mirrors/fdroidserver
1
0
Fork 0
mirror of https://github.com/f-droid/fdroidserver.git synced 2025-11-05 15:00:30 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

convert apkcache from pickle to JSON

Browse source 
pickle can serialize executable code, while JSON is only ever pure data.
The APK cache is only ever pure data, so no need for the security risks of
pickle.  For example, if some malicious thing gets write access on the
`fdroid update` machine, it can write out a custom tmp/apkcache which would
then be executed.  That is not possible with JSON.

This does just ignore any existing cache and rebuilds from scratch. That is
so we don't need to maintain pickle anywhere, and to ensure there are no
glitches from a conversion from pickle to JSON.

closes #163
This commit is contained in:
Hans-Christoph Steiner 2018-09-03 18:07:40 +02:00
parent 74776e026f
commit 3011953d0e
6 changed files with 97 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

14
fdroidserver/index.py
View file

@ -533,7 +533,7 @@ def make_v0(apps, apks, repodir, repodict, requestsdict, fdroid_signing_key_fing
old_permissions = set()
sorted_permissions = sorted(apk['uses-permission'])
for perm in sorted_permissions:
perm_name = perm.name
perm_name = perm[0]
if perm_name.startswith("android.permission."):
perm_name = perm_name[19:]
old_permissions.add(perm_name)
@ -541,15 +541,15 @@ def make_v0(apps, apks, repodir, repodict, requestsdict, fdroid_signing_key_fing
for permission in sorted_permissions:
permel = doc.createElement('uses-permission')
permel.setAttribute('name', permission.name)
if permission.maxSdkVersion is not None:
permel.setAttribute('maxSdkVersion', '%d' % permission.maxSdkVersion)
permel.setAttribute('name', permission[0])
if permission[1] is not None:
permel.setAttribute('maxSdkVersion', '%d' % permission[1])
apkel.appendChild(permel)
for permission_sdk_23 in sorted(apk['uses-permission-sdk-23']):
permel = doc.createElement('uses-permission-sdk-23')
permel.setAttribute('name', permission_sdk_23.name)
if permission_sdk_23.maxSdkVersion is not None:
permel.setAttribute('maxSdkVersion', '%d' % permission_sdk_23.maxSdkVersion)
permel.setAttribute('name', permission_sdk_23[0])
if permission_sdk_23[1] is not None:
permel.setAttribute('maxSdkVersion', '%d' % permission_sdk_23[1])
apkel.appendChild(permel)
if 'nativecode' in apk:
addElement('nativecode', ','.join(sorted(apk['nativecode'])), doc, apkel)