logos-co/logos-cpp-sdk
1
0
Fork 0
mirror of https://github.com/logos-co/logos-cpp-sdk.git synced 2026-08-31 09:41:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

only allow core and capability module to call informTokenModule

Browse Source
This commit is contained in:
Iuri Matias
2026-06-08 10:16:05 -04:00
parent eb71a1aa90
commit 214a720207
6 changed files with 218 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cpp/module_proxy.cpp
+21 -12
View File
@@ -95,18 +95,6 @@ QVariant ModuleProxy::callRemoteMethod(const QString& authToken, const QString&
return m_provider->callMethod(methodName, args);
}
bool ModuleProxy::informModuleToken(const QString& authToken, const QString& moduleName, const QString& token)
{
Q_UNUSED(authToken)
if (!m_provider) {
qWarning() << "ModuleProxy: Cannot inform token on null provider";
return false;
}
return m_provider->informModuleToken(moduleName, token);
}
namespace {
// note: this is to ensure comparison is constant time to prevent timing attacks
// Length-independent constant-time comparison of two tokens. Returns true only
@@ -129,6 +117,27 @@ bool constantTimeEquals(const QString& a, const QString& b)
}
} // namespace
bool ModuleProxy::informModuleToken(const QString& authToken, const QString& moduleName, const QString& token)
{
if (!m_provider) {
qWarning() << "ModuleProxy: Cannot inform token on null provider";
return false;
}
const QString coreToken = TokenManager::instance().getToken(QStringLiteral("core"));
const QString capToken = TokenManager::instance().getToken(QStringLiteral("capability_module"));
const bool callerIsTrusted =
(!coreToken.isEmpty() && constantTimeEquals(authToken, coreToken)) ||
(!capToken.isEmpty() && constantTimeEquals(authToken, capToken));
if (authToken.isEmpty() || !callerIsTrusted) {
qWarning() << "ModuleProxy: rejecting informModuleToken for" << moduleName
<< "- caller is not the trusted core/capability_module channel";
return false;
}
return m_provider->informModuleToken(moduleName, token);
}
bool ModuleProxy::isAuthorized(const QString& authToken) const
{
// Fail closed: an empty token is never valid, even if some empty value