1414import java .util .zip .GZIPInputStream ;
1515
1616public class Urls {
17- public static boolean isFileDebugScheme () {
18- return !Mod .isRelease ();
17+ public static boolean isFileDebugSchemeAllowed () {
18+ return Mod .isFileDebugSchemeAllowed ();
19+ }
20+
21+ public static boolean isHTTPTrafficAllowed () {
22+ return Mod .isHTTPTrafficAllowed ();
1923 }
2024
2125 public static String parseContentAndVerify (String signatureUrl , String url , String publicKeyBase64 , long maxLimit ) throws IOException {
@@ -99,8 +103,13 @@ private static InputStream _getInputStreamOfUrl(String url, long sizeLimit) thro
99103 }
100104
101105 private static InputStream _getInputStreamOfUrl (String url , long sizeLimit , /*@Nullable*/ LongConsumer progress ) throws IOException {
106+ if (url .contains (" " )) {
107+ throw new IOException ("URL can't contains spaces!" );
108+ }
109+
110+
102111 if (url .startsWith ("file_debug_only://" )) {
103- if (!isFileDebugScheme ()) {
112+ if (!isFileDebugSchemeAllowed ()) {
104113 throw new RuntimeException ("Not allowed scheme." );
105114 }
106115
@@ -113,7 +122,26 @@ private static InputStream _getInputStreamOfUrl(String url, long sizeLimit, /*@N
113122
114123
115124 } else if (url .startsWith ("http://" )) {
116- throw new RuntimeException ("HTTP (not secure) not allowed scheme." );
125+ if (!isHTTPTrafficAllowed ()) {
126+ throw new RuntimeException ("HTTP (not secure) not allowed scheme." );
127+ }
128+
129+ if (!Mod .isUrlHostTrusted (url )) {
130+ if (Mod .isBlockAllNotTrustedNetworks ()) {
131+ throw new SecurityException ("Url host is not trusted!" );
132+ }
133+ }
134+
135+ URL urlObj = new URL (url );
136+ URLConnection connection = urlObj .openConnection ();
137+ long length = connection .getContentLengthLong ();
138+ if (length > sizeLimit ) {
139+ throw new RuntimeException ("[HTTP] File at " + url + " so bigger. " + length + " > " + sizeLimit );
140+ }
141+ if (progress != null ){
142+ progress .accept (length );
143+ }
144+ return connection .getInputStream ();
117145
118146
119147 } else if (url .startsWith ("https://" )) {
@@ -123,9 +151,6 @@ private static InputStream _getInputStreamOfUrl(String url, long sizeLimit, /*@N
123151 }
124152 }
125153
126- if (url .contains (" " )) {
127- Out .warn ("URL " + url + " contains not encoded spaced! Use %20 for space symbol in links!" );
128- }
129154 URL urlObj = new URL (url );
130155 URLConnection connection = urlObj .openConnection ();
131156 long length = connection .getContentLengthLong ();
0 commit comments