From 4fe069abac83373539f2598333754d19b9e6cfcc Mon Sep 17 00:00:00 2001 From: Emojigit <55009343+Emojigit@users.noreply.github.com> Date: Mon, 6 Dec 2021 19:58:50 +0800 Subject: [PATCH] fix http security leak --- src/api.lua | 5 +++-- src/caches.lua | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/api.lua b/src/api.lua index f899fa7..c5400c2 100644 --- a/src/api.lua +++ b/src/api.lua @@ -1,3 +1,4 @@ +local http = core.request_http_api() local make_fs = i3.files.gui() IMPORT("gmatch", "split") @@ -22,13 +23,13 @@ function i3.register_craft(def) local width, c = 0, 0 if true_str(def.url) then - if not i3.http then + if not http then return err(fmt([[i3.register_craft(): Unable to reach %s. No HTTP support for this mod: add it to the `secure.http_mods` or `secure.trusted_mods` setting.]], def.url)) end - i3.http.fetch({url = def.url}, function(result) + http.fetch({url = def.url}, function(result) if result.succeeded then local t = core.parse_json(result.data) if is_table(t) then diff --git a/src/caches.lua b/src/caches.lua index eec94bd..264424e 100644 --- a/src/caches.lua +++ b/src/caches.lua @@ -1,3 +1,4 @@ +local http = core.request_http_api() local replacements = {fuel = {}} IMPORT("maxn", "copy", "insert", "sort", "match", "sub") @@ -269,13 +270,13 @@ local function init_recipes() resolve_aliases(_select) sort(i3.init_items) - if i3.http and true_str(i3.export_url) then + if http and true_str(i3.export_url) then local post_data = { recipes = i3.recipes_cache, usages = i3.usages_cache, } - i3.http.fetch_async { + http.fetch_async { url = i3.export_url, post_data = core.write_json(post_data), }