[GH-ISSUE #3437] hopper: vendor downloads accept redirects that leave HTTPS #1284

New issue

Open

opened 2026-10-16 21:03:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:03:45 +00:00

Owner

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3437

src/application/HopperDownload.ts fetches release metadata and packages from https://www.hopperapp.com, but fetch follows redirects with the default redirect: "follow", including HTTPS→HTTP. The "Hopper origin only" rule therefore applies only to the starting URL.

The impact is limited: Linux packages are checked against hard-coded SHA-1 values and lengths. On macOS, though, the expected SHA-1 comes from the same metadata response, so a downgraded metadata fetch would also control the checksum (codesign verification still applies).

Expected: refuse any response whose final URL is not HTTPS.

Related, not addressed here: the macOS app check verifies codesign --verify --deep --strict and the bundle ID but not the signing Team ID. Pinning the vendor's designated requirement would be stronger.

Reviewed at fa4b828. A PR follows.

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3437 `src/application/HopperDownload.ts` fetches release metadata and packages from `https://www.hopperapp.com`, but `fetch` follows redirects with the default `redirect: "follow"`, including HTTPS→HTTP. The "Hopper origin only" rule therefore applies only to the starting URL. The impact is limited: Linux packages are checked against hard-coded SHA-1 values and lengths. On macOS, though, the expected SHA-1 comes from the same metadata response, so a downgraded metadata fetch would also control the checksum (codesign verification still applies). **Expected:** refuse any response whose final URL is not HTTPS. Related, not addressed here: the macOS app check verifies `codesign --verify --deep --strict` and the bundle ID but not the signing Team ID. Pinning the vendor's designated requirement would be stronger. Reviewed at fa4b828. A PR follows.

bsakaguchi referenced this issue

2026-10-17 21:10:00 +00:00

[PR #1284] [MERGED] fix(process): localize capture truncation diagnostics #2765

bsakaguchi referenced this issue

2026-10-17 21:10:04 +00:00

[PR #1293] [MERGED] fix(process): validate terminal byte totals against retained frames #2773

bsakaguchi referenced this issue

2026-10-31 00:38:46 +00:00

[GH-ISSUE #5418] [Bug] Process capture blames normalization for unchanged rendered-frame omissions #3284