From f68911e9c2f52a3839293c253f78eaf6ddba40f7 Mon Sep 17 00:00:00 2001
From: Cucumberrbob <128094686+Cucumberrbob@users.noreply.github.com>
Date: Tue, 11 Mar 2025 20:38:02 +0000
Subject: [PATCH] Add `UpdateChecker.IsInsecure` to check if running version is
 insecure

Uses a hard-coded list of GHSA ids of known fixed vulnerabilities
---
 client/src/app/models/profile.model.ts        |  1 +
 client/src/app/navbar/navbar.component.html   | 14 ++++--
 .../RdtClient.Data/Models/Internal/Profile.cs |  1 +
 .../BackgroundServices/UpdateChecker.cs       | 45 ++++++++++++++-----
 server/RdtClient.Service/Services/Torrents.cs |  1 +
 5 files changed, 47 insertions(+), 15 deletions(-)

diff --git a/client/src/app/models/profile.model.ts b/client/src/app/models/profile.model.ts
index edcc38c..041bc6d 100644
--- a/client/src/app/models/profile.model.ts
+++ b/client/src/app/models/profile.model.ts
@@ -4,5 +4,6 @@ export class Profile {
   public expiration: Date;
   public currentVersion: string;
   public latestVersion: string;
+  public isInsecure: boolean;
   public disableUpdateNotification: boolean;
 }
diff --git a/client/src/app/navbar/navbar.component.html b/client/src/app/navbar/navbar.component.html
index a0c730f..a8a3b9f 100644
--- a/client/src/app/navbar/navbar.component.html
+++ b/client/src/app/navbar/navbar.component.html
@@ -62,9 +62,15 @@
   </div>
 </nav>
 <div
-  class="notification is-warning"
-  *ngIf="profile && !profile.disableUpdateNotification && profile.latestVersion && profile.currentVersion !== profile.latestVersion"
+  class="notification"
+  [ngClass]="profile.isInsecure ? 'is-danger' : 'is-warning'"
+  *ngIf="profile && (!profile.disableUpdateNotification || profile.isInsecure) && profile.latestVersion && profile.currentVersion !== profile.latestVersion"
 >
-  Version {{ profile.latestVersion }} of RealDebrid Client was found. You are currently on version
-  {{ profile.currentVersion }}.
+  <span *ngIf="profile.isInsecure">
+    Your current version is insecure.
+  </span>
+  <span>
+    Version {{ profile.latestVersion }} of RealDebrid Client was found. You are currently on version
+    {{ profile.currentVersion }}.
+  </span>
 </div>
diff --git a/server/RdtClient.Data/Models/Internal/Profile.cs b/server/RdtClient.Data/Models/Internal/Profile.cs
index 9cad703..0f5ae9c 100644
--- a/server/RdtClient.Data/Models/Internal/Profile.cs
+++ b/server/RdtClient.Data/Models/Internal/Profile.cs
@@ -7,5 +7,6 @@ public class Profile
     public DateTimeOffset? Expiration { get; set; }
     public String? CurrentVersion { get; set; }
     public String? LatestVersion { get; set; }
+    public Boolean? IsInsecure { get; set; }
     public Boolean? DisableUpdateNotification { get; set; }
 }
\ No newline at end of file
diff --git a/server/RdtClient.Service/BackgroundServices/UpdateChecker.cs b/server/RdtClient.Service/BackgroundServices/UpdateChecker.cs
index 846c000..95de08b 100644
--- a/server/RdtClient.Service/BackgroundServices/UpdateChecker.cs
+++ b/server/RdtClient.Service/BackgroundServices/UpdateChecker.cs
@@ -9,6 +9,11 @@ public class UpdateChecker(ILogger<UpdateChecker> logger) : BackgroundService
 {
     public static String? CurrentVersion { get; private set; }
     public static String? LatestVersion { get; private set; }
+    
+    public static Boolean? IsInsecure { get; private set; }
+
+    private static readonly List<String> KnownGhsaIds = [
+    ];
 
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
@@ -34,18 +39,9 @@ public class UpdateChecker(ILogger<UpdateChecker> logger) : BackgroundService
         {
             try
             {
-                var httpClient = new HttpClient();
-                httpClient.DefaultRequestHeaders.UserAgent.Add(new("RdtClient", CurrentVersion));
-                var response = await httpClient.GetStringAsync($"https://api.github.com/repos/rogerfar/rdt-client/tags?per_page=1", stoppingToken);
+                var gitHubReleases = await GitHubRequest<List<GitHubReleasesResponse>>("/repos/rogerfar/rdt-client/tags?per_page=1", stoppingToken);
 
-                var gitHubReleases = JsonConvert.DeserializeObject<List<GitHubReleasesResponse>>(response);
-
-                if (gitHubReleases == null || gitHubReleases.Count == 0)
-                {
-                    return;
-                }
-
-                var latestRelease = gitHubReleases.FirstOrDefault(m => m.Name != null)?.Name;
+                var latestRelease = gitHubReleases?.FirstOrDefault(m => m.Name != null)?.Name;
 
                 if (latestRelease == null)
                 {
@@ -59,6 +55,18 @@ public class UpdateChecker(ILogger<UpdateChecker> logger) : BackgroundService
                 }
 
                 LatestVersion = latestRelease;
+
+                var gitHubSecurityAdvisories = await GitHubRequest<List<GitHubSecurityAdvisoriesResponse>>("/repos/rogerfar/rdt-client/security-advisories", stoppingToken);
+
+                var unseenGhsaIds = gitHubSecurityAdvisories?.Where(advisory => !KnownGhsaIds.Contains(advisory.GhsaId));
+                
+                if (unseenGhsaIds == null)
+                {
+                    logger.LogWarning($"Unable to find security advisories on GitHub");
+                    return;
+                }
+
+                IsInsecure = unseenGhsaIds.Any();
             }
             catch (Exception ex)
             {
@@ -70,10 +78,25 @@ public class UpdateChecker(ILogger<UpdateChecker> logger) : BackgroundService
 
         logger.LogInformation("UpdateChecker stopped.");
     }
+
+    private async Task<T?> GitHubRequest<T>(String endpoint, CancellationToken cancellationToken)
+    {
+            var httpClient = new HttpClient();
+            httpClient.DefaultRequestHeaders.UserAgent.Add(new("RdtClient", CurrentVersion));
+            var response = await httpClient.GetStringAsync($"https://api.github.com{endpoint}", cancellationToken);
+            
+            return JsonConvert.DeserializeObject<T>(response);
+    }
 }
 
 public class GitHubReleasesResponse 
 {
     [JsonProperty("name")]
     public String? Name { get; set; }
+}
+
+public class GitHubSecurityAdvisoriesResponse
+{
+    [JsonProperty("ghsa_id")]
+    public required String GhsaId { get; set; } 
 }
\ No newline at end of file
diff --git a/server/RdtClient.Service/Services/Torrents.cs b/server/RdtClient.Service/Services/Torrents.cs
index 5bec7d8..9004cb3 100644
--- a/server/RdtClient.Service/Services/Torrents.cs
+++ b/server/RdtClient.Service/Services/Torrents.cs
@@ -414,6 +414,7 @@ public class Torrents(
             Expiration = user.Expiration,
             CurrentVersion = UpdateChecker.CurrentVersion,
             LatestVersion = UpdateChecker.LatestVersion,
+            IsInsecure = UpdateChecker.IsInsecure,
             DisableUpdateNotification = Settings.Get.General.DisableUpdateNotifications
         };