Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

URLs with the HTTP protocol are not being accepted #2788

Closed
decentraland-bot opened this issue Nov 13, 2024 · 6 comments · Fixed by #3281
Closed

URLs with the HTTP protocol are not being accepted #2788

decentraland-bot opened this issue Nov 13, 2024 · 6 comments · Fixed by #3281
Assignees
Labels
1-high Very important but not critical or game breaking bug Something isn't working
Milestone

Comments

@decentraland-bot
Copy link

decentraland-bot commented Nov 13, 2024

Severity:

SEV-2 | Critical, impacting some users

Description:

URLs with the HTTP protocol are not being accepted. In both the web client and alternative clients, these URLs are ignored when in preview mode

Operating system:

Windows 11

Error:

null

Steps to reproduce:

-clone this repo https://github.com/decentraland-scenes/cube-jumper-colyesus-sdk7
initialize the server

-test in web explorer with npm run start and check that everything works

-test in the desktop app with npm run start -- --explorer-alpha and check that the game is not working because is not allowing server's local connection

Ticket number:

@Vitsky4079
Copy link
Collaborator

image

@pabloes
Copy link

pabloes commented Nov 13, 2024

Tested on Apple M1 Pro Sequoia 15.0.1

@Ludmilafantaniella Ludmilafantaniella added 1-high Very important but not critical or game breaking and removed need QA validation labels Nov 14, 2024
@Ludmilafantaniella
Copy link

STR:

  1. Open two separate command line windows.

    In the first window:

    • Navigate to the /server folder.
    • Run npm i to install dependencies.
    • Run npm run start to start the server.
    • The server should start, and you should see a confirmation message. Leave this window running.

    In the second window:

    • Go to the root directory of the repository.
    • Run npm i to install dependencies (if not already installed).
    • Run npm run start -- --explorer-alpha to start the scene as usual.

✅ Expected Result:

2788.support.mp4

❌ Actual Result:

2788.support.desktop.mp4

@AlejandroAlvarezMelucciDCL
Copy link
Collaborator

Hey @m3taphysics, before submitting a fix, is there any security concern I should be aware of that you can think of?

@pravusjif
Copy link
Member

Last time I checked, the only way to make a Unity app accept "http" requests is to change the "Allow downloads over HTTP" setting to allow it.

But that also means we have to start checking EVERY request and if we are not in Local Scene Development, then manually reject any HTTP request, only allowing HTTPS.

Image

@AlejandroAlvarezMelucciDCL AlejandroAlvarezMelucciDCL moved this from In Progress to With QA / Awaiting Review in Explorer Alpha Feb 10, 2025
@AlejandroAlvarezMelucciDCL
Copy link
Collaborator

Last time I checked, the only way to make a Unity app accept "http" requests is to change the "Allow downloads over HTTP" setting to allow it.

But that also means we have to start checking EVERY request and if we are not in Local Scene Development, then manually reject any HTTP request, only allowing HTTPS.

Image

Thanks @pravusjif for your input!
It seems that affects usual requests, but we're using JS API and wrappers, and I didn't find anything blocking those and my fix seems to work fine.
We definitely need more tests, maybe in some cases what you mentioned takes place, but so far in my tests it didn't 🤞

@github-project-automation github-project-automation bot moved this from With QA / Awaiting Review to Done in Explorer Alpha Feb 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
1-high Very important but not critical or game breaking bug Something isn't working
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.

8 participants