From c673996fe792f8ae85e00bb52fd8e1572bf73eb6 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Tue, 3 Nov 2026 04:37:12 +0000 Subject: [PATCH] fix(engine): install a directory plugin only with the permissions that were shown The confirmation showed the directory entry's access and commands, but the downloaded bundle's manifest was registered as is, so a directory could show a read-only plugin and install one that edits the document. A manifest asking for more than the entry showed is refused before it is saved. --- .../engine/src/extensions/plugin_directory.rs | 10 +++++++ crates/engine/src/plugin_directory_tests.rs | 26 +++++++++++++++++++ crates/engine/src/sharing/background/tests.rs | 11 ++++++-- 3 files changed, 45 insertions(+), 2 deletions(-) diff --git a/crates/engine/src/extensions/plugin_directory.rs b/crates/engine/src/extensions/plugin_directory.rs index 2f721feae..2c7e00e8f 100644 --- a/crates/engine/src/extensions/plugin_directory.rs +++ b/crates/engine/src/extensions/plugin_directory.rs @@ -127,6 +127,16 @@ fn install(s: &mut Session, p: &Value) -> Result { if manifest.id != entry.id || manifest.version != entry.version { return Err(fail("its manifest doesn't match the directory's entry")); } + // What was shown and approved is the entry's access and commands: a bundle whose manifest + // asks for more is refused, since the manifest is what the plugin then runs under. + if manifest.permissions.access == figcraft_plugin::manifest::Access::Write && !entry.access.trim().eq_ignore_ascii_case("write") { + return Err(fail("its manifest asks to write the document, but the directory showed it as read-only")); + } + if !entry.commands.is_empty() + && (manifest.permissions.commands.is_empty() || manifest.permissions.commands.iter().any(|c| !entry.commands.contains(c))) + { + return Err(fail("its manifest asks for commands the directory didn't show")); + } let source = address(&server); let path = save(s, &mut manifest, &bundle).map_err(|e| fail(&e))?; let out = json!({ diff --git a/crates/engine/src/plugin_directory_tests.rs b/crates/engine/src/plugin_directory_tests.rs index fa4d3d4cc..358845933 100644 --- a/crates/engine/src/plugin_directory_tests.rs +++ b/crates/engine/src/plugin_directory_tests.rs @@ -252,3 +252,29 @@ fn publishing_sends_a_checked_folder() { assert_eq!(r["id"], ID); let _ = std::fs::remove_dir_all(&dir); } + +#[test] +fn a_bundle_asking_for_more_than_the_directory_showed_is_not_installed() { + let (mut s, d) = session(); + // Shown as read-only with one command; the bundle's manifest asks to write, any command. + let text = + json!({"id": ID, "name": "Tiny", "version": "1.0.0", "author": "Ada", "main": "tiny.wasm", "permissions": {"access": "write"}}).to_string(); + let b = Bundle { manifest: text, wasm: wasm(), assets: vec![] }.encode(); + let mut e = entry(ID, "1.0.0", &b); + e.commands = vec!["node.get".into()]; + d.lock().unwrap().plugins.push((e, b)); + s.execute("plugin.directory.list", &json!({"server": "ws://127.0.0.1:9/"})).unwrap(); + let err = s.execute("plugin.directory.install", &json!({"id": ID, "confirm": true})).unwrap_err().to_string(); + assert!(err.contains("write"), "{err}"); + assert!(s.prefs.plugins.is_empty(), "nothing was installed"); + // Read-only as shown, but more commands than shown. + let text = json!({"id": ID, "name": "Tiny", "version": "1.0.1", "author": "Ada", "main": "tiny.wasm", "permissions": {"access": "read", "commands": ["node.get", "node.set"]}}).to_string(); + let b = Bundle { manifest: text, wasm: wasm(), assets: vec![] }.encode(); + let mut e = entry(ID, "1.0.1", &b); + e.commands = vec!["node.get".into()]; + d.lock().unwrap().plugins.clear(); + d.lock().unwrap().plugins.push((e, b)); + s.execute("plugin.directory.list", &json!({"server": "ws://127.0.0.1:9/"})).unwrap(); + let err = s.execute("plugin.directory.install", &json!({"id": ID, "confirm": true})).unwrap_err().to_string(); + assert!(err.contains("commands"), "{err}"); +} diff --git a/crates/engine/src/sharing/background/tests.rs b/crates/engine/src/sharing/background/tests.rs index fa4d00824..6f98841df 100644 --- a/crates/engine/src/sharing/background/tests.rs +++ b/crates/engine/src/sharing/background/tests.rs @@ -73,8 +73,15 @@ fn bundle() -> Vec { fn directory(req: PluginReq) -> PluginReply { let bytes = bundle(); - let entry = - PluginEntry { id: ID.into(), name: "Tiny tool".into(), version: "1.0.0".into(), sha256: sha256_hex(&bytes), ..PluginEntry::default() }; + let entry = PluginEntry { + id: ID.into(), + name: "Tiny tool".into(), + version: "1.0.0".into(), + access: "write".into(), + commands: vec!["shape.rectangle".into()], + sha256: sha256_hex(&bytes), + ..PluginEntry::default() + }; match req { PluginReq::List { .. } => PluginReply::List(vec![entry]), PluginReq::Fetch { .. } => PluginReply::Bundle { entry, bundle: bytes },