mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-22 23:16:46 +00:00
mauriceboe
f7c54d3d90
Plugins placed on the /plugins volume are now discovered, validated and registered
as inactive, ready to activate.
- manifest.ts: strict trek-plugin.json validation (id/version/type, known
permissions only, egress required with http:outbound, native modules rejected).
- discovery.ts: scans the volume on startup + on demand (POST /api/admin/plugins/
rescan), upserts rows INACTIVE, refreshes settings-field descriptors, and never
downgrades or wipes an already-installed plugin's status / grants / config.
Invalid or native-carrying plugins are skipped and logged.
- Activation now grants the DECLARED permissions (the consent gate) and persists
them before spawning.
- install/ utilities for the registry installer (M5), each independently tested:
- safe-fetch: host allowlist (GitHub only) + private-IP refusal + manual
redirect following + size cap + sha256 (constant-time compare).
- safe-extract: zip/tar-slip-safe extraction with its own minimal tar.gz + zip
readers; rejects traversal, absolute paths, symlinks, oversized/too-many
entries, and unsupported formats.
- native-scan: refuses .node / binding.gyp / prebuilds, never follows symlinks.
38 lines
1.2 KiB
TypeScript
38 lines
1.2 KiB
TypeScript
import fs from 'node:fs';
|
|
import path from 'node:path';
|
|
|
|
/**
|
|
* Scan a plugin directory for native binaries / build artifacts (#plugins, M4).
|
|
* Native modules (.node) are forbidden in v1 — a native addon in a fork() child
|
|
* is arbitrary native code at the plugin uid, which would defeat any future
|
|
* sandbox. Returns the offending relative paths (empty = clean).
|
|
*/
|
|
const OFFENDERS = /\.node$|(^|[\\/])binding\.gyp$|(^|[\\/])prebuilds?[\\/]/i;
|
|
const MAX_ENTRIES = 20_000;
|
|
|
|
export function scanForNativeBinaries(dir: string): string[] {
|
|
const hits: string[] = [];
|
|
let seen = 0;
|
|
const walk = (d: string, rel: string) => {
|
|
let entries: fs.Dirent[];
|
|
try {
|
|
entries = fs.readdirSync(d, { withFileTypes: true });
|
|
} catch {
|
|
return;
|
|
}
|
|
for (const e of entries) {
|
|
if (++seen > MAX_ENTRIES) return;
|
|
const childRel = rel ? `${rel}/${e.name}` : e.name;
|
|
if (e.isSymbolicLink()) continue; // never follow symlinks
|
|
if (e.isDirectory()) {
|
|
if (OFFENDERS.test(childRel + '/')) hits.push(childRel);
|
|
else walk(path.join(d, e.name), childRel);
|
|
} else if (OFFENDERS.test(childRel)) {
|
|
hits.push(childRel);
|
|
}
|
|
}
|
|
};
|
|
walk(dir, '');
|
|
return hits;
|
|
}
|