fix: scope cleartext-scheme enforcement so local-scene-development fetch is not broken

Scopes the cleartext-scheme policy so it no longer over-upgrades unsigned local-scene-development scene fetches (the Creator Hub preview / SDK network-testing flow).

- RequestEnvelope: EnforceSecureScheme now runs only on signed requests (identity auth never travels over cleartext); unsigned wire URLs pass through — their scheme is decided at the infra resolution site or the fetch module's dev-mode gate.
- WebRequestController: redirect guard changed to IsCleartextDowngrade(sentUrl, finalUrl) so a deliberately-sent cleartext request (dev fetch) is not misread as a mid-flight downgrade.
- WebRequestUtils: adds IsCleartextDowngrade.

v16 EditMode RED/GREEN (DCL.WebRequests.Tests.InsecureSchemePolicyShould): over-scoped global hook = 34 total / 3 failed (the non-loopback-http + texture passthrough guards); scoped fix = 34/34 passed. Loopback preview still works, production scene fetch still blocked by the module dev-mode gate, signed/infra requests still upgraded.

Author: eordano

Explorer/Assets/DCL/SDKComponents/MediaStream/UrlResolverService.cs

@@ -101,8 +101,8 @@ private async UniTask<ResolvedMediaUrl> ResolveDirectUrlAsync(string url, Report
 
         private static async UniTask<bool> IsGetReachableAsync(string url, CancellationToken ct)
         {
-            // This request bypasses IWebRequestController, so the pre-send transport-security
-            // policy the controller applies must hold here too: no cleartext to non-loopback hosts
+            // This request bypasses IWebRequestController, so the media transport-security policy
+            // (no cleartext to non-loopback hosts) binds directly at this send site
             UnityWebRequest request = UnityWebRequest.Get(WebRequestUtils.EnforceSecureScheme(url));
 
             try

Explorer/Assets/DCL/WebRequests/RequestEnvelope.cs

@@ -98,16 +98,20 @@ public TWebRequest InitializedWebRequest(IWeb3IdentityCache web3IdentityCache)
             TWebRequest request = initializeRequest(CommonArguments.URL, ref args);
             UnityWebRequest unityWebRequest = request.UnityWebRequest;
 
-            // The scheme policy governs the wire URL of the request about to be sent; running it
-            // after per-request composition keeps origin URLs embedded in it as data (e.g. the
-            // media-converter's url query parameter) byte-identical
-            string wireUrl = unityWebRequest.url;
-            string secureUrl = WebRequestUtils.EnforceSecureScheme(wireUrl);
-
-            if (!ReferenceEquals(wireUrl, secureUrl))
+            if (signInfo.HasValue)
             {
-                ReportHub.LogWarning(ReportData, $"Cleartext http to a non-loopback host upgraded to https: {wireUrl}");
-                unityWebRequest.url = secureUrl;
+                // The identity auth chain attached below never travels over forbidden cleartext:
+                // a signed request's wire URL is secure-enforced before signing. Unsigned wire
+                // URLs are not policed here — their scheme policy binds at the resolution site
+                // (infra URLs) or in the issuing module (scene fetch)
+                string wireUrl = unityWebRequest.url;
+                string secureUrl = WebRequestUtils.EnforceSecureScheme(wireUrl);
+
+                if (!ReferenceEquals(wireUrl, secureUrl))
+                {
+                    ReportHub.LogWarning(ReportData, $"Cleartext http on a signed request upgraded to https: {wireUrl}");
+                    unityWebRequest.url = secureUrl;
+                }
             }
 
             AssignTimeout(unityWebRequest);

Explorer/Assets/DCL/WebRequests/Tests/InsecureSchemePolicyShould.cs

@@ -1,6 +1,7 @@
 using CommunicationData.URLHelpers;
 using DCL.Diagnostics;
 using DCL.Multiplayer.Connections.DecentralandUrls;
+using DCL.Web3.Chains;
 using DCL.Web3.Identities;
 using NSubstitute;
 using NUnit.Framework;
@@ -11,23 +12,44 @@
 
 namespace DCL.WebRequests.Tests
 {
-    // Transport-security policy invariants: cleartext http is loopback-only; http to any
-    // other host is upgraded to https on the wire URL of the built request (after per-request
-    // URL composition, so URLs embedded in it as data survive); the player-level
+    // Transport-security policy invariants: cleartext http is loopback-only where the policy
+    // binds — at infra URL-resolution sites (media resolution, sidecar realm root) and on the
+    // wire URL of signed requests (the identity auth chain never travels over forbidden
+    // cleartext). Unsigned wire URLs pass through the envelope unchanged: their scheme is a
+    // module-level decision (local-scene-development fetch permits cleartext to any host).
+    // The redirect guard blocks only mid-flight downgrades, and the player-level
     // insecureHttpOption stays AlwaysAllowed so the client-side policy is the single
     // enforcement point.
     public class InsecureSchemePolicyShould
     {
         private const string MEDIA_CONVERTER_TEMPLATE = "https://metamorph-api.decentraland.org/convert?url={0}";
 
+        [TestCase("http://192.168.1.50:8000/api")]
+        [TestCase("http://peer.decentraland.org/x")]
+        public void PassNonLoopbackHttpThroughUnchangedWhenUnsigned(string url)
+        {
+            // A local-scene-development scene fetch is an unsigned request whose cleartext
+            // scheme is the fetch module's own vetted decision; the envelope must not rewrite it
+            Assert.That(UrlAfterEnvelopeInitialization(url), Is.EqualTo(UnityCanonicalUrl(url)));
+        }
+
         [Test]
-        public void UpgradeNonLoopbackHttpToHttps()
+        public void UpgradeNonLoopbackHttpToHttpsWhenSigned()
         {
             Assert.That(
-                UrlAfterEnvelopeInitialization("http://peer.decentraland.org/x"),
+                UrlAfterEnvelopeInitialization("http://peer.decentraland.org/x", new WebRequestSignInfo(string.Empty)),
                 Is.EqualTo(UnityCanonicalUrl("https://peer.decentraland.org/x")));
         }
 
+        [TestCase("http://127.0.0.1:8000/content/contents/bafkreib")]
+        [TestCase("http://localhost:8001/x")]
+        public void PassLoopbackHttpThroughUnchangedWhenSigned(string url)
+        {
+            Assert.That(
+                UrlAfterEnvelopeInitialization(url, new WebRequestSignInfo(string.Empty)),
+                Is.EqualTo(UnityCanonicalUrl(url)));
+        }
+
         [TestCase("http://127.0.0.1:8000/content/contents/bafkreib")]
         [TestCase("http://127.0.0.5:8000/x")]
         [TestCase("http://localhost:8001/x")]
@@ -45,11 +67,13 @@ public void PassNonHttpSchemesThroughUnchanged(string url)
         }
 
         [Test]
-        public void UpgradeNonConvertedTextureUrlAtTheWire()
+        public void PassNonConvertedTextureUrlThroughUnchangedAtTheWire()
         {
+            const string HTTP_URL = "http://textures.example.com/a.png";
+
             Assert.That(
-                TextureUrlAfterEnvelopeInitialization("http://textures.example.com/a.png", ktxEnabled: false),
-                Is.EqualTo(UnityCanonicalUrl("https://textures.example.com/a.png")));
+                TextureUrlAfterEnvelopeInitialization(HTTP_URL, ktxEnabled: false),
+                Is.EqualTo(UnityCanonicalUrl(HTTP_URL)));
         }
 
         [Test]
@@ -93,11 +117,22 @@ public void PreserveHttpOriginEmbeddedInConverterUrl()
         [TestCase("http://[::1]:8000/x", false)]
         [TestCase("https://peer.decentraland.org/x", false)]
         [TestCase("file:///tmp/streaming-asset.bin", false)]
-        public void ClassifyForbiddenCleartextForTheRedirectGuard(string url, bool forbidden)
+        public void ClassifyForbiddenCleartext(string url, bool forbidden)
         {
             Assert.That(WebRequestUtils.IsForbiddenCleartext(url), Is.EqualTo(forbidden));
         }
 
+        [TestCase("https://peer.decentraland.org/x", "http://peer.decentraland.org/x", true)]
+        [TestCase("http://127.0.0.1:8000/x", "http://192.168.1.50:8000/x", true)]
+        [TestCase("http://192.168.1.50:8000/api", "http://192.168.1.50:8000/api", false)]
+        [TestCase("http://192.168.1.50:8000/x", "http://10.0.0.7:9000/y", false)]
+        [TestCase("https://peer.decentraland.org/x", "https://cdn.decentraland.org/x", false)]
+        [TestCase("https://peer.decentraland.org/x", "http://127.0.0.1:8000/x", false)]
+        public void ClassifyCleartextDowngradeForTheRedirectGuard(string sentUrl, string finalUrl, bool downgrade)
+        {
+            Assert.That(WebRequestUtils.IsCleartextDowngrade(sentUrl, finalUrl), Is.EqualTo(downgrade));
+        }
+
         [Test]
         public void KeepPlayerSettingAlwaysAllowed()
         {
@@ -111,7 +146,7 @@ public void KeepPlayerSettingAlwaysAllowed()
         ///     (WebRequestController.SendAsync -> InitializedWebRequest) and returns the URL the
         ///     UnityWebRequest would actually be sent with. The request is never sent.
         /// </summary>
-        private static string UrlAfterEnvelopeInitialization(string url)
+        private static string UrlAfterEnvelopeInitialization(string url, WebRequestSignInfo? signInfo = null)
         {
             using var envelope = new RequestEnvelope<GenericGetRequest, GenericGetArguments>(
                 GenericGetRequest.Initialize,
@@ -120,9 +155,9 @@ private static string UrlAfterEnvelopeInitialization(string url)
                 CancellationToken.None,
                 ReportData.UNSPECIFIED,
                 WebRequestHeadersInfo.NewEmpty(),
-                signInfo: null);
+                signInfo);
 
-            GenericGetRequest request = envelope.InitializedWebRequest(Substitute.For<IWeb3IdentityCache>());
+            GenericGetRequest request = envelope.InitializedWebRequest(SigningIdentityCache());
             using UnityWebRequest unityWebRequest = request.UnityWebRequest;
             return unityWebRequest.url;
         }
@@ -145,11 +180,25 @@ private static string TextureUrlAfterEnvelopeInitialization(string url, bool ktx
                 WebRequestHeadersInfo.NewEmpty(),
                 signInfo: null);
 
-            GetTextureWebRequest request = envelope.InitializedWebRequest(Substitute.For<IWeb3IdentityCache>());
+            GetTextureWebRequest request = envelope.InitializedWebRequest(SigningIdentityCache());
             using UnityWebRequest unityWebRequest = request.UnityWebRequest;
             return unityWebRequest.url;
         }
 
+        /// <summary>
+        ///     An identity cache whose identity signs any payload with an empty auth chain, so
+        ///     signed envelopes can be initialized without a real wallet.
+        /// </summary>
+        private static IWeb3IdentityCache SigningIdentityCache()
+        {
+            IWeb3Identity identity = Substitute.For<IWeb3Identity>();
+            identity.Sign(Arg.Any<string>()).Returns(_ => AuthChain.Create());
+
+            IWeb3IdentityCache cache = Substitute.For<IWeb3IdentityCache>();
+            cache.Identity.Returns(identity);
+            return cache;
+        }
+
         /// <summary>
         ///     UnityWebRequest applies its own URL canonicalization; comparing against the same
         ///     canonicalization keeps the assertions about the scheme policy only.

Explorer/Assets/DCL/WebRequests/WebRequestController.cs

@@ -72,6 +72,10 @@ public WebRequestController(
                 // No matter what we must release UnityWebRequest, otherwise it crashes in the destructor
                 using UnityWebRequest wr = request.UnityWebRequest;
 
+                // wr.url mutates to the final hop as redirects are followed; the as-sent form
+                // anchors the downgrade checks below
+                string sentUrl = wr.url;
+
                 try
                 {
                     analyticsContainer.OnBeforeBudgeting(in envelope, request);
@@ -89,10 +93,11 @@ public WebRequestController(
                         analyticsContainer.OnRequestFinished(request);
                     }
 
-                    // A redirect can hop from the sent https URL to cleartext http after the pre-send
-                    // scheme policy ran; a response with a forbidden-cleartext final URL is never consumed
-                    if (WebRequestUtils.IsForbiddenCleartext(wr.url))
-                        throw new InvalidOperationException($"Insecure redirect blocked: request to {envelope.CommonArguments.URL} was redirected to {wr.url}");
+                    // A redirect can hop from an allowed sent URL to forbidden cleartext; a response
+                    // from such a downgraded exchange is never consumed. An exchange sent as
+                    // cleartext on purpose (local-scene-development fetch) is not a downgrade
+                    if (WebRequestUtils.IsCleartextDowngrade(sentUrl, wr.url))
+                        throw new InvalidOperationException($"Insecure redirect blocked: request to {sentUrl} was redirected to {wr.url}");
 
                     if (!realmClock.HasSample)
                         realmClock.TryRecordHttpDate(wr.GetResponseHeader(DATE_HEADER));
@@ -110,9 +115,10 @@ public WebRequestController(
                 {
                     analyticsContainer.OnException(request, exception);
 
-                    // An exchange whose final URL downgraded to forbidden cleartext fails permanently:
-                    // never ignored, never retried (a retry would re-send headers over cleartext)
-                    if (WebRequestUtils.IsForbiddenCleartext(wr.url))
+                    // An exchange that downgraded from an allowed sent URL to forbidden cleartext
+                    // fails permanently: never ignored, never retried (a retry would re-send
+                    // headers over cleartext)
+                    if (WebRequestUtils.IsCleartextDowngrade(sentUrl, wr.url))
                         throw;
 
                     // No result can be concluded in this case

Explorer/Assets/DCL/WebRequests/WebRequestUtils.cs

@@ -176,8 +176,11 @@ public static string GetResponseContentEncoding(this UnityWebRequest unityWebReq
         ///     Client-side transport-security policy, standing in for the player-level insecure-http
         ///     block (which is global and cannot exempt loopback): cleartext http is permitted to
         ///     loopback hosts only (local preview servers, sidecars); http to any other host is
-        ///     upgraded to https. Applied to the wire URL of the built request, never to URLs
-        ///     embedded inside it as data. Non-http URLs pass through unchanged (same reference).
+        ///     upgraded to https. Applied where a policed URL is resolved (media resolution, sidecar
+        ///     realm root) and to the wire URL of signed requests — never to URLs embedded in a
+        ///     request as data, and never to unsigned wire URLs, whose cleartext scheme is a
+        ///     module-level decision (local-scene-development fetch). Non-http URLs pass through
+        ///     unchanged (same reference).
         /// </summary>
         public static string EnforceSecureScheme(string url) =>
             IsForbiddenCleartext(url)
@@ -195,6 +198,14 @@ public static bool IsForbiddenCleartext(string url) =>
             && url.StartsWith(HTTP_SCHEME_PREFIX, StringComparison.OrdinalIgnoreCase)
             && !(Uri.TryCreate(url, UriKind.Absolute, out Uri? uri) && IsLoopbackHost(uri.Host));
 
+        /// <summary>
+        ///     True when an exchange left on an allowed scheme/host but its final (post-redirect)
+        ///     URL is forbidden cleartext. A request sent to forbidden cleartext in the first place
+        ///     is not a downgrade: that scheme is the sender's own policy decision.
+        /// </summary>
+        public static bool IsCleartextDowngrade(string sentUrl, string finalUrl) =>
+            !IsForbiddenCleartext(sentUrl) && IsForbiddenCleartext(finalUrl);
+
         /// <summary>
         ///     Loopback means "localhost", 127.0.0.0/8 or [::1] — the hosts a local preview
         ///     server or sidecar can be reached on.