fix(protocol): take the checksum from the registry, not from the caller

fast-install accepted a checksum as a URI parameter, and the handler is
reachable from page JS through Spicetify.Daemon, so anything loaded in the
client could have its own bytes verified against its own hash. The
checksum is now resolved from the registry for that id and version, and an
artifact the registry does not carry installs with a warning that nothing
verified it.

Author: afonsojramos

rust/crates/spicetify/src/commands/pkg.rs

@@ -92,6 +92,19 @@ pub(crate) fn list(ctx: &AppContext) -> Result<()> {
     Ok(())
 }
 
+/// The checksum the registry recorded for `id@version`, if it carries that
+/// version at all.
+///
+/// Callers that did not resolve the module themselves (the `spicetify://`
+/// handler, and so anything in the client that reaches it) use this rather
+/// than a checksum handed to them, so the bytes are held to what was
+/// published rather than to whatever the caller claims they should hash to.
+pub(crate) fn registry_checksum(identifier: &str, version: &str) -> Option<String> {
+    let vault = fetch_vault(DEFAULT_VAULT).ok()?;
+    let entry = vault.modules.get(identifier)?.v.get(version)?;
+    (!entry.checksum.is_empty()).then(|| entry.checksum.clone())
+}
+
 pub(crate) fn install(ctx: &AppContext, identifier: &str) -> Result<()> {
     let vault = fetch_vault(DEFAULT_VAULT)?;
     let Some(module) = vault.modules.get(identifier) else {

rust/crates/spicetify/src/commands/protocol.rs

@@ -84,7 +84,18 @@ fn perform(ctx: &AppContext, action: ProtocolAction, uri: &Url) -> Result<()> {
         ProtocolAction::Add | ProtocolAction::FastInstall | ProtocolAction::FastEnable => {
             let id = require_id(&query)?;
             let artifacts = get_all_params(&query, "artifacts");
-            let checksum = get_param(&query, "checksum").unwrap_or_default();
+            // The checksum comes from the registry, never from the caller.
+            // Anything that can reach this handler (page JS through
+            // Spicetify.Daemon, a spicetify:// link) could otherwise supply
+            // the hash of its own bytes and have them verified against
+            // themselves, which is no verification at all.
+            let checksum = crate::commands::pkg::registry_checksum(&id.module_identifier, &id.version)
+                .unwrap_or_default();
+            if checksum.is_empty() {
+                tracing::warn!(
+                    "{id}: not in the registry, so there is no checksum to verify these bytes against"
+                );
+            }
             module::add_store(&paths, &id, Store { installed: false, artifacts, checksum })?;
             if matches!(action, ProtocolAction::Add) {
                 return Ok(());
@@ -165,9 +176,6 @@ fn require_param(query: &[(Cow<'_, str>, Cow<'_, str>)], key: &str) -> Result<St
         .ok_or_else(|| anyhow::anyhow!("missing '{key}' query parameter"))
 }
 
-fn get_param(query: &[(Cow<'_, str>, Cow<'_, str>)], key: &str) -> Option<String> {
-    query.iter().find(|(k, _)| k == key).map(|(_, v)| v.to_string())
-}
 
 fn get_all_params(query: &[(Cow<'_, str>, Cow<'_, str>)], key: &str) -> Vec<String> {
     query.iter().filter(|(k, _)| k == key).map(|(_, v)| v.to_string()).collect()