search

staniel359 / muffon

Advanced multi-source music streaming + discovery client for desktop. Free, clean, no login, no ads.
https://muffon.netlify.app
GNU Affero General Public License v3.0
1.18k stars 49 forks source link

Fix for harmful switches that can be enabled via command line #133

Closed xyloflake closed 5 months ago

xyloflake commented 6 months ago

The executables, when accessed via command line can be used to set harmful switches. This fix makes sure specified command line switches don't allow the app to open.

staniel359 commented 6 months ago

@xyloflake Please rebase this branch onto main.

xyloflake commented 6 months ago

@staniel359 it's not ready, plus I don't get what you mean.

xyloflake commented 6 months ago

@staniel359 gotchu

xyloflake commented 6 months ago

@gamersi not ready yet

xyloflake commented 6 months ago

Hey @gamersi @staniel359 ready for merging, just need a verification from @gamersi that it works.

How to check?

  1. @gamersi clone the repo (make sure you're cloning this branch) as instructed in the dev manual
  2. yarn package:all
  3. Install and try fix
xyloflake commented 6 months ago

Sorry guys, need some time to figure something out.

gamersi commented 6 months ago

Sorry guys, need some time to figure something out.

Should i still test it or wait

xyloflake commented 6 months ago

Please test it @gamersi

gamersi commented 6 months ago

Please test it @gamersi yeah its currently building

xyloflake commented 6 months ago

Sure!

xyloflake commented 6 months ago

Theoretically, there should be some error

gamersi commented 6 months ago

Sure!

It doesnt work. it breaks at electron builder

xyloflake commented 6 months ago

What does it show?

xyloflake commented 6 months ago

Mine doesn't create a problem at building

gamersi commented 6 months ago

Sure!

It doesnt work. it breaks at electron builder

oh, i just read through the log, its a permission error, let me restart as admin (im in windows currenlty)

gamersi commented 6 months ago

building works, let me test the harmful switches rq

xyloflake commented 6 months ago

Hmm it should give an electron error (theoretically)

gamersi commented 6 months ago

oh wait i forgot the env, stashed the test changes and didnt readd it

gamersi commented 6 months ago

no i have the .env and stillg et the invalid json error, weird

xyloflake commented 6 months ago

Can you provide a screenshot?

gamersi commented 6 months ago

screenshot

xyloflake commented 6 months ago

Did you add VITE_APP before ANONYMOUS_TOKEN?

gamersi commented 6 months ago

Did you add VITE_APP before ANONYMOUS_TOKEN?

yes

xyloflake commented 6 months ago

Also, this was caused by node_env, follow the SO link @staniel359 sent

gamersi commented 6 months ago

Also, this was caused by node_env, follow the SO link @staniel359 sent

but the node env thing was for development builds

xyloflake commented 6 months ago

Have you tried it tho?

gamersi commented 6 months ago

Have you tried it tho?

with it set i get a different error: sc

xyloflake commented 6 months ago

What is that lol

gamersi commented 6 months ago

What is that lol

it says that something in not a direcotry

xyloflake commented 6 months ago

Electron store problem, doesn't happen with me tho

gamersi commented 6 months ago

i am currently rebuilding it with the axios dev url updated

xyloflake commented 6 months ago

I have to go sleep tho, I'll see tomorrow.

gamersi commented 6 months ago

ill try the installer

gamersi commented 6 months ago

good night

xyloflake commented 6 months ago

Did it build?

gamersi commented 6 months ago

yes it did build this error only comes when i start it

gamersi commented 6 months ago

when the installer is finished it also gives the JSON error

xyloflake commented 6 months ago

Can you build the OG branch @gamersi ?

gamersi commented 6 months ago

Can you build the OG branch @gamersi ?

No, main does not work either

xyloflake commented 6 months ago

Can you build the OG branch @gamersi ?

No, main does not work either

Maybe a problem with the stuff @staniel359 pushed

xyloflake commented 6 months ago

@gamersi I built it with the updated stuff, it builds fine. Installs fine. Runs fine. Wth?

@staniel359 can you try building it?

staniel359 commented 6 months ago

@xyloflake Please rebase this branch onto main. (You merged it, I asked for rebase). Also please squash all your commits into a single one.

xyloflake commented 6 months ago

@staniel359 will not be squashing commits, as discussed on discord and telegram. Ready to merge after updating harmful switches list, confirmed by @gamersi that it works.

Need updating the harmful switches

xyloflake commented 6 months ago

@staniel359 @gamersi ready for review.

Added all harmful switches as of now.

xyloflake commented 6 months ago

@staniel359 @gamersi FINALLY successfully rebased to main (thank god). Please review.

staniel359 commented 6 months ago

@xyloflake Also please don't forget to run yarn lint.

xyloflake commented 5 months ago

@gamersi need you to test the build with HTTPToolkit and check if the fix works or not. Theoretically speaking, it should.

I dived into the source code and found out they're using the proxy-server flag, which we've listed.

I've added one more flag that they were using.

xyloflake commented 5 months ago

I'm very proud to announce that the fix applies to every other interceptor out there specifically targeting muffon. I've tested the packaged app with HTTPToolkit.

@gamersi @staniel359 Please review, I'll not be visiting github (probably) for a few months/days.

xyloflake commented 5 months ago

@gamersi @staniel359 please note that this is a temporary fix, I'll soon be implementing the patch directly into mutrino