Make the links in the block popups clickable

core/src/aliasing/managers/bun.rs

@@ -11,5 +11,4 @@ pub static BUN: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/cargo.rs

@@ -17,5 +17,4 @@ pub static CARGO: Manager = Manager {
             "source.firewall.registry=\"sparse+http://index.crates.io/\"",
         ],
     }],
-    lockfile: None,
 };

core/src/aliasing/managers/gem.rs

@@ -8,5 +8,4 @@ pub static GEM: Manager = Manager {
         when: &["install", "update", "fetch"],
         flags: &["--clear-sources", "--source", "http://rubygems.org/"],
     }],
-    lockfile: None,
 };

core/src/aliasing/managers/go.rs

@@ -11,5 +11,4 @@ pub static GO: Manager = Manager {
         ("GOFLAGS", "-mod=mod"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/mod.rs

@@ -36,14 +36,6 @@ pub struct Manager {
     pub command: &'static str,
     pub env: &'static [(&'static str, &'static str)],
     pub args: &'static [Args],
-    /// Where the manager records registry URLs, which then carry our http:// override.
-    pub lockfile: Option<Lockfile>,
-}
-
-/// What to do after a run about http:// registry URLs left in the lockfile at this path.
-pub enum Lockfile {
-    Restore(&'static str),
-    Warn(&'static str),
 }
 
 pub static MANAGERS: &[&Manager] =

core/src/aliasing/managers/npm.rs

@@ -1,4 +1,4 @@
-use super::{Lockfile, Manager, PROXY};
+use super::{Manager, PROXY};
 
 pub static NPM: Manager = Manager {
     command: "npm",
@@ -8,5 +8,4 @@ pub static NPM: Manager = Manager {
         ("npm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: Some(Lockfile::Restore("package-lock.json")),
 };

core/src/aliasing/managers/pdm.rs

@@ -13,5 +13,4 @@ pub static PDM: Manager = Manager {
         ("PDM_PYPI_VERIFY_SSL", "false"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/pip.rs

@@ -12,5 +12,5 @@ pub static PIP: Manager = recipe("pip");
 pub static PIP3: Manager = recipe("pip3");
 
 const fn recipe(name: &'static str) -> Manager {
-    Manager { command: name, env: PIP_ENV, args: &[], lockfile: None }
+    Manager { command: name, env: PIP_ENV, args: &[] }
 }

core/src/aliasing/managers/pipenv.rs

@@ -13,5 +13,4 @@ pub static PIPENV: Manager = Manager {
         ("PIP_TRUSTED_HOST", "pypi.org files.pythonhosted.org"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/pnpm.rs

@@ -9,5 +9,4 @@ pub static PNPM: Manager = Manager {
         ("pnpm_config_registry", "http://registry.npmjs.org/"),
     ],
     args: &[],
-    lockfile: None,
 };

core/src/aliasing/managers/uv.rs

@@ -1,8 +1,7 @@
-use super::{Lockfile, Manager, PROXY, PYPI_SIMPLE};
+use super::{Manager, PROXY, PYPI_SIMPLE};
 
 pub static UV: Manager = Manager {
     command: "uv",
     env: &[("HTTP_PROXY", PROXY), ("http_proxy", PROXY), ("UV_DEFAULT_INDEX", PYPI_SIMPLE)],
     args: &[],
-    lockfile: Some(Lockfile::Warn("uv.lock")),
 };

core/src/aliasing/mod.rs

@@ -6,11 +6,9 @@ mod windows;
 pub use forward::spawn;
 pub use managers::*;
 
-use crate::policies::registries::BUILT_IN;
 use std::io::{Error, ErrorKind};
 use std::path::{Path, PathBuf};
 use std::process::Command;
-use tracing::{info, warn};
 
 pub struct Invocation {
     pub program: String,
@@ -52,42 +50,10 @@ pub fn run(port: u16, invocation: &Invocation, dir: Option<&Path>) -> std::io::R
     let status = command.status();
     #[cfg(windows)]
     let status = status.map_err(|error| windows::explain(error, &program));
-    let code = status?.code().unwrap_or(1);
-    let manager = MANAGERS.iter().find(|manager| manager.command == invocation.program);
-    match manager.and_then(|manager| manager.lockfile.as_ref()) {
-        Some(Lockfile::Restore(lockfile)) => restore_https(lockfile, dir),
-        Some(Lockfile::Warn(lockfile)) => warn_if_plaintext(lockfile, dir),
-        None => {}
-    }
-    Ok(code)
+    Ok(status?.code().unwrap_or(1))
 }
 
 // Command::new only finds .exe on Windows; npm, pnpm and gem are .cmd shims found via PATHEXT.
 fn resolve(program: &str) -> std::io::Result<PathBuf> {
     which::which(program).map_err(|e| Error::new(ErrorKind::NotFound, e))
 }
-
-fn warn_if_plaintext(lockfile: &str, dir: Option<&Path>) {
-    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
-    let Ok(text) = std::fs::read_to_string(path) else { return };
-    if BUILT_IN.iter().any(|registry| text.contains(&format!("http://{}/", registry.host()))) {
-        warn!("{lockfile} has http:// registry URLs; change them to https:// before committing");
-    }
-}
-
-fn restore_https(lockfile: &str, dir: Option<&Path>) {
-    let path = dir.unwrap_or(Path::new(".")).join(lockfile);
-    let Ok(text) = std::fs::read_to_string(&path) else { return };
-    let mut fixed = text.clone();
-    for registry in BUILT_IN {
-        let host = registry.host();
-        fixed = fixed.replace(&format!("http://{host}/"), &format!("https://{host}/"));
-    }
-    if fixed == text {
-        return;
-    }
-    match std::fs::write(&path, fixed) {
-        Ok(()) => info!("changed {lockfile}'s registry URLs back to https://"),
-        Err(e) => warn!("could not change {lockfile}'s registry URLs back to https://: {e}"),
-    }
-}

core/src/os/windows/pipe.rs

@@ -1,32 +1,24 @@
-//! How the tray asks the service what it blocked, and allows a new package once, as the macOS
-//! app messages its extension.
+//! How the tray asks the service what it blocked, as the macOS app messages its extension.
 
-use super::{config_file, security_descriptor};
-use crate::{blocks, Firewall};
+use super::security_descriptor;
+use crate::blocks;
 use rama::error::BoxError;
-use std::os::windows::io::AsRawHandle;
-use std::sync::Arc;
 use std::time::Duration;
 use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
 use tokio::net::windows::named_pipe::{NamedPipeServer, ServerOptions};
-use windows::core::{Owned, PWSTR};
-use windows::Win32::Foundation::HANDLE;
 use windows::Win32::Security::SECURITY_ATTRIBUTES;
-use windows::Win32::System::Pipes::GetNamedPipeClientProcessId;
-use windows::Win32::System::Threading::*;
 
 pub(super) const PIPE: &str = r"\\.\pipe\StrixFirewall";
 /// Signed-in users can connect, as the tray runs as them.
 const PIPE_ACL: &str = "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW;;;IU)";
 
-pub(super) async fn serve(firewall: Arc<Firewall>) -> Result<(), BoxError> {
+pub(super) async fn serve() -> Result<(), BoxError> {
     let mut server = create(true)?;
     loop {
         server.connect().await?;
         let client = std::mem::replace(&mut server, create(false)?);
-        let firewall = Arc::clone(&firewall);
         tokio::spawn(async move {
-            if let Err(error) = answer(client, &firewall).await {
+            if let Err(error) = answer(client).await {
                 tracing::debug!(%error, "could not answer the tray");
             }
         });
@@ -48,39 +40,19 @@ fn create(first: bool) -> Result<NamedPipeServer, BoxError> {
 }
 
 /// A line each way.
-async fn answer(client: NamedPipeServer, firewall: &Firewall) -> Result<(), BoxError> {
+async fn answer(client: NamedPipeServer) -> Result<(), BoxError> {
     let mut client = BufReader::new(client);
     let mut request = String::new();
     (&mut client)
         .take(64 * 1024)
         .read_line(&mut request)
         .await?;
-    let request = request.trim_end();
-    // Only the app can message the macOS extension; here any program could connect.
-    let reply = if !client_is_tray(client.get_ref())? {
-        "error: only the tray can ask".to_owned()
-    } else if request.starts_with("allow ") {
-        // Trusting writes the config for every user, so it is left to an administrator.
-        "error: trusting a package takes an administrator".to_owned()
-    } else {
-        blocks::answer(firewall, &config_file(), request)
+    let reply = match request.trim_end() {
+        "blocks" => serde_json::to_string(&blocks::take())?,
+        other => format!("error: unknown request {other}"),
     };
     client.write_all(format!("{reply}\n").as_bytes()).await?;
     // Closing before the tray hangs up could discard the reply.
     let _ = tokio::time::timeout(Duration::from_secs(5), client.read(&mut [0])).await;
     Ok(())
 }
-
-fn client_is_tray(client: &NamedPipeServer) -> Result<bool, BoxError> {
-    let mut id = 0;
-    unsafe { GetNamedPipeClientProcessId(HANDLE(client.as_raw_handle()), &mut id)? };
-    let process = unsafe { Owned::new(OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, false, id)?) };
-    let mut path = [0u16; 1024];
-    let mut len = path.len() as u32;
-    let flags = PROCESS_NAME_WIN32;
-    unsafe { QueryFullProcessImageNameW(*process, flags, PWSTR(path.as_mut_ptr()), &mut len)? };
-    let path = String::from_utf16(&path[..len as usize])?;
-    let tray = std::env::current_exe()?.with_file_name("firewall-tray.exe");
-    // Windows paths ignore case.
-    Ok(path.to_lowercase() == tray.to_string_lossy().to_lowercase())
-}

core/src/os/windows/service.rs

@@ -155,9 +155,8 @@ async fn start_screening(status: &ServiceStatusHandle) -> Result<Vec<&'static st
     let crl = HttpServer::auto(exec.clone()).service(crl);
     tokio::spawn(listen_on(CRL_ADDRESS, 80, &exec)?.serve(crl));
 
-    let tray_firewall = Arc::clone(&firewall);
-    tokio::spawn(async move {
-        if let Err(error) = pipe::serve(tray_firewall).await {
+    tokio::spawn(async {
+        if let Err(error) = pipe::serve().await {
             tracing::error!(%error, "the tray cannot reach the service");
         }
     });

core/src/os/windows/tray.rs

@@ -2,11 +2,10 @@
 
 use super::pipe::PIPE;
 use super::*;
-use muda::{IsMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
+use muda::{Menu, MenuEvent, MenuItem, PredefinedMenuItem, Submenu};
 use serde::Deserialize;
 use std::io::{BufRead, BufReader, Cursor, Write};
 use std::os::windows::io::AsRawHandle;
-use std::sync::mpsc::{channel, Receiver, Sender};
 use std::time::Duration;
 use tray_icon::{Icon, MouseButtonState, TrayIcon, TrayIconBuilder, TrayIconEvent};
 use windows::core::{w, PCWSTR};
@@ -23,8 +22,6 @@ const MENU_PAUSE: &str = "pause";
 const MENU_RESTART: &str = "restart";
 const MENU_LOG: &str = "log";
 const MENU_QUIT: &str = "quit";
-/// Also the service's request.
-const ALLOW_ONCE: &str = "allow-once";
 const LOGO: &[u8] = include_bytes!("tray.png");
 /// Where blocked packages are listed, below Open logs.
 const BLOCKED_AT: usize = 5;
@@ -65,11 +62,9 @@ pub fn run() -> Result<(), BoxError> {
         menu,
         blocked_separator,
         blocked: Vec::new(),
-        allowed: channel(),
     };
     tray.update();
-    // The service holds a new package's download only while it is asked this often.
-    unsafe { SetTimer(None, 0, 500, None) };
+    unsafe { SetTimer(None, 0, 2000, None) };
     let mut message = MSG::default();
     while unsafe { GetMessageW(&mut message, None, 0, 0) }.0 > 0 {
         unsafe { DispatchMessageW(&message) };
@@ -117,13 +112,10 @@ struct Tray {
     blocked_separator: PredefinedMenuItem,
     /// The most recent, as the menu lists them.
     blocked: Vec<BlockedPackage>,
-    /// Allowed from another thread, so no longer listed.
-    allowed: (Sender<BlockedPackage>, Receiver<BlockedPackage>),
 }
 
 #[derive(Clone, PartialEq, Deserialize)]
 struct BlockedPackage {
-    id: u64,
     eco: String,
     name: String,
     version: Option<String>,
@@ -144,11 +136,6 @@ impl BlockedPackage {
     fn malicious(&self) -> bool {
         self.filter != "age"
     }
-
-    /// Malware is never allowed, and a new package only by version.
-    fn trustable(&self) -> bool {
-        !self.malicious() && self.version.is_some()
-    }
 }
 
 impl Tray {
@@ -174,11 +161,6 @@ impl Tray {
 
     /// The service hands each block over once, so whichever tray asks first shows it.
     fn collect_blocks(&mut self) {
-        let allowed: Vec<_> = self.allowed.1.try_iter().collect();
-        if !allowed.is_empty() {
-            self.blocked.retain(|blocked| !allowed.contains(blocked));
-            self.list_blocked();
-        }
         if self.state != Some(ServiceState::Running) {
             return;
         }
@@ -202,14 +184,7 @@ impl Tray {
         self.blocked.drain(..excess);
         self.list_blocked();
         // Off the UI thread, so the menu keeps working while they are open.
-        let allowed = self.allowed.0.clone();
-        std::thread::spawn(move || {
-            for package in new {
-                if alert(&package) {
-                    allow_once(package, &allowed);
-                }
-            }
-        });
+        std::thread::spawn(move || new.iter().for_each(alert));
     }
 
     fn list_blocked(&self) {
@@ -229,28 +204,14 @@ impl Tray {
                 package.reason.clone()
             };
             let reason = MenuItem::new(reason, false, None);
-            let once = MenuItem::with_id(format!("{ALLOW_ONCE}:{i}"), "Allow Once", true, None);
-            let items: &[&dyn IsMenuItem] = if package.trustable() {
-                &[&reason, &once]
-            } else {
-                &[&reason]
-            };
             let label = format!("{verb} {}", package.label());
-            if let Ok(item) = Submenu::with_items(label, true, items) {
+            if let Ok(item) = Submenu::with_items(label, true, &[&reason]) {
                 let _ = self.menu.insert(&item, BLOCKED_AT + 1 + i);
             }
         }
     }
 
     fn on_menu(&self, id: &str) {
-        if let Some(i) = id.strip_prefix(ALLOW_ONCE).and_then(|i| i.strip_prefix(':')) {
-            let package = i.parse().ok().and_then(|i: usize| self.blocked.get(i));
-            if let Some(package) = package.cloned() {
-                let allowed = self.allowed.0.clone();
-                std::thread::spawn(move || allow_once(package, &allowed));
-            }
-            return;
-        }
         let state = self.state;
         let screening = state == Some(ServiceState::Running);
         let action: fn() -> Result<(), BoxError> = match id {
@@ -276,8 +237,7 @@ impl Tray {
     }
 }
 
-/// Whether the user chose to allow it once.
-fn alert(package: &BlockedPackage) -> bool {
+fn alert(package: &BlockedPackage) {
     let text = format!("{} {}.", package.label(), package.reason);
     let (title, text, style) = if package.malicious() {
         let title = format!("Blocked malware: {}", package.label());
@@ -285,33 +245,11 @@ fn alert(package: &BlockedPackage) -> bool {
             + "\n\nIt was not installed. Don't install it from another source. If you didn't expect this "
             + "package, a dependency may be compromised; tell your security team.";
         (title, text, MB_ICONERROR)
-    } else if !package.trustable() {
-        ("Held back a new package".to_owned(), text, MB_ICONINFORMATION)
     } else {
-        let text = text + "\n\nAllow it once?";
-        ("Held back a new package".to_owned(), text, MB_YESNO | MB_ICONINFORMATION)
+        ("Held back a new package".to_owned(), text, MB_ICONINFORMATION)
     };
     let (title, text) = (HSTRING::from(title), HSTRING::from(text));
-    unsafe { MessageBoxW(None, &text, &title, style | MB_SETFOREGROUND) == IDYES }
-}
-
-/// Tells the user when the install had already stopped waiting.
-fn allow_once(package: BlockedPackage, allowed: &Sender<BlockedPackage>) {
-    let reply = match ask_service(&format!("{ALLOW_ONCE} {}", package.id)) {
-        Ok(reply) => reply,
-        Err(error) => return show_error(error),
-    };
-    match reply.as_str() {
-        "ok" => {}
-        "late" => {
-            let title = format!("Allowed {} for the next minute", package.label());
-            let text = "The install had already stopped waiting for it. Run it again to finish.";
-            let (title, text) = (HSTRING::from(title), HSTRING::from(text));
-            unsafe { MessageBoxW(None, &text, &title, MB_ICONINFORMATION | MB_SETFOREGROUND) };
-        }
-        other => return show_error(other.into()),
-    }
-    let _ = allowed.send(package);
+    unsafe { MessageBoxW(None, &text, &title, style | MB_SETFOREGROUND) };
 }
 
 /// One request per connection, as the service answers.

core/src/policies/filters/osv.rs

@@ -41,9 +41,7 @@ impl Filter for Osv {
             if hits.is_empty() {
                 Verdict::Allow
             } else {
-                let links: Vec<String> =
-                    hits.iter().map(|id| format!("{id} https://osv.dev/vulnerability/{id}")).collect();
-                Verdict::Deny(format!("is flagged malicious by OSV: {}", links.join(", ")))
+                Verdict::Deny(format!("is flagged malicious by OSV ({})", hits.join(", ")))
             }
         })
     }