search

dstark5 / Openlib

An Open source app to download and read books from shadow library (Anna’s Archive)
GNU General Public License v3.0
913 stars 45 forks source link

Downloaded files not verified? #62

Open Vyryn opened 5 months ago

Vyryn commented 5 months ago

I may be misreading the code, but it doesn't seem like the file contents downloaded from mirrors in lib/services/download_file.dart are verified with the annas-archive md5 hash anywhere. Since third party mirrors can host whatever they like, this is an important step to avoid handing users potential malware. Is it maybe done somewhere I'm not seeing?

dstark5 commented 5 months ago

I may be misreading the code, but it doesn't seem like the file contents downloaded from mirrors in lib/services/download_file.dart are verified with the annas-archive md5 hash anywhere. Since third party mirrors can host whatever they like, this is an important step to avoid handing users potential malware. Is it maybe done somewhere I'm not seeing?

I'm sorry I haven't implemented that check ,But will sure implement the md5 hash check ASAP. Thank you for mentioning this bro

inson1 commented 5 months ago

I think maybe it would be good to also show it in the ui?

dstark5 commented 5 months ago

Sure, gonna add the md5 verified tick after file download on the pop up

inson1 commented 5 months ago

it looks like its done in latest release

inson1 commented 5 months ago

btw if the checksum is wrong, the file is deleted?

dstark5 commented 5 months ago

If the checksum doesn't match a pop immediately shows with a warning

"The downloaded book may be malicious. Delete it and get the same book from another source, or use the book at your own risk."

inson1 commented 5 months ago

@dstark5 Shouldnt there be also option to delete the file from the dialog? so its easy to manage it?

dstark5 commented 5 months ago

Yes there should be but I haven't added the delete button on the alert pop up will sure add it in next update

inson1 commented 5 months ago

great work