Security fix

This commit is contained in:
ninjadev64 committed 2023-12-28 10:30:37 -06:00
1 parent 8d60a0a300
commit 848869f596
3 files changed
+9 -5

No files matched your search

+7 -3
View File
@@ -190,7 +190,7 @@ async fn initialise_plugin(path: path::PathBuf) -> anyhow::Result<()> {
/// Initialise plugins from the plugins directory.
pub fn initialise_plugins(app: AppHandle) {
tokio::spawn(init_websocket_server());
tokio::spawn(init_browser_server());
tokio::spawn(init_browser_server(app.path_resolver().app_config_dir().unwrap()));
let plugin_dir = app.path_resolver().app_config_dir().unwrap().join("plugins/");
let _ = fs::create_dir_all(&plugin_dir);
@@ -251,8 +251,12 @@ async fn accept_connection(stream: TcpStream) {
}
/// Start a simple webserver to serve files of plugins that run in a browser environment.
async fn init_browser_server() {
async fn init_browser_server(prefix: path::PathBuf) {
rouille::start_server("localhost:57118", move |request| {
rouille::Response::html(std::fs::read_to_string(request.url()).unwrap_or_default())
if path::Path::new(&request.url()).starts_with(&prefix) {
rouille::Response::html(fs::read_to_string(request.url()).unwrap_or_default())
} else {
rouille::Response::empty_400()
}
});
}
+1 -1
View File
@@ -10,7 +10,7 @@
$: state = instance?.states[instance?.current_state];
export let iframe: HTMLIFrameElement;
$: if (iframe) iframe.src = instance ? ("http://localhost:57118" + instance.action.property_inspector) : "";
$: if (iframe) iframe.src = instance?.action.property_inspector ? ("http://localhost:57118" + instance.action.property_inspector) : "";
function handleDragOver(event: DragEvent) {
event.preventDefault();
+1 -1
View File
@@ -10,7 +10,7 @@
$: state = instance?.states[instance?.current_state];
export let iframe: HTMLIFrameElement;
$: if (iframe) iframe.src = instance ? ("http://localhost:57118" + instance.action.property_inspector) : "";
$: if (iframe) iframe.src = instance?.action.property_inspector ? ("http://localhost:57118" + instance.action.property_inspector) : "";
function handleDragOver(event: DragEvent) {
event.preventDefault();