From 812e027e1d5a4f83394069edd67bdf8404ffa2bb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 30 Oct 2017 12:39:59 +0100
Subject: Add option allowed-uris

This allows network access in restricted eval mode.
---
 src/libexpr/eval.cc | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to 'src/libexpr/eval.cc')

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 548537b72ced..63de2d60a147 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -355,6 +355,26 @@ Path EvalState::checkSourcePath(const Path & path_)
 }
 
 
+void EvalState::checkURI(const std::string & uri)
+{
+    if (!restricted) return;
+
+    /* 'uri' should be equal to a prefix, or in a subdirectory of a
+       prefix. Thus, the prefix https://github.co does not permit
+       access to https://github.com. Note: this allows 'http://' and
+       'https://' as prefixes for any http/https URI. */
+    for (auto & prefix : settings.allowedUris.get())
+        if (uri == prefix ||
+            (uri.size() > prefix.size()
+            && prefix.size() > 0
+            && hasPrefix(uri, prefix)
+            && (prefix[prefix.size() - 1] == '/' || uri[prefix.size()] == '/')))
+            return;
+
+    throw RestrictedPathError("access to URI '%s' is forbidden in restricted mode", uri);
+}
+
+
 void EvalState::addConstant(const string & name, Value & v)
 {
     Value * v2 = allocValue();
-- 
cgit 1.4.1