feat(http/plugins): add allowInsecureTls

Author: ItsLemmy

src/net/http_client.cpp

@@ -310,6 +310,10 @@ void HttpClient::request(HttpRequest req, ResponseCallback cb) {
   curl_easy_setopt(easy, CURLOPT_NOSIGNAL, 1L);
   curl_easy_setopt(easy, CURLOPT_TIMEOUT, 30L);
   curl_easy_setopt(easy, CURLOPT_CONNECTTIMEOUT, 10L);
+  if (req.allowInsecureTls) {
+    curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(easy, CURLOPT_SSL_VERIFYHOST, 0L);
+  }
   if (req.followRedirects) {
     curl_easy_setopt(easy, CURLOPT_FOLLOWLOCATION, 1L);
     if (req.allowRedirectAuth) {
@@ -393,6 +397,10 @@ HttpClient::StreamId HttpClient::startStream(HttpRequest req, StreamDataCallback
   curl_easy_setopt(easy, CURLOPT_NOSIGNAL, 1L);
   // No CURLOPT_TIMEOUT: the transfer is expected to stay open indefinitely.
   curl_easy_setopt(easy, CURLOPT_CONNECTTIMEOUT, 10L);
+  if (req.allowInsecureTls) {
+    curl_easy_setopt(easy, CURLOPT_SSL_VERIFYPEER, 0L);
+    curl_easy_setopt(easy, CURLOPT_SSL_VERIFYHOST, 0L);
+  }
   if (req.followRedirects) {
     curl_easy_setopt(easy, CURLOPT_FOLLOWLOCATION, 1L);
     if (req.allowRedirectAuth) {

src/net/http_client.h

@@ -19,6 +19,7 @@ struct HttpRequest {
   std::string body;                 // sent as the request body when non-empty
   bool followRedirects = false;
   bool allowRedirectAuth = false; // continue auth across redirect hosts; use only for trusted provider redirects
+  bool allowInsecureTls = false;  // disable origin certificate and hostname verification; use only for trusted hosts
   bool freshConnection = false;   // bypass curl's connection cache; needed when the route may have changed
                                   // (e.g. probing the external IP after a VPN toggle), otherwise a reused
                                   // keep-alive connection answers via the old path

src/scripting/luau_host.cpp

@@ -924,6 +924,7 @@ namespace {
     request.basicUsername = reqStringField(L, tableIdx, "basic_username");
     request.basicPassword = reqStringField(L, tableIdx, "basic_password");
     request.followRedirects = reqBoolField(L, tableIdx, "follow_redirects", false);
+    request.allowInsecureTls = reqBoolField(L, tableIdx, "allow_insecure_tls", false);
     lua_getfield(L, tableIdx, "headers");
     if (lua_istable(L, -1)) {
       const int headersIdx = lua_gettop(L);

src/scripting/plugin_api.h

@@ -6,7 +6,8 @@ namespace scripting {
 
   inline constexpr std::uint32_t kOldestSupportedPluginApiVersion = 3;
   inline constexpr std::uint32_t kStringMapSettingPluginApiVersion = 6;
-  inline constexpr std::uint32_t kCurrentPluginApiVersion = kStringMapSettingPluginApiVersion;
+  inline constexpr std::uint32_t kAllowInsecureTlsPluginApiVersion = 7;
+  inline constexpr std::uint32_t kCurrentPluginApiVersion = kAllowInsecureTlsPluginApiVersion;
 
   static_assert(kOldestSupportedPluginApiVersion <= kCurrentPluginApiVersion);
 

tests/plugin_manifest_test.cpp

@@ -59,7 +59,8 @@ int main() {
   ok = expect(scripting::supportsPluginApiVersion(4), "plugin API 4 should be supported") && ok;
   ok = expect(scripting::supportsPluginApiVersion(5), "plugin API 5 should be supported") && ok;
   ok = expect(scripting::supportsPluginApiVersion(6), "plugin API 6 should be supported") && ok;
-  ok = expect(!scripting::supportsPluginApiVersion(7), "plugin API 7 should be too new") && ok;
+  ok = expect(scripting::supportsPluginApiVersion(7), "plugin API 7 should be supported") && ok;
+  ok = expect(!scripting::supportsPluginApiVersion(8), "plugin API 8 should be too new") && ok;
   const auto defaultManifestPath = root / "defaults/plugin.toml";
   ok = writeText(defaultManifestPath, "id = \"me/defaults\"\nname = \"Defaults\"\nplugin_api = 3\n") && ok;