Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow to install packed extensions from URL or local file #1456

Merged
merged 23 commits into from
Nov 25, 2020

Conversation

ixrock
Copy link
Member

@ixrock ixrock commented Nov 19, 2020

Done:

  • UI part of extensions-page (unpack, validate, load .tgz)
  • new react-component Clipboard for copying html-element full text-content or partial into clipboard
  • new react-component DropFileInput to handle drag-n-dropped files from external app, e.g. Finder / other file explorer (logic adopted originally from add-cluster-page)

Todo:

  • fix: downloading file by URL
  • unpack requested extensions to ~/.k8slens/extensions

requires #1461 #1482 (otherwise just restart the app after installation)
close #1227

Screenshots:

1

2

3

4

5

@ixrock ixrock added enhancement New feature or request area/extension Something to related to the extension api labels Nov 19, 2020
@ixrock ixrock added this to the 4.0.0 milestone Nov 19, 2020
@ixrock ixrock requested a review from a team November 19, 2020 22:54
@ixrock ixrock marked this pull request as draft November 19, 2020 22:55
@ixrock ixrock changed the title [Draft]: Install additional extensions from local-files or by URL [Draft]: Install custom extensions from local-files or by URL (.tgz) Nov 19, 2020
Signed-off-by: Roman <[email protected]>
@ixrock ixrock changed the title [Draft]: Install custom extensions from local-files or by URL (.tgz) Install extensions from NPM or from URL to tarball.tgz Nov 20, 2020
@ixrock ixrock changed the title Install extensions from NPM or from URL to tarball.tgz Allow to install extensions from .tgz (npm / url) Nov 22, 2020
@ixrock ixrock marked this pull request as ready for review November 23, 2020 21:57
package.json Outdated Show resolved Hide resolved
@ixrock
Copy link
Member Author

ixrock commented Nov 23, 2020

@jakolehm PTAL / test

@ixrock ixrock requested a review from a team November 23, 2020 22:13
package.json Outdated Show resolved Hide resolved
src/renderer/components/+extensions/extensions.tsx Outdated Show resolved Hide resolved
@ixrock ixrock changed the title Allow to install extensions from .tgz (npm / url) Allow to install packed extensions URL or local file Nov 24, 2020
@ixrock ixrock changed the title Allow to install packed extensions URL or local file Allow to install packed extensions from URL or local file Nov 24, 2020
Signed-off-by: Roman <[email protected]>
# Conflicts:
#	src/renderer/components/+extensions/extensions.tsx
#	src/renderer/utils/downloadFile.ts
Signed-off-by: Roman <[email protected]>
Signed-off-by: Roman <[email protected]>
src/common/utils/downloadFile.ts Show resolved Hide resolved
src/common/utils/index.ts Show resolved Hide resolved
src/common/utils/tar.ts Outdated Show resolved Hide resolved
}

getExtensionDestFolder(name: string) {
return path.join(this.extensionsPath, sanitizeExtensionName(name));
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This sanitation is not as complete as you think. So far I don't think we put any requirements on extension names and (at least on Windows) we do not sanitize out \ or even .s.

Plus I don't see why @ cannot be part of the dest folder path.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Anyway we have to sanitize it since name might contain / and currently loading extensions supported only from single level from ~./k8slens/extensions/<folder>

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True, but I am thinking more about security. If someone crafted the name to be @foo\..\..\/blarr on windows, this would be "sanitized" to foo\..\..\-blarr and if we were ever to say "overWrite: true" (which I think I saw in this PR somewhere) then we would be writing to some unknown place.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not valid name for NPM-package (@foo\..\..\/blarr) so no need to worry about it.
@jakolehm your word?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Nokel81 has a point here.. I think it's possible for an attacker to handcraft a package with invalid name. Of course if user installs a malicious package then it can do even worse things via runtime ... so maybe not super critical to fix here.

Let's create a separate issue about this.

src/renderer/components/+extensions/extensions.tsx Outdated Show resolved Hide resolved
theme="round-black"
iconLeft="link"
placeholder={`URL to packed extension (${this.supportedFormats.join(", ")})`}
validators={InputValidators.isUrl}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This validator is wrong, the string "123.com" is reported as invalid. Also it seems that even if the validator returns an error we can still click the "Add extensions" button

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dunno, this is out of scope of this PR. This validator also matching to empty string which is also invalid.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The validator being wrong is yes, but not being able to click "add extensions" if it returns an error

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So yeah, 123.com is invalid URL, try new URL("123.com") :D
Just prepend with http(s) and all good, lol.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW you might want to fix this meanwhile in separated PR! :)

@Nokel81
Copy link
Collaborator

Nokel81 commented Nov 24, 2020

Also, I tested this with https://registry.npmjs.org/@mirantis/lens-extension-cc/-/lens-extension-cc-1.0.2.tgz which is the value I got from running npm view @mirantis/lens-extension-cc dist.tarball. And this PR reported a failure because "invalid package, package.json not found".

However, if I download that package and unpack it. I get the following folder structure:
Screen Shot 2020-11-24 at 2 10 45 PM

I think that this PR should handle correctly how npm bundles its code into tarballs.

@ixrock
Copy link
Member Author

ixrock commented Nov 24, 2020

I think that this PR should handle correctly how npm bundles its code into tarballs.

Yes it should and I expected it to work, so you just found one more 🐞 Congrats! 🎉 (FIXED)

@ixrock
Copy link
Member Author

ixrock commented Nov 25, 2020

@jakolehm ready to merge? any issues so far? ofc after #1510

Copy link
Contributor

@jakolehm jakolehm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I spotted few usability issues but they should be fixed in separate PRs (I'll open issues about those).

@jakolehm jakolehm dismissed Nokel81’s stale review November 25, 2020 07:54

Change requests are done

@jakolehm jakolehm merged commit 77ae315 into master Nov 25, 2020
@jakolehm jakolehm deleted the extension_install_1277 branch November 25, 2020 07:55
@jakolehm jakolehm mentioned this pull request Nov 25, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/extension Something to related to the extension api enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Option to install an extension from filesystem/url
5 participants