University-of-Basel-Studentprojects/Programmierprojekt
Archived
1
0
Fork 0
Code Issues 17 Pull Requests Actions Wiki Activity

Fix: Casono Browser URL allowlist

Browse Source
This commit is contained in:
Julian Kropff
2026-05-14 20:00:20 +02:00
parent 0b3c0a728c
commit b1da533f21
1 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/ch/unibas/dmi/dbis/cs108/casono/client/ui/gameui/gameuicomponents/CasinoBrowserController.java
+13 -10
View File
@@ -112,6 +112,7 @@ public class CasinoBrowserController {
TRUSTED_DOMAINS.add("mojeek.com"); TRUSTED_DOMAINS.add("mojeek.com");
TRUSTED_DOMAINS.add("searx.be"); TRUSTED_DOMAINS.add("searx.be");
TRUSTED_DOMAINS.add("startpage.com"); TRUSTED_DOMAINS.add("startpage.com");
TRUSTED_DOMAINS.add("vscode.dev");
} }
/** Aliases for common websites. */ /** Aliases for common websites. */
@@ -138,7 +139,10 @@ public class CasinoBrowserController {
Map.entry("gradle", "gradle.org"), Map.entry("gradle", "gradle.org"),
Map.entry("spring", "spring.io"), Map.entry("spring", "spring.io"),
Map.entry("jetbrains", "jetbrains.com"), Map.entry("jetbrains", "jetbrains.com"),
Map.entry("uni", "unibas.ch")); Map.entry("uni", "unibas.ch"),
Map.entry("vs", "vscode.dev"),
Map.entry("vscode", "vscode.dev"),
Map.entry("vs code", "vscode.dev"));
/** /**
* Resolves user input into a valid URL. * Resolves user input into a valid URL.
@@ -653,23 +657,22 @@ public class CasinoBrowserController {
} }
if ("file".equalsIgnoreCase(scheme)) { if ("file".equalsIgnoreCase(scheme)) {
Path allowed =
Paths.get( Path baseDir = Paths.get(System.getProperty("user.dir")).normalize();
System.getProperty("user.dir"),
"documents", Path manual = baseDir.resolve("documents/docs/game-engine/manual.html").normalize();
"docs",
"game-engine", Path outreach = baseDir.resolve("outreach/index.html").normalize();
"manual.html")
.normalize();
Path requested = Paths.get(uri).normalize(); Path requested = Paths.get(uri).normalize();
if (requested.equals(allowed)) { if (requested.equals(manual) || requested.equals(outreach)) {
securityLabel.setText("LOCAL OK"); securityLabel.setText("LOCAL OK");
engine.load(uri.toString()); engine.load(uri.toString());
} else { } else {
securityLabel.setText("BLOCKED"); securityLabel.setText("BLOCKED");
} }
return; return;
} }