fanhuadesenlinnn/tdesktop
1
0
Fork 0
mirror of https://hubproxy.babadafafafafa.cn/https://github.com/telegramdesktop/tdesktop synced 2026-09-20 08:03:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

Harden mini-apps shell access.

Browse Source
This commit is contained in:
John Preston
2026-08-13 16:33:52 +04:00
parent cae5c68cb3
commit d28708d371
7 changed files with 56 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
Telegram/SourceFiles/ui/chat/attach/attach_bot_webview.cpp
View File

@@ -285,6 +285,9 @@ void LogNativeMessageRejected(
LogNativeMessageRejected(reason, byteCount, command);
return std::optional<NativeMessage>();
};
if (!IsExternalShellOrigin(OriginFromUrl(sourceUrl))) {
return reject(u"bad external sender"_q);
}
if (object.value(u"type"_q).toString()
!= QString::fromLatin1(kExternalMessageType)) {
return reject(u"bad external type"_q);
@@ -310,6 +313,9 @@ void LogNativeMessageRejected(
|| !IsExternalShellOrigin(origin.toString())) {
return reject(u"bad shell origin"_q);
}
} else if (!origin.isString()
|| OriginFromUrl(origin.toString()).isEmpty()) {
return reject(u"bad webapp origin"_q);
}
if (!object.value(u"eventType"_q).isString() || command.isEmpty()) {
return reject(u"bad command"_q);
@@ -330,7 +336,7 @@ void LogNativeMessageRejected(
return NativeMessage{
.source = source,
.origin = (source == NativeMessageSource::ExternalWebApp)
? origin.toString()
? OriginFromUrl(origin.toString())
: QString(),
.command = command,
.arguments = arguments,