From 3dddb3b2401adffe075aec8c792ba5e380a0bde9 Mon Sep 17 00:00:00 2001
From: Andrew Belt <andrewpbelt@gmail.com>
Date: Fri, 4 Jan 2019 00:50:28 -0500
Subject: [PATCH] Add slug validation to plugin loader

---
 include/plugin.hpp    |  2 ++
 src/engine/Engine.cpp | 26 ++++++++++++++------------
 src/plugin.cpp        | 18 ++++++++++++++++--
 3 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/include/plugin.hpp b/include/plugin.hpp
index 705d534d..eb185037 100644
--- a/include/plugin.hpp
+++ b/include/plugin.hpp
@@ -21,6 +21,8 @@ bool isLoggedIn();
 Plugin *getPlugin(std::string pluginSlug);
 Model *getModel(std::string pluginSlug, std::string modelSlug);
 std::string getAllowedTag(std::string tag);
+/** Checks that the slug contains only alphanumeric characters, "-", and "_" */
+bool isSlugValid(std::string slug);
 
 
 extern std::list<Plugin*> plugins;
diff --git a/src/engine/Engine.cpp b/src/engine/Engine.cpp
index 6ec5bf8a..cfc66b84 100644
--- a/src/engine/Engine.cpp
+++ b/src/engine/Engine.cpp
@@ -105,30 +105,31 @@ static void Engine_step(Engine *engine) {
 
 	// Param smoothing
 	{
-		// Store in local variables for thread safety
-		Module *localSmoothModule = engine->internal->smoothModule;
-		int localSmoothParamId = engine->internal->smoothParamId;
-		float localSmoothValue = engine->internal->smoothValue;
-		if (localSmoothModule) {
-			float value = localSmoothModule->params[localSmoothParamId].value;
+		Module *smoothModule = engine->internal->smoothModule;
+		int smoothParamId = engine->internal->smoothParamId;
+		float smoothValue = engine->internal->smoothValue;
+		if (smoothModule) {
+			Param *param = &smoothModule->params[smoothParamId];
+			float value = param->value;
 			// decay rate is 1 graphics frame
 			const float lambda = 60.f;
-			float delta = localSmoothValue - value;
+			float delta = smoothValue - value;
 			float newValue = value + delta * lambda * engine->internal->sampleTime;
 			if (value == newValue) {
 				// Snap to actual smooth value if the value doesn't change enough (due to the granularity of floats)
-				localSmoothModule->params[localSmoothParamId].value = localSmoothValue;
+				param->value = smoothValue;
 				engine->internal->smoothModule = NULL;
 			}
 			else {
-				localSmoothModule->params[localSmoothParamId].value = newValue;
+				param->value = newValue;
 			}
 		}
 	}
 
-	// Step modules
+	// Iterate modules
 	for (Module *module : engine->modules) {
 		if (module->bypass) {
+			// Bypass module
 			for (Output &output : module->outputs) {
 				output.numChannels = 1;
 				output.setValue(0.f);
@@ -136,6 +137,7 @@ static void Engine_step(Engine *engine) {
 			module->cpuTime = 0.f;
 		}
 		else {
+			// Step module
 			if (settings::powerMeter) {
 				auto startTime = std::chrono::high_resolution_clock::now();
 
@@ -151,7 +153,7 @@ static void Engine_step(Engine *engine) {
 			}
 		}
 
-		// Step ports
+		// Iterate ports and step plug lights
 		for (Input &input : module->inputs) {
 			if (input.active) {
 				float value = input.value / 5.f;
@@ -168,7 +170,7 @@ static void Engine_step(Engine *engine) {
 		}
 	}
 
-	// Step cables by moving their output values to inputs
+	// Step cables
 	for (Wire *wire : engine->wires) {
 		wire->step();
 	}
diff --git a/src/plugin.cpp b/src/plugin.cpp
index 4864ac7b..5a779632 100644
--- a/src/plugin.cpp
+++ b/src/plugin.cpp
@@ -114,12 +114,18 @@ static bool loadPlugin(std::string path) {
 	initCallback(plugin);
 	plugin->fromJson(rootJ);
 
+	// Check slug
+	if (!isSlugValid(plugin->slug)) {
+		WARN("Plugin slug \"%s\" is invalid", plugin->slug.c_str());
+		// TODO Fix memory leak with `plugin`
+		return false;
+	}
+
 	// Reject plugin if slug already exists
 	Plugin *oldPlugin = getPlugin(plugin->slug);
 	if (oldPlugin) {
 		WARN("Plugin \"%s\" is already loaded, not attempting to load it again", plugin->slug.c_str());
-		// TODO
-		// Fix memory leak with `plugin` here
+		// TODO Fix memory leak with `plugin`
 		return false;
 	}
 
@@ -512,6 +518,14 @@ std::string getAllowedTag(std::string tag) {
 	return "";
 }
 
+bool isSlugValid(std::string slug) {
+	for (char c : slug) {
+		if (!(std::isalnum(c) || c == '-' || c == '_'))
+			return false;
+	}
+	return true;
+}
+
 
 std::list<Plugin*> plugins;
 std::string token;