WinGui: Enhance the security of our update checker. It can no longer access URL's...

diff --git a/win/CS/HandBrakeWPF/Services/UpdateService.cs b/win/CS/HandBrakeWPF/Services/UpdateService.cs
index e5c97126f1bc57ff07fc2784046437172233b869..6a8885a071d3b6bc972ae67a37a42d5146da91b2 100644 (file)
--- a/win/CS/HandBrakeWPF/Services/UpdateService.cs
+++ b/win/CS/HandBrakeWPF/Services/UpdateService.cs
@@ -93,6 +93,7 @@ namespace HandBrakeWPF.Services
                 {\r
                     try\r
                     {\r
+                        // Figure out which appcast we want to read.\r
                         string url =\r
                             VersionHelper.Is64Bit() || Environment.Is64BitOperatingSystem\r
                                 ? Constants.Appcast64\r
@@ -108,20 +109,32 @@ namespace HandBrakeWPF.Services
 \r
                         var currentBuild = HandBrakeUtils.Build;\r
 \r
-                        // Initialize variables\r
-                        WebRequest request = WebRequest.Create(url);\r
+                        // Fetch the Appcast from our server.\r
+                        HttpWebRequest request = (HttpWebRequest) WebRequest.Create(url);\r
+                        request.AllowAutoRedirect = false; // We will never do this.\r
                         WebResponse response = request.GetResponse();\r
-                        var reader = new AppcastReader();\r
 \r
-                        // Get the data, convert it to a string, and parse it into the AppcastReader\r
+                        // Parse the data with the AppcastReader\r
+                        var reader = new AppcastReader();\r
                         reader.GetUpdateInfo(new StreamReader(response.GetResponseStream()).ReadToEnd());\r
 \r
                         // Further parse the information\r
                         string build = reader.Build;\r
-\r
                         int latest = int.Parse(build);\r
                         int current = currentBuild;\r
 \r
+                        // Security Check\r
+                        // Verify the download URL is for handbrake.fr and served over https.\r
+                        // This prevents a compromised appcast download tricking the GUI into downloading a file, or accessing another website or local network resource.\r
+                        Uri uriResult;\r
+                        bool result = Uri.TryCreate(reader.DownloadFile, UriKind.Absolute, out uriResult) && uriResult.Scheme == Uri.UriSchemeHttps;\r
+                        if (!result || (uriResult.Host != "handbrake.fr" && uriResult.Host != "download.handbrake.fr"))\r
+                        {\r
+                            callback(new UpdateCheckInformation { NewVersionAvailable = false, Error = new Exception("The HandBrake update service is currently unavailable.") });\r
+                            return;\r
+                        }\r
+\r
+                        // Validate the URL from the appcast is ours.\r
                         var info2 = new UpdateCheckInformation\r
                             {\r
                                 NewVersionAvailable = latest > current,\r