Add canDownload API

TurboWarp/scratch-gui#969
TurboWarp · Dec 22, 2024 · 1a578aa · 1a578aa
1 parent 9e6993d
commit 1a578aa
Show file tree

Hide file tree

Showing 6 changed files with 48 additions and 0 deletions.
diff --git a/src/extension-support/extension-worker.js b/src/extension-support/extension-worker.js
@@ -86,6 +86,7 @@ Object.assign(global.Scratch, ScratchCommon, {
     canNotify: () => Promise.resolve(false),
     canGeolocate: () => Promise.resolve(false),
     canEmbed: () => Promise.resolve(false),
+    canDownload: () => Promise.resolve(false),
     translate
 });
 

diff --git a/src/extension-support/tw-security-manager.js b/src/extension-support/tw-security-manager.js
@@ -152,6 +152,15 @@ class SecurityManager {
     canEmbed (documentURL) {
         return Promise.resolve(true);
     }
+
+    /**
+     * Determine whether an extension is allowed to download a file with a given name.
+     * @param {string} filename The name of the file
+     * @returns {Promise<boolean>|boolean}
+     */
+    canDownload (filename) {
+        return Promise.resolve(true);
+    }
 }
 
 module.exports = SecurityManager;
diff --git a/src/extension-support/tw-unsandboxed-extension-runner.js b/src/extension-support/tw-unsandboxed-extension-runner.js
@@ -96,6 +96,8 @@ const setupUnsandboxedExtensionAPI = vm => new Promise(resolve => {
         return vm.securityManager.canEmbed(parsed.href);
     };
 
+    Scratch.canDownload = async name => vm.securityManager.canDownload(name);
+
     Scratch.fetch = async (url, options) => {
         const actualURL = url instanceof Request ? url.url : url;
 

diff --git a/test/integration/tw_security_manager.js b/test/integration/tw_security_manager.js
@@ -266,3 +266,23 @@ test('canEmbed', async t => {
 
     t.end();
 });
+
+test('canDownload', async t => {
+    const vm = new VirtualMachine();
+    setupUnsandboxedExtensionAPI(vm);
+
+    const calledWithNames = [];
+    vm.securityManager.canDownload = async name => {
+        calledWithNames.push(name);
+        return name.includes('safe');
+    };
+
+    t.equal(await global.Scratch.canDownload('safe.html'), true);
+    t.equal(await global.Scratch.canDownload('dangerous.html'), false);
+    t.same(calledWithNames, [
+        'safe.html',
+        'dangerous.html'
+    ]);
+
+    t.end();
+});
diff --git a/test/unit/tw_sandboxed_extensions.js b/test/unit/tw_sandboxed_extensions.js
@@ -141,3 +141,8 @@ test('canEmbed', async t => {
     t.equal(await global.Scratch.canEmbed('https://example.com/'), false);
     t.end();
 });
+
+test('canDownload', async t => {
+    t.equal(await global.Scratch.canDownload('test.sb3'), false);
+    t.end();
+});
diff --git a/test/unit/tw_unsandboxed_extensions.js b/test/unit/tw_unsandboxed_extensions.js
@@ -418,6 +418,17 @@ test('canEmbed', async t => {
     t.end();
 });
 
+test('canDownload', async t => {
+    const vm = new VirtualMachine();
+    UnsandboxedExtensionRunner.setupUnsandboxedExtensionAPI(vm);
+
+    vm.securityManager.canDownload = name => name === 'safe.txt';
+    t.ok(await global.Scratch.canDownload('safe.txt'));
+    t.notOk(await global.Scratch.canDownload('unsafe.txt'));
+
+    t.end();
+});
+
 test('CREATE_UNSANDBOXED_EXTENSION_API', t => {
     const vm = new VirtualMachine();
     vm.on('CREATE_UNSANDBOXED_EXTENSION_API', api => {