From a281b30ef07f83a1511e17234572013cfb25900a Mon Sep 17 00:00:00 2001 From: David Jardin Date: Wed, 15 May 2024 10:49:25 +0200 Subject: [PATCH 1/4] =?UTF-8?q?add=20a=20generic=20=E2=80=9Etuf=20error?= =?UTF-8?q?=E2=80=9C=20catch=20block=20for=20non-attack=20exceptions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- administrator/language/en-GB/lib_joomla.ini | 1 + libraries/src/TUF/TufFetcher.php | 3 +++ 2 files changed, 4 insertions(+) diff --git a/administrator/language/en-GB/lib_joomla.ini b/administrator/language/en-GB/lib_joomla.ini index be68c0764c93a..0d69cc7645b60 100644 --- a/administrator/language/en-GB/lib_joomla.ini +++ b/administrator/language/en-GB/lib_joomla.ini @@ -668,6 +668,7 @@ JLIB_INSTALLER_TUF_INVALID_METADATA="The saved TUF update information is invalid JLIB_INSTALLER_TUF_NOT_AVAILABLE="TUF is not available for extensions yet." JLIB_INSTALLER_TUF_ROLLBACK_ATTACK="Update not possible because the offered update is older than the currently installed version." JLIB_INSTALLER_TUF_SIGNATURE_THRESHOLD="Update not possible because the offered update does not have enough signatures." +JLIB_INSTALLER_TUF_ERROR_GENERIC="Could not fetch update information, enable system debug mode for further information" JLIB_INSTALLER_UNINSTALL="Uninstall" JLIB_INSTALLER_UPDATE="Update" JLIB_INSTALLER_UPDATE_LOG_QUERY="Ran query from file %1$s. Query text: %2$s." diff --git a/libraries/src/TUF/TufFetcher.php b/libraries/src/TUF/TufFetcher.php index a2c1840e389f8..d0f2e0ca0bd97 100644 --- a/libraries/src/TUF/TufFetcher.php +++ b/libraries/src/TUF/TufFetcher.php @@ -20,6 +20,7 @@ use Tuf\Exception\Attack\SignatureThresholdException; use Tuf\Exception\DownloadSizeException; use Tuf\Exception\MetadataException; +use Tuf\Exception\TufException; use Tuf\Loader\SizeCheckingLoader; // phpcs:disable PSR1.Files.SideEffects @@ -136,6 +137,8 @@ public function getValidUpdate() $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_ROLLBACK_ATTACK'), CMSApplicationInterface::MSG_ERROR); } catch (SignatureThresholdException $e) { $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_SIGNATURE_THRESHOLD'), CMSApplicationInterface::MSG_ERROR); + } catch (TufException $e) { + $this->app->enqueueMessage(Text::_('JLIB_INSTALLER_TUF_ERROR_GENERIC'), CMSApplicationInterface::MSG_ERROR); } $this->rollBackTufMetadata(); From 1fdac738e676443990ddec4c69e690268dd40907 Mon Sep 17 00:00:00 2001 From: David Jardin Date: Wed, 15 May 2024 11:48:27 +0200 Subject: [PATCH 2/4] Update administrator/language/en-GB/lib_joomla.ini Co-authored-by: Brian Teeman --- administrator/language/en-GB/lib_joomla.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/language/en-GB/lib_joomla.ini b/administrator/language/en-GB/lib_joomla.ini index 0d69cc7645b60..b92e6927a3ac3 100644 --- a/administrator/language/en-GB/lib_joomla.ini +++ b/administrator/language/en-GB/lib_joomla.ini @@ -668,7 +668,7 @@ JLIB_INSTALLER_TUF_INVALID_METADATA="The saved TUF update information is invalid JLIB_INSTALLER_TUF_NOT_AVAILABLE="TUF is not available for extensions yet." JLIB_INSTALLER_TUF_ROLLBACK_ATTACK="Update not possible because the offered update is older than the currently installed version." JLIB_INSTALLER_TUF_SIGNATURE_THRESHOLD="Update not possible because the offered update does not have enough signatures." -JLIB_INSTALLER_TUF_ERROR_GENERIC="Could not fetch update information, enable system debug mode for further information" +JLIB_INSTALLER_TUF_ERROR_GENERIC="Could not fetch update information, enable system debug mode for further information." JLIB_INSTALLER_UNINSTALL="Uninstall" JLIB_INSTALLER_UPDATE="Update" JLIB_INSTALLER_UPDATE_LOG_QUERY="Ran query from file %1$s. Query text: %2$s." From e9c46b52f02d6c8535c00841e461449e1a576bba Mon Sep 17 00:00:00 2001 From: David Jardin Date: Wed, 15 May 2024 14:06:07 +0200 Subject: [PATCH 3/4] adjust key ordering --- administrator/language/en-GB/lib_joomla.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/administrator/language/en-GB/lib_joomla.ini b/administrator/language/en-GB/lib_joomla.ini index 0d69cc7645b60..b9f1a30061034 100644 --- a/administrator/language/en-GB/lib_joomla.ini +++ b/administrator/language/en-GB/lib_joomla.ini @@ -663,12 +663,12 @@ JLIB_INSTALLER_SQL_END="End of SQL updates." JLIB_INSTALLER_SQL_END_NOT_COMPLETE="End of SQL updates - INCOMPLETE." JLIB_INSTALLER_TUF_DEBUG_MESSAGE="TUF Debug Message: %s" JLIB_INSTALLER_TUF_DOWNLOAD_SIZE="The size of the update downloaded did not match the expected size." +JLIB_INSTALLER_TUF_ERROR_GENERIC="Could not fetch update information, enable system debug mode for further information" JLIB_INSTALLER_TUF_FREEZE_ATTACK="Update not possible because the offered update has expired." JLIB_INSTALLER_TUF_INVALID_METADATA="The saved TUF update information is invalid." JLIB_INSTALLER_TUF_NOT_AVAILABLE="TUF is not available for extensions yet." JLIB_INSTALLER_TUF_ROLLBACK_ATTACK="Update not possible because the offered update is older than the currently installed version." JLIB_INSTALLER_TUF_SIGNATURE_THRESHOLD="Update not possible because the offered update does not have enough signatures." -JLIB_INSTALLER_TUF_ERROR_GENERIC="Could not fetch update information, enable system debug mode for further information" JLIB_INSTALLER_UNINSTALL="Uninstall" JLIB_INSTALLER_UPDATE="Update" JLIB_INSTALLER_UPDATE_LOG_QUERY="Ran query from file %1$s. Query text: %2$s." From fa179de5ad01814090ca75ef60fe4dfe22ad7252 Mon Sep 17 00:00:00 2001 From: David Jardin Date: Thu, 16 May 2024 07:13:51 +0200 Subject: [PATCH 4/4] also cover http loader exceptions --- libraries/src/TUF/HttpLoader.php | 9 +++++++-- libraries/src/TUF/HttpLoaderException.php | 19 +++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 libraries/src/TUF/HttpLoaderException.php diff --git a/libraries/src/TUF/HttpLoader.php b/libraries/src/TUF/HttpLoader.php index b299866b9bf2d..483b93bb9e313 100644 --- a/libraries/src/TUF/HttpLoader.php +++ b/libraries/src/TUF/HttpLoader.php @@ -29,8 +29,13 @@ public function __construct(private readonly string $repositoryPath, private rea public function load(string $locator, int $maxBytes): PromiseInterface { - /** @var Http $client */ - $response = $this->http->get($this->repositoryPath . $locator); + try { + /** @var Http $client */ + $response = $this->http->get($this->repositoryPath . $locator); + } catch (\Exception $e) { + // We convert the generic exception thrown in the Http library into a TufException + throw new HttpLoaderException($e->getMessage(), $e->getCode(), $e); + } if ($response->code !== 200) { throw new RepoFileNotFound(); diff --git a/libraries/src/TUF/HttpLoaderException.php b/libraries/src/TUF/HttpLoaderException.php new file mode 100644 index 0000000000000..cc3e8d9ff4b38 --- /dev/null +++ b/libraries/src/TUF/HttpLoaderException.php @@ -0,0 +1,19 @@ + + * @license GNU General Public License version 2 or later; see LICENSE.txt + */ + +namespace Joomla\CMS\TUF; + +use Tuf\Exception\TufException; + +/** + * @since __DEPLOY_VERSION__ + */ +class HttpLoaderException extends TufException +{ +}