feat(core): validate SHA1 hashes of Yarn and Quilt cached metadata (#35)

zlataovce · Dec 18, 2023 · f5a5364 · f5a5364
1 parent dbcd133
commit f5a5364
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 16 deletions.
diff --git a/core/src/main/kotlin/me/kcra/takenaka/core/mapping/resolve/impl/QuiltMetadataProvider.kt b/core/src/main/kotlin/me/kcra/takenaka/core/mapping/resolve/impl/QuiltMetadataProvider.kt
@@ -21,8 +21,7 @@ import com.fasterxml.jackson.core.JacksonException
 import com.fasterxml.jackson.databind.JsonNode
 import com.fasterxml.jackson.databind.ObjectMapper
 import me.kcra.takenaka.core.Workspace
-import me.kcra.takenaka.core.util.copyTo
-import me.kcra.takenaka.core.util.readTree
+import me.kcra.takenaka.core.util.*
 import mu.KotlinLogging
 import java.net.URL
 
@@ -70,17 +69,25 @@ class QuiltMetadataProvider(val workspace: Workspace, private val xmlMapper: Obj
     private fun readMetadata(): JsonNode {
         val file = workspace[METADATA]
 
+        val metadataLocation = "https://maven.quiltmc.org/repository/release/org/quiltmc/quilt-mappings/maven-metadata.xml"
+
         if (relaxedCache && METADATA in workspace) {
-            try {
-                return xmlMapper.readTree(file).apply {
-                    logger.info { "read cached Quilt mappings metadata" }
+            URL("$metadataLocation.sha1").httpRequest {
+                if (it.readText() == file.getChecksum(sha1Digest)) {
+                    try {
+                        return xmlMapper.readTree(file).apply {
+                            logger.info { "read cached Quilt mappings metadata" }
+                        }
+                    } catch (e: JacksonException) {
+                        logger.warn(e) { "failed to read cached Quilt mappings metadata, fetching it again" }
+                    }
+                } else {
+                    logger.warn { "cached Quilt mappings metadata is outdated or corrupt, fetching it again" }
                 }
-            } catch (e: JacksonException) {
-                logger.warn(e) { "failed to read cached Quilt mappings metadata, fetching it again" }
             }
         }
 
-        URL("https://maven.quiltmc.org/repository/release/org/quiltmc/quilt-mappings/maven-metadata.xml").copyTo(file)
+        URL(metadataLocation).copyTo(file)
 
         logger.info { "fetched Quilt metadata" }
         return xmlMapper.readTree(file)

diff --git a/core/src/main/kotlin/me/kcra/takenaka/core/mapping/resolve/impl/YarnMetadataProvider.kt b/core/src/main/kotlin/me/kcra/takenaka/core/mapping/resolve/impl/YarnMetadataProvider.kt
@@ -21,8 +21,7 @@ import com.fasterxml.jackson.core.JacksonException
 import com.fasterxml.jackson.databind.JsonNode
 import com.fasterxml.jackson.databind.ObjectMapper
 import me.kcra.takenaka.core.Workspace
-import me.kcra.takenaka.core.util.copyTo
-import me.kcra.takenaka.core.util.readTree
+import me.kcra.takenaka.core.util.*
 import mu.KotlinLogging
 import java.net.URL
 
@@ -78,17 +77,25 @@ class YarnMetadataProvider(val workspace: Workspace, private val xmlMapper: Obje
     private fun readMetadata(): JsonNode {
         val file = workspace[METADATA]
 
+        val metadataLocation = "https://maven.fabricmc.net/net/fabricmc/yarn/maven-metadata.xml"
+
         if (relaxedCache && METADATA in workspace) {
-            try {
-                return xmlMapper.readTree(file).apply {
-                    logger.info { "read cached Yarn metadata" }
+            URL("$metadataLocation.sha1").httpRequest {
+                if (it.readText() == file.getChecksum(sha1Digest)) {
+                    try {
+                        return xmlMapper.readTree(file).apply {
+                            logger.info { "read cached Yarn mappings metadata" }
+                        }
+                    } catch (e: JacksonException) {
+                        logger.warn(e) { "failed to read cached Yarn mappings metadata, fetching it again" }
+                    }
+                } else {
+                    logger.warn { "cached Yarn mappings metadata is outdated or corrupt, fetching it again" }
                 }
-            } catch (e: JacksonException) {
-                logger.warn(e) { "failed to read cached Yarn metadata, fetching it again" }
             }
         }
 
-        URL("https://maven.fabricmc.net/net/fabricmc/yarn/maven-metadata.xml").copyTo(file)
+        URL(metadataLocation).copyTo(file)
 
         logger.info { "fetched Yarn metadata" }
         return xmlMapper.readTree(file)