UpdateChecker.cpp

Go to the documentation of this file.

// Copyright 2015 - 2026, GIBIS-UNIFESP and the wiRedPanda contributors
// SPDX-License-Identifier: GPL-3.0-or-later
 
#include "App/Core/UpdateChecker.h"
 
#include <QDate>
#include <QDebug>
#include <QJsonDocument>
#include <QJsonObject>
#include <QNetworkReply>
#include <QNetworkRequest>
#include <QSslError>
#include <QSysInfo>
#include <QVersionNumber>
 
#include "App/Core/Settings.h"
#include "App/Versions.h"
 
static constexpr auto k_releaseDataUrl = "https://gibis-unifesp.github.io/wiRedPanda/latest-release.json";

static QString currentPlatform()
{
#if defined(Q_OS_WIN)
    return "Windows";
#elif defined(Q_OS_MACOS)
    return "macOS";
#elif defined(Q_OS_LINUX)
    return "Linux";
#else
    return {};
#endif
}
 
QString releaseAssetKey(const QString &platform, const QString &arch)
{
    if (platform == "Linux") {
        if (arch == "x86_64") {
            return QStringLiteral("linuxX64");
        }
        if (arch == "arm64") {
            return QStringLiteral("linuxArm64");
        }
        return {};
    }
    if (platform == "Windows") {
        if (arch == "x86_64") {
            return QStringLiteral("windowsX64");
        }
        if (arch == "arm64") {
            return QStringLiteral("windowsArm64");
        }
        return {};
    }
    if (platform == "macOS") {
        // A single universal DMG serves both architectures, so it carries no arch-specific key.
        return QStringLiteral("macosUniversal");
    }
    return {};
}
 
bool shouldOfferUpdate(const QString &tagName, const QVersionNumber &currentVersion, const QString &skippedVersion)
{
    const QVersionNumber latest = QVersionNumber::fromString(tagName).normalized();
    if (latest.isNull() || latest <= currentVersion) {
        return false;
    }
 
    // Respect the user's per-version suppression.
    return latest.toString() != skippedVersion;
}
 
bool isSafeGitHubUrl(const QUrl &url)
{
    return url.isValid() && url.scheme() == QLatin1String("https") && url.host() == QLatin1String("github.com");
}
 
UpdateChecker::UpdateChecker(QObject *parent)
    : QObject(parent)
    , m_apiUrl(k_releaseDataUrl)
{
    // QNetworkAccessManager::sslErrors doesn't exist at all when Qt is built with QT_NO_SSL --
    // the case for every Qt-for-WebAssembly build, since WASM has no native TLS backend and
    // routes network access through the browser instead (any TLS failure there surfaces as a
    // generic QNetworkReply error, not through this signal).
#ifndef QT_NO_SSL
    connect(&m_network, &QNetworkAccessManager::sslErrors, this, [](QNetworkReply *reply, const QList<QSslError> &errors) {
        qWarning() << "UpdateChecker: SSL errors, aborting reply:" << errors;
        reply->abort();
    });
#endif
}
 
void UpdateChecker::checkForUpdates()
{
    // Honour the global opt-out (offline/managed installs).
    if (Settings::updateChecksDisabled()) {
        return;
    }
 
    // Skip if we already checked today.
    const QString today = QDate::currentDate().toString(Qt::ISODate);
    if (Settings::updateCheckLastDate() == today) {
        return;
    }
 
    QNetworkRequest request = QNetworkRequest{m_apiUrl};
    request.setHeader(QNetworkRequest::UserAgentHeader, "wiRedPanda/" APP_VERSION);
    request.setAttribute(QNetworkRequest::RedirectPolicyAttribute,
                         QNetworkRequest::NoLessSafeRedirectPolicy);
    request.setTransferTimeout(10000);
 
    QNetworkReply *reply = m_network.get(request);
    // The release data response is realistically under 1KB; cap well above that
    // as defense-in-depth against a hostile/corrupted endpoint buffering unbounded
    // bytes into memory before onReplyFinished ever gets a chance to react.
    reply->setReadBufferSize(1024 * 1024 + 1);
    // Empirically confirmed (a local QTcpServer streaming well past 1 MiB while
    // nothing reads from `reply`): setReadBufferSize()'s own backpressure stops
    // Qt from admitting more bytes once the cap is reached, so `received` never
    // actually exceeds it here — this condition is a belt-and-suspenders check
    // for a network-backend timing edge case (a single oversized delivery
    // landing before backpressure engages) that a synchronous local-server test
    // cannot reproduce.
    connect(reply, &QNetworkReply::downloadProgress, this, [reply](qint64 received, qint64) {
        if (received > 1024 * 1024) { // LCOV_EXCL_LINE
            reply->abort(); // LCOV_EXCL_LINE
        } // LCOV_EXCL_LINE
    });
    connect(reply, &QNetworkReply::finished, this, [this, reply] { onReplyFinished(reply); });
}
 
void UpdateChecker::onReplyFinished(QNetworkReply *reply)
{
    reply->deleteLater();
 
    // Also covers QNetworkReply::OperationCanceledError produced by the
    // read-buffer size-cap abort in checkForUpdates().
    if (reply->error() != QNetworkReply::NoError) {
        return;
    }
 
    const QJsonDocument doc = QJsonDocument::fromJson(reply->readAll());
    if (doc.isNull() || !doc.isObject()) {
        return;
    }
 
    // A successful, parseable reply IS the daily check — record it here, not
    // when a dialog is shown: with no newer release (the common case) the
    // date was never written and the endpoint was hit on every launch. Network
    // failures above intentionally don't record, so the check retries.
    Settings::setUpdateCheckLastDate(QDate::currentDate().toString(Qt::ISODate));
 
    const QString version = doc.object().value("version").toString();
    if (!shouldOfferUpdate(version, AppVersion::current, Settings::updateCheckSkippedVersion())) {
        return;
    }
    const QVersionNumber latest = QVersionNumber::fromString(version).normalized();
 
    const QString platform = currentPlatform();
    const QString arch = QSysInfo::buildCpuArchitecture(); // "x86_64" / "arm64"
    const QString key = releaseAssetKey(platform, arch);
    QUrl downloadUrl = key.isEmpty() ? QUrl{} : QUrl(doc.object().value(key).toString());
 
    const QUrl releaseUrl = QUrl(QStringLiteral("https://github.com/GIBIS-UNIFESP/wiRedPanda/releases/tag/%1").arg(latest.toString()));
    if (!isSafeGitHubUrl(releaseUrl)) {
        // Unlike downloadUrl just below (built from an untrusted JSON field, and covered by
        // testOnReplyFinishedUnsafeDownloadUrlFallsBackToReleasePage()), releaseUrl is built
        // from a hardcoded "https://github.com/..." literal plus latest.toString() --
        // QVersionNumber::toString() can only ever produce digits and dots (fromString()
        // stops parsing at the first non-digit-dot character), so it can't inject a scheme,
        // host, or path segment that would make isSafeGitHubUrl() reject this URL. Belt-and-
        // suspenders, same class as checkForUpdates()'s downloadProgress backpressure guard
        // above -- not reachable from a real test process. isSafeGitHubUrl() itself is
        // directly unit-tested (testSafeGitHubUrl()).
        qWarning() << "UpdateChecker: release URL has unexpected scheme/host, ignoring update notification:" << releaseUrl; // LCOV_EXCL_LINE
        return; // LCOV_EXCL_LINE
    } // LCOV_EXCL_LINE
    if (!downloadUrl.isEmpty() && !isSafeGitHubUrl(downloadUrl)) {
        qWarning() << "UpdateChecker: download URL has unexpected scheme/host, falling back to release page:" << downloadUrl;
        downloadUrl.clear();
    }
 
    emit updateAvailable(latest.toString(), downloadUrl, releaseUrl);
}