.WriteDebug(DebugLevel.I, "Addon entry {0} is using path [{1}].", addon, addonPath);
if (!Checking.FileExists(addonPath))
{
DebugWriter.WriteDebug(DebugLevel.W, "Skipping addon entry {0} because of nonexistent file [{1}]...", addon, addonPath);
Expand Down

0 comments on commit d0ab3f7

Please sign in to comment.