Examples with TrustedSources dev.jbang.net.TrustedSources used on opensource projects

Example 1 with TrustedSources

use of dev.jbang.net.TrustedSources in project jbang by jbangdev.

the class RemoteResourceResolver method fetchScriptFromUntrustedURL.

public static ResourceRef fetchScriptFromUntrustedURL(String scriptURL) {
    try {
        java.net.URI uri = new java.net.URI(scriptURL);
        if (!TrustedSources.instance().isURLTrusted(uri)) {
            String question = scriptURL + " is not from a trusted source thus not running it automatically.\n" + "\n" + "If you trust the url to be safe to run you can do one of the following";
            String trustUrl = goodTrustURL(scriptURL);
            String trustOrgUrl = orgURL(trustUrl);
            List<String> options = new ArrayList<>();
            options.add("Trust once: Add no trust, just run this time");
            options.add("Trust limited url in future: " + trustUrl);
            if (trustOrgUrl != null) {
                options.add("Trust organization url in future: " + trustOrgUrl);
            }
            int result = Util.askInput(question, 30, 0, options.toArray(new String[] {}));
            TrustedSources ts = TrustedSources.instance();
            if (result == 2) {
                ts.add(trustUrl, Settings.getTrustedSourcesFile().toFile());
            } else if (result == 3) {
                ts.add(trustOrgUrl, Settings.getTrustedSourcesFile().toFile());
            } else if (result <= 0) {
                String exmsg = scriptURL + " is not from a trusted source and user did not confirm trust thus aborting.\n" + "If you trust the url to be safe to run are here a few suggestions:\n" + "Limited trust:\n     jbang trust add " + trustUrl + "\n";
                if (trustOrgUrl != null) {
                    exmsg += "Organization trust:\n     jbang trust add " + trustOrgUrl + "\n";
                }
                exmsg += "Trust all subdomains:\n    jbang trust add *." + uri.getAuthority() + "\n" + "Trust all sources (WARNING! disables url protection):\n    jbang trust add *" + "\n" + "\nFor more control edit ~/.jbang/trusted-sources.json" + "\n";
                throw new ExitException(10, exmsg);
            }
        }
        scriptURL = swizzleURL(scriptURL);
        Path path = Util.swizzleContent(scriptURL, Util.downloadAndCacheFile(scriptURL));
        return ResourceRef.forCachedResource(scriptURL, path.toFile());
    } catch (IOException | URISyntaxException e) {
        throw new ExitException(BaseCommand.EXIT_INVALID_INPUT, "Could not download " + scriptURL, e);
    }
}