Slic3r::PluginAuditManager Class Reference

#include </home/runner/work/OrcaSlicer/OrcaSlicer/src/slic3r/plugin/PluginAuditManager.hpp>

Collaboration diagram for Slic3r::PluginAuditManager:

Public Types
using	PermissionPrompt = std::function<bool(const std::string& event_name, const std::vector<std::string>& targets)>
using	PermissionMessagePrompt = std::function<bool(const std::string& message)>

Public Member Functions
void	install_hook ()
void	set_current_plugin (const std::string &plugin_key)
std::string	current_plugin () const
void	clear_current_plugin ()
void	set_current_capability (const std::string &capability_name)
std::string	current_capability () const
void	clear_current_capability ()
void	add_global_allowed_root (const boost::filesystem::path &root, bool allow_write=true)
void	add_scoped_allowed_root (const boost::filesystem::path &root, bool allow_write=true)
void	add_denied_filename (const std::string &filename)
bool	is_denied_filename (const boost::filesystem::path &candidate) const
void	add_denied_path_keyword (const std::string &keyword)
bool	is_denied_path_keyword (const boost::filesystem::path &candidate) const
bool	is_denied_path (const boost::filesystem::path &candidate) const
AuditDecision	check_path_access (const boost::filesystem::path &candidate, bool is_write)
AuditDecision	check_open (const std::string &path, const std::string &mode)
bool	request_permissions (const std::string &plugin_key, const PluginPermissions &requested)
bool	request_network_permissions (const std::string &plugin_key, const std::vector< std::string > &urls)
void	report_violation (const AuditViolation &violation)
bool	audit_denial_pending () const
void	clear_audit_denial ()
void	clear_last_violation ()
bool	last_violation (AuditViolation &violation) const
void	record_root_frame ()
bool	covered_by_root_frame () const
bool	releasing_frames () const

Static Public Member Functions
static PluginAuditManager &	instance ()
static std::vector< std::string >	default_denied_filenames ()
static std::vector< std::string >	default_denied_path_keywords ()
static std::string	normalize_network_url (const std::string &url)
static bool	network_permission_matches (const std::vector< std::string > &granted, const std::string &target)
static bool	is_stdlib_file (const std::string &filename)
static void	set_permission_prompt_for_testing (PermissionPrompt prompt)
static void	set_permission_message_prompt_for_testing (PermissionMessagePrompt prompt)

Public Attributes
bool	verbose_events = true

Private Member Functions
	PluginAuditManager ()=default
void	release_frames (std::vector< PyObject * > &frames)

Static Private Member Functions
static int	audit_hook (const char *event, PyObject *args, void *user_data)
static bool	is_stdlib_path (const boost::filesystem::path &path)

Private Attributes
std::mutex	m_mutex
std::vector< AllowedRoot >	m_global_allowed_roots
std::vector< std::string >	m_denied_filenames
std::vector< std::string >	m_denied_path_keywords

Static Private Attributes
static std::string	m_current_plugin_key = ""
static std::string	m_current_capability_name = ""
static std::vector< AllowedRoot >	m_scoped_allowed_roots
static std::vector< PyObject * >	m_root_frames
static int	m_releasing_frames = 0
static bool	m_audit_denial_pending = false
static bool	m_has_last_violation = false
static AuditViolation	m_last_violation

Friends
class	ScopedPluginAuditContext

Detailed Description

Member Typedef Documentation

PermissionMessagePrompt

using Slic3r::PluginAuditManager::PermissionMessagePrompt = std::function<bool(const std::string& message)>

PermissionPrompt

using Slic3r::PluginAuditManager::PermissionPrompt = std::function<bool(const std::string& event_name, const std::vector<std::string>& targets)>

Constructor & Destructor Documentation

PluginAuditManager()

Slic3r::PluginAuditManager::PluginAuditManager ( )

privatedefault

Referenced by audit_hook(), and instance().

Here is the caller graph for this function:

Member Function Documentation

add_denied_filename()

void Slic3r::PluginAuditManager::add_denied_filename

(

const std::string &

filename

)

{
    if (filename.empty())
        return;
 
    std::lock_guard<std::mutex> lock(m_mutex);
    m_denied_filenames.push_back(filename);
    BOOST_LOG_TRIVIAL(info) << "[AUDIT] Denied filename: " << filename;
}

References m_denied_filenames, and m_mutex.

Referenced by install_hook().

Here is the caller graph for this function:

add_denied_path_keyword()

void Slic3r::PluginAuditManager::add_denied_path_keyword

(

const std::string &

keyword

)

{
    if (keyword.empty())
        return;
 
    std::string lower = keyword;
    std::transform(lower.begin(), lower.end(), lower.begin(), [](unsigned char c) { return std::tolower(c); });
 
    std::lock_guard<std::mutex> lock(m_mutex);
    m_denied_path_keywords.push_back(lower);
    BOOST_LOG_TRIVIAL(info) << "[AUDIT] Denied path keyword: " << lower;
}

References m_denied_path_keywords, and m_mutex.

Referenced by install_hook().

Here is the caller graph for this function:

add_global_allowed_root()

void Slic3r::PluginAuditManager::add_global_allowed_root	(	const boost::filesystem::path &	root,
		bool	allow_write = true )

{
    if (root.empty())
        return;
 
    std::lock_guard<std::mutex> lock(m_mutex);
    m_global_allowed_roots.push_back({root, allow_write});
    BOOST_LOG_TRIVIAL(info) << "[AUDIT] Global allowed root: " << root.string() << " allow_write=" << allow_write;
}

References m_global_allowed_roots, and m_mutex.

Referenced by install_hook().

Here is the caller graph for this function:

add_scoped_allowed_root()

void Slic3r::PluginAuditManager::add_scoped_allowed_root	(	const boost::filesystem::path &	root,
		bool	allow_write = true )

{
    if (root.empty())
        return;
 
    m_scoped_allowed_roots.push_back({root, allow_write});
    BOOST_LOG_TRIVIAL(info) << "[AUDIT] Scoped allowed root for plugin " << current_plugin() << ": " << root.string()
                            << " allow_write=" << allow_write;
}

References current_plugin(), and m_scoped_allowed_roots.

Referenced by Slic3r::PySlicingPipelinePluginCapabilityTrampoline::execute().

Here is the call graph for this function:

Here is the caller graph for this function:

audit_denial_pending()

bool Slic3r::PluginAuditManager::audit_denial_pending

(

)

const

{ return m_audit_denial_pending; }

References m_audit_denial_pending.

Referenced by Slic3r::invoke_script_execute().

Here is the caller graph for this function:

audit_hook()

int Slic3r::PluginAuditManager::audit_hook ( const char * event, PyObject * args, void * user_data )

staticprivate

{
    auto* mgr = static_cast<PluginAuditManager*>(user_data);
    if (!mgr)
        return 0;
 
    std::string event_name(event ? event : "");
 
    if (event_name.empty())
        return 0;
 
    // Verbose logging of every audit event (can be noisy)
    if (mgr->verbose_events) {
        BOOST_LOG_TRIVIAL(debug) << "[AUDIT EVENT] " << event_name;
    }
 
    if (mgr->current_plugin().empty()) {
        BOOST_LOG_TRIVIAL(trace) << "[AUDIT] event=" << event_name << " bypassed (no plugin context)";
        return 0;
    }
 
    // the open function can take in different flags that determine if it is a read or readwrite.
    const AuditEventCategory event_type =
        event_name == "open" ? PluginAuditDetail::open_category(args) : event_category(event_name);
    if (event_type == AuditEventCategory::None)
        return 0;
 
    // Root frames whose operation has returned are let go once this event is decided, so that a
    // finalizer they run re-enters a hook whose held frames are already consistent.
    std::vector<PyObject*> returned_frames;
    PluginAuditDetail::take_returned_frames(m_root_frames, returned_frames);
    const int result = PluginAuditDetail::audit_plugin_event(*mgr, event_name, event_type, args);
    mgr->release_frames(returned_frames);
    return result;
}

References PluginAuditManager(), Slic3r::PluginAuditDetail::audit_plugin_event(), current_plugin(), Slic3r::event_category(), m_root_frames, Slic3r::None, Slic3r::PluginAuditDetail::open_category(), release_frames(), Slic3r::PluginAuditDetail::take_returned_frames(), Slic3r::trace(), and verbose_events.

Referenced by install_hook().

Here is the call graph for this function:

Here is the caller graph for this function:

check_open()

AuditDecision Slic3r::PluginAuditManager::check_open	(	const std::string &	path,
		const std::string &	mode )

{
    const bool is_write = mode.find('w') != std::string::npos || mode.find('a') != std::string::npos ||
                          mode.find('+') != std::string::npos || mode.find('x') != std::string::npos;
    return check_path_access(boost::filesystem::path(path_str), is_write);
}

References check_path_access().

Here is the call graph for this function:

check_path_access()

AuditDecision Slic3r::PluginAuditManager::check_path_access	(	const boost::filesystem::path &	candidate,
		bool	is_write )

{
    if (path.empty())
        return {true, ""};
 
    std::string plugin_key = current_plugin();
    if (plugin_key.empty())
        return {true, ""}; // not running inside a plugin context
 
    // Denied filenames/keywords are checked before the allowed roots.  The app config and the
    // cloud refresh token live directly inside data_dir(), which is a global allowed root, and
    // the bundled TLS client cert lives inside resources_dir(), a read-only global allowed
    // root, so a deny placed any lower would be unreachable.
    if (is_denied_filename(path)) {
        BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
                                   << " plugin=" << plugin_key << " reason=denied filename";
        return {false, "denied filename"};
    }
    if (is_denied_path_keyword(path)) {
        BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << path.string() << " is_write=" << is_write
                                   << " plugin=" << plugin_key << " reason=denied path keyword";
        return {false, "denied path keyword"};
    }
 
    namespace fs = boost::filesystem;
    fs::path candidate = path;
 
    // Resolve relative paths against the current working directory
    if (candidate.is_relative()) {
        boost::system::error_code ec;
        fs::path absolute_candidate = fs::absolute(candidate, ec);
        if (!ec)
            candidate = absolute_candidate;
    }
 
    // Importing Python modules reads their source and may inspect package directories. These
    // reads are normal interpreter work, not plugin data access; keep the exemption read-only
    // and exclude third-party packages from the stdlib roots.
    if (!is_write && is_stdlib_path(candidate))
        return {true, ""};
 
    // A root that doesn't allow writes only matches a read-shaped request; a write/create/
    // delete-shaped one falls through to "outside allowed root" for that root even though the
    // path is physically inside it.
    for (const auto& root : m_scoped_allowed_roots) {
        if ((!is_write || root.allow_write) && is_inside_allowed_root(candidate, root.path)) {
            return {true, ""};
        }
    }
 
    {
        std::lock_guard<std::mutex> lock(m_mutex);
        for (const auto& root : m_global_allowed_roots) {
            if ((!is_write || root.allow_write) && is_inside_allowed_root(candidate, root.path)) {
                return {true, ""};
            }
        }
    }
 
    BOOST_LOG_TRIVIAL(warning) << "[AUDIT] block path=" << candidate.string() << " is_write=" << is_write
                               << " plugin=" << plugin_key;
    return {false, "outside allowed root"};
}

References current_plugin(), is_denied_filename(), is_denied_path_keyword(), Slic3r::is_inside_allowed_root(), is_stdlib_path(), m_global_allowed_roots, m_mutex, and m_scoped_allowed_roots.

Referenced by check_open().

Here is the call graph for this function:

Here is the caller graph for this function:

clear_audit_denial()

void Slic3r::PluginAuditManager::clear_audit_denial

(

)

{ m_audit_denial_pending = false; }

References m_audit_denial_pending.

Referenced by Slic3r::invoke_script_execute().

Here is the caller graph for this function:

clear_current_capability()

void Slic3r::PluginAuditManager::clear_current_capability

(

)

{ m_current_capability_name.clear(); }

References m_current_capability_name.

clear_current_plugin()

void Slic3r::PluginAuditManager::clear_current_plugin

(

)

{ m_current_plugin_key.clear(); }

References m_current_plugin_key.

Referenced by Slic3r::invoke_script_execute().

Here is the caller graph for this function:

clear_last_violation()

void Slic3r::PluginAuditManager::clear_last_violation

(

)

{
    m_has_last_violation = false;
    m_last_violation     = AuditViolation{};
}

References m_has_last_violation, and m_last_violation.

covered_by_root_frame()

bool Slic3r::PluginAuditManager::covered_by_root_frame

(

)

const

{
    if (m_root_frames.empty())
        return false;
 
    // Only stdlib frames may sit between the event and the operation: plugin or library code
    // the operation calls back into (an os.walk onerror, a urllib handler) acts on its own.
    for (PyObject* frame : PluginAuditDetail::stack_frames()) {
        if (std::find(m_root_frames.begin(), m_root_frames.end(), frame) != m_root_frames.end())
            return true;
        if (!PluginAuditDetail::is_stdlib_frame(frame))
            return false;
    }
    return false;
}

References Slic3r::PluginAuditDetail::is_stdlib_frame(), m_root_frames, and Slic3r::PluginAuditDetail::stack_frames().

Referenced by Slic3r::PluginAuditDetail::audit_plugin_event().

Here is the call graph for this function:

Here is the caller graph for this function:

current_capability()

std::string Slic3r::PluginAuditManager::current_capability

(

)

const

{ return m_current_capability_name; }

References m_current_capability_name.

current_plugin()

std::string Slic3r::PluginAuditManager::current_plugin

(

)

const

{ return m_current_plugin_key; }

References m_current_plugin_key.

Referenced by add_scoped_allowed_root(), audit_hook(), Slic3r::PluginAuditDetail::audit_plugin_event(), check_path_access(), Slic3r::anonymous_namespace{PluginHostUi.cpp}::plater_notification(), Slic3r::host_bindings::register_plugin(), Slic3r::anonymous_namespace{PluginHostUi.cpp}::ui_create_dock_panel(), Slic3r::anonymous_namespace{PluginHostUi.cpp}::ui_create_progress_dialog(), and Slic3r::anonymous_namespace{PluginHostUi.cpp}::ui_create_window().

Here is the caller graph for this function:

default_denied_filenames()

std::vector< std::string > Slic3r::PluginAuditManager::default_denied_filenames ( )

static

{
    // AppConfig::config_path() picks .conf vs .ini on the USE_JSON_CONFIG ifdef and the app key
    // on its mode, and is a non-static member we cannot call without an instance. Denying all
    // four names is cheaper and more robust than replicating that; the two unused names cost one
    // string comparison each. Keep the plugin install-state sidecar here too: it controls which
    // packages load on startup and must remain host-managed. Single-sourced so install_hook() and
    // the tests seed from the same list and cannot drift apart.
    return {
        SLIC3R_APP_KEY ".conf",
        GCODEVIEWER_APP_KEY ".conf",
        SLIC3R_APP_KEY ".ini",
        GCODEVIEWER_APP_KEY ".ini",
        secret_constants::USER_SECRET_FILENAME,
        ".install_state.json",
    };
}

References GCODEVIEWER_APP_KEY, and Slic3r::secret_constants::USER_SECRET_FILENAME.

Referenced by install_hook().

Here is the caller graph for this function:

default_denied_path_keywords()

std::vector< std::string > Slic3r::PluginAuditManager::default_denied_path_keywords ( )

static

{
    // Broad, categorical rules on top of the exact-name is_denied_filename registry: a plugin
    // must never be able to reach a secret, a certificate, or a configuration file just because
    // it happens to live inside an otherwise-allowed root (e.g. the bundled TLS client cert at
    // resources_dir()/cert/..., which would become reachable the moment resources_dir() is
    // granted as a read-only allowed root). Match as whole path components, not substrings, so
    // imports such as numpy/__config__.py and stdlib configparser.py remain usable. Inside
    // data_dir() they match below that root only; see is_denied_path_keyword().
    return {"secret", "secrets", "cert", "certs", "certificate", "certificates", "conf", "config"};
}

Referenced by install_hook().

Here is the caller graph for this function:

install_hook()

void Slic3r::PluginAuditManager::install_hook

(

)

{
    // Identifies stdlib frames for operation roots and stdlib paths for read-only access.
    PluginAuditDetail::collect_stdlib_dirs();
 
    // data_dir() is the primary globally-allowed root during plugin execution: read+write. It
    // covers the plugin system's own workflow needs -- each plugin's storage folder
    // (data_dir()/orca_plugins) and the installed/system profile cache (data_dir()/system) --
    // without a separate, narrower grant for either (G-code plugins additionally get the temp
    // G-code folder via a scoped root, see SlicingPipelinePluginCapabilityTrampoline).
    add_global_allowed_root(data_dir());
 
    // resources_dir() holds the app's bundled, shared assets (installed system profiles, the
    // bundled TLS client cert, web assets). Plugins may read from it -- e.g. inspecting bundled
    // profiles -- but must never write into the shared, potentially multi-user app install, so
    // it is granted read-only. The bundled cert itself stays unreachable regardless, via the
    // "cert" denied-path keyword seeded below.
    add_global_allowed_root(resources_dir(), /*allow_write=*/false);
 
    // The user's app config and cloud credentials live directly inside data_dir(), and plugin
    // install state lives beneath it, so the root just granted would otherwise expose them to
    // plugins. Deny them by name.
    //
    // Seeded here rather than by each secret's owner because install_hook() runs during lazy
    // interpreter init and therefore provably precedes any plugin bytecode, whereas
    // OrcaCloudServiceAgent::set_config_dir runs during networking init — neither strictly
    // precedes the other, and if Orca cloud never initializes an owner-registered token deny
    // would never exist at all.  default_denied_filenames() is the single source of that list
    // (see its comment for why all four config names are denied); the tests seed from it too.
    for (const auto& name : default_denied_filenames())
        add_denied_filename(name);
 
    // Categorical denies on top of the exact-name list above: a path a plugin reaches must not
    // have a "secret", "cert"(ificate), or "conf"(ig) component below data_dir() -- or anywhere
    // in the path outside data_dir(), whose own location may legitimately contain one (Flatpak
    // keeps it under .../config/OrcaSlicer). This holds regardless of which allowed root the
    // path happens to sit inside. default_denied_path_keywords() is the single source of this
    // list; the tests seed from it too.
    for (const auto& keyword : default_denied_path_keywords())
        add_denied_path_keyword(keyword);
 
    if (PySys_AddAuditHook(audit_hook, this) < 0) {
        BOOST_LOG_TRIVIAL(error) << "[AUDIT] Failed to install CPython audit hook";
        return;
    }
    BOOST_LOG_TRIVIAL(info) << "[AUDIT] CPython audit hook installed successfully";
}

References add_denied_filename(), add_denied_path_keyword(), add_global_allowed_root(), audit_hook(), Slic3r::PluginAuditDetail::collect_stdlib_dirs(), Slic3r::data_dir(), default_denied_filenames(), default_denied_path_keywords(), and Slic3r::resources_dir().

Referenced by Slic3r::PythonInterpreter::initialize().

Here is the call graph for this function:

Here is the caller graph for this function:

instance()

PluginAuditManager & Slic3r::PluginAuditManager::instance ( )

static

{
    static PluginAuditManager mgr;
    return mgr;
}

References PluginAuditManager().

Referenced by Slic3r::ScopedPluginAuditContext::ScopedPluginAuditContext(), Slic3r::ScopedPluginAuditContext::~ScopedPluginAuditContext(), Slic3r::PySlicingPipelinePluginCapabilityTrampoline::execute(), Slic3r::PythonPluginBridge::finalize_plugin_capture(), Slic3r::PythonInterpreter::initialize(), Slic3r::invoke_script_execute(), Slic3r::anonymous_namespace{PluginHostUi.cpp}::plater_notification(), Slic3r::host_bindings::register_plugin(), Slic3r::anonymous_namespace{PluginHostUi.cpp}::ui_create_dock_panel(), Slic3r::anonymous_namespace{PluginHostUi.cpp}::ui_create_progress_dialog(), and Slic3r::anonymous_namespace{PluginHostUi.cpp}::ui_create_window().

Here is the call graph for this function:

Here is the caller graph for this function:

is_denied_filename()

bool Slic3r::PluginAuditManager::is_denied_filename

(

const boost::filesystem::path &

candidate

)

const

{
    // Match on the base name alone, with no path resolution.  Traversal is handled for free,
    // because filename() of data_dir()/plugins/../OrcaSlicer.conf is already "OrcaSlicer.conf",
    // and the prefix rule covers the .bak/.tmp companions that hold the same secrets plus Windows
    // alternate data streams ("OrcaSlicer.conf:stream").  A plugin that launders a denied file
    // through a symlink, a hardlink, a subprocess, or a Windows 8.3 short name is out of scope
    // (see the design doc): this blocks direct access, not an actively evasive plugin.
    const std::string filename = candidate.filename().string();
    if (filename.empty())
        return false;
 
    std::lock_guard<std::mutex> lock(m_mutex);
    for (const auto& denied : m_denied_filenames) {
        if (boost::algorithm::istarts_with(filename, denied))
            return true;
    }
    return false;
}

References m_denied_filenames, and m_mutex.

Referenced by check_path_access(), and is_denied_path().

Here is the caller graph for this function:

is_denied_path()

bool Slic3r::PluginAuditManager::is_denied_path

(

const boost::filesystem::path &

candidate

)

const

{
    return is_denied_filename(candidate) || is_denied_path_keyword(candidate);
}

References is_denied_filename(), and is_denied_path_keyword().

Referenced by Slic3r::PluginAuditDetail::audit_plugin_event().

Here is the call graph for this function:

Here is the caller graph for this function:

is_denied_path_keyword()

bool Slic3r::PluginAuditManager::is_denied_path_keyword

(

const boost::filesystem::path &

candidate

)

const

{
    namespace fs = boost::filesystem;
 
    const fs::path canon = canonical_for_comparison(candidate);
 
    // The app's data folder can itself sit below a component named like one of the keywords
    // without being one: Flatpak keeps it under <home>/.var/app/<app-id>/config/OrcaSlicer, and
    // the sandbox's home layout is not ours to change.  A keyword above data_dir() therefore says
    // nothing about what a plugin may reach inside it, so inside data_dir() the keywords apply to
    // the suffix below data_dir() only.  Everywhere else -- resources_dir() with the bundled
    // certificates, a plugin's own folders, arbitrary files -- the whole path is still checked,
    // and so is a keyword under data_dir() itself.
    fs::path canonical_data_dir;
    if (!data_dir().empty())
        canonical_data_dir = canonical_for_comparison(data_dir());
 
    fs::path scope = canon;
    fs::path suffix;
    if (!canonical_data_dir.empty() && suffix_inside_root(canon, canonical_data_dir, suffix))
        scope = suffix;
 
    std::lock_guard<std::mutex> lock(m_mutex);
    if (m_denied_path_keywords.empty())
        return false;
 
    for (const auto& component : scope) {
        std::string name = component.string();
        if (name.empty())
            continue;
        std::transform(name.begin(), name.end(), name.begin(), [](unsigned char c) { return std::tolower(c); });
        for (const auto& keyword : m_denied_path_keywords) {
            if (name == keyword || (keyword == "conf" && has_denied_config_extension(name)))
                return true;
        }
    }
    return false;
}

References Slic3r::data_dir(), Slic3r::empty(), Slic3r::has_denied_config_extension(), m_denied_path_keywords, and m_mutex.

Referenced by check_path_access(), and is_denied_path().

Here is the call graph for this function:

Here is the caller graph for this function:

is_stdlib_file()

bool Slic3r::PluginAuditManager::is_stdlib_file ( const std::string & filename )

static

{
    // Frozen stdlib modules (os, posixpath, codecs, ...) carry a pseudo filename.
    if (boost::algorithm::starts_with(filename, "<frozen "))
        return true;
    if (filename.empty() || filename.front() == '<')
        return false;
 
    // Both sides are resolved: co_filename follows the Python home as it was given, which may
    // be a symlink.
    const auto [it, inserted] = PluginAuditDetail::s_stdlib_file_verdicts.try_emplace(filename, false);
    if (inserted) {
        const boost::filesystem::path file(filename);
        const auto inside_any = [&file](const std::vector<boost::filesystem::path>& dirs) {
            return std::any_of(dirs.begin(), dirs.end(),
                               [&file](const boost::filesystem::path& dir) { return is_inside_allowed_root(file, dir); });
        };
        it->second = inside_any(PluginAuditDetail::s_stdlib_dirs) && !inside_any(PluginAuditDetail::s_site_package_dirs);
    }
    return it->second;
}

References Slic3r::PluginAuditDetail::s_site_package_dirs, Slic3r::PluginAuditDetail::s_stdlib_dirs, and Slic3r::PluginAuditDetail::s_stdlib_file_verdicts.

Referenced by Slic3r::PluginAuditDetail::is_stdlib_frame().

Here is the caller graph for this function:

is_stdlib_path()

bool Slic3r::PluginAuditManager::is_stdlib_path ( const boost::filesystem::path & path )

staticprivate

{
    if (path.empty())
        return false;
 
    const auto inside_any = [&path](const std::vector<boost::filesystem::path>& dirs) {
        return std::any_of(dirs.begin(), dirs.end(),
                           [&path](const boost::filesystem::path& dir) { return is_inside_allowed_root(path, dir); });
    };
    return inside_any(PluginAuditDetail::s_stdlib_dirs) && !inside_any(PluginAuditDetail::s_site_package_dirs);
}

References Slic3r::PluginAuditDetail::s_site_package_dirs, and Slic3r::PluginAuditDetail::s_stdlib_dirs.

Referenced by check_path_access().

Here is the caller graph for this function:

last_violation()

bool Slic3r::PluginAuditManager::last_violation

(

AuditViolation &

violation

)

const

{
    if (!m_has_last_violation)
        return false;
 
    violation = m_last_violation;
    return true;
}

References m_has_last_violation, and m_last_violation.

network_permission_matches()

bool Slic3r::PluginAuditManager::network_permission_matches ( const std::vector< std::string > & granted, const std::string & target )

static

{
    if (target.empty())
        return false;
 
    const bool        target_is_url = target.find("://") != std::string::npos;
    const std::string target_url    = normalize_network_url(target);
    if (target_is_url && target_url.empty()) {
        // A non-http(s) URL has no network identity we can generalize; only an exact grant
        // recorded by an earlier approval stays valid, so an unrelated scheme never matches.
        return std::find(granted.begin(), granted.end(), target) != granted.end();
    }
 
    const std::string target_host =
        target_is_url ? std::string{} : without_ipv6_brackets(network_host_from_target(target));
    if (!target_is_url && target_host.empty())
        return false;
 
    for (const std::string& entry : granted) {
        // Preserve an exact grant recorded by an older release, e.g. a full URL with a query.
        if (entry == target)
            return true;
 
        const std::string entry_url = normalize_network_url(entry);
        if (target_is_url) {
            // Canonical scheme://host grants are host-wide. Older grants that persisted a full
            // URL remain scoped to that exact URL, preserving the operation-root URL check.
            if (!entry_url.empty() && entry_url == entry && entry_url == target_url)
                return true;
            continue;
        }
 
        if (!entry_url.empty()) {
            // A bare host carries no scheme: only a canonical scheme://host grant is host-wide.
            // A grant that persisted a full URL stays scoped to that URL, so it must not
            // authorize raw socket access to its whole host. Normalization lowercases the scheme
            // and host, so a canonical grant compares equal to its lowercased form.
            if (ascii_lower(entry) == entry_url) {
                const std::string entry_host = entry_url.substr(entry_url.find("://") + 3);
                if (without_ipv6_brackets(entry_host) == target_host)
                    return true;
            }
        } else if (without_ipv6_brackets(network_host_from_target(entry)) == target_host) {
            // Legacy persisted address tuples, e.g. "('host', 443)".
            return true;
        }
    }
 
    return false;
}

References Slic3r::ascii_lower(), Slic3r::network_host_from_target(), normalize_network_url(), and Slic3r::without_ipv6_brackets().

Referenced by Slic3r::PluginAuditDetail::has_network_permission().

Here is the call graph for this function:

Here is the caller graph for this function:

normalize_network_url()

std::string Slic3r::PluginAuditManager::normalize_network_url ( const std::string & url )

static

{
    const size_t scheme_end = url.find("://");
    if (scheme_end == std::string::npos || scheme_end == 0)
        return {};
 
    const std::string scheme = ascii_lower(url.substr(0, scheme_end));
    if (scheme != "http" && scheme != "https")
        return {};
 
    const size_t authority_start = scheme_end + 3;
    const size_t authority_end   = url.find_first_of("/?#", authority_start);
    const std::string authority  = url.substr(authority_start, authority_end == std::string::npos
                                                                    ? std::string::npos
                                                                    : authority_end - authority_start);
 
    const std::string host = host_from_authority(authority);
    if (host.empty())
        return {};
 
    return scheme + "://" + host;
}

References Slic3r::ascii_lower(), and Slic3r::host_from_authority().

Referenced by Slic3r::bind_python_api(), network_permission_matches(), and request_network_permissions().

Here is the call graph for this function:

Here is the caller graph for this function:

record_root_frame()

void Slic3r::PluginAuditManager::record_root_frame

(

)

{
    PyObject* frame = reinterpret_cast<PyObject*>(PyEval_GetFrame()); // borrowed reference
    if (!frame || !PluginAuditDetail::is_stdlib_frame(frame))
        return;
    if (std::find(m_root_frames.begin(), m_root_frames.end(), frame) != m_root_frames.end())
        return; // glob.glob and glob.glob/2 share a frame
    Py_INCREF(frame);
    m_root_frames.push_back(frame);
}

References Slic3r::PluginAuditDetail::is_stdlib_frame(), and m_root_frames.

Referenced by Slic3r::PluginAuditDetail::audit_plugin_event().

Here is the call graph for this function:

Here is the caller graph for this function:

release_frames()

void Slic3r::PluginAuditManager::release_frames ( std::vector< PyObject * > & frames )

private

{
    if (frames.empty())
        return;
 
    // A finalizer's own denial must neither replace the PermissionError of the event being
    // decided nor leave a stale denial behind for the next call.
    PyObject* const      error          = PyErr_GetRaisedException();
    const bool           denial_pending = m_audit_denial_pending;
    const bool           has_violation  = m_has_last_violation;
    const AuditViolation violation      = m_last_violation;
 
    std::vector<PyObject*> released;
    released.swap(frames);
    ++m_releasing_frames;
    for (PyObject* frame : released)
        Py_DECREF(frame);
    --m_releasing_frames;
 
    m_audit_denial_pending = denial_pending;
    m_has_last_violation   = has_violation;
    m_last_violation       = violation;
    PyErr_SetRaisedException(error);
}

References m_audit_denial_pending, m_has_last_violation, m_last_violation, and m_releasing_frames.

Referenced by Slic3r::ScopedPluginAuditContext::~ScopedPluginAuditContext(), and audit_hook().

Here is the caller graph for this function:

releasing_frames()

bool Slic3r::PluginAuditManager::releasing_frames

(

)

const

{ return m_releasing_frames > 0; }

References m_releasing_frames.

Referenced by Slic3r::PluginAuditDetail::decide_audited_event().

Here is the caller graph for this function:

report_violation()

void Slic3r::PluginAuditManager::report_violation

(

const AuditViolation &

violation

)

{
    m_last_violation     = violation;
    m_has_last_violation = true;
    m_audit_denial_pending = true;
 
    BOOST_LOG_TRIVIAL(warning) << "[AUDIT BLOCKED] plugin=" << violation.plugin_key << " event=" << violation.event_name
                               << " reason=" << violation.reason;
}

References Slic3r::AuditViolation::event_name, m_audit_denial_pending, m_has_last_violation, m_last_violation, Slic3r::AuditViolation::plugin_key, and Slic3r::AuditViolation::reason.

request_network_permissions()

bool Slic3r::PluginAuditManager::request_network_permissions	(	const std::string &	plugin_key,
		const std::vector< std::string > &	urls )

{
    if (plugin_key.empty() || urls.empty())
        return true;
 
    // Reduce every request to scheme://host before comparing or persisting it, so a URL with a
    // path or query cannot create a second grant for the same host.
    PluginPermissions requested;
    for (const std::string& url : urls) {
        const std::string normalized = normalize_network_url(url);
        if (normalized.empty()) {
            BOOST_LOG_TRIVIAL(warning) << "[AUDIT] Invalid network permission request for plugin " << plugin_key << ": " << url;
            return false;
        }
        if (std::find(requested.network_http.begin(), requested.network_http.end(), normalized) == requested.network_http.end())
            requested.network_http.push_back(normalized);
    }
 
    // network_permission_matches() also applies the recorded host grant to raw socket events, so
    // one HTTP grant covers both event layers without prompting for each list separately.
    return request_permissions(plugin_key, requested);
}

References Slic3r::PluginPermissions::network_http, normalize_network_url(), and request_permissions().

Here is the call graph for this function:

request_permissions()

bool Slic3r::PluginAuditManager::request_permissions	(	const std::string &	plugin_key,
		const PluginPermissions &	requested )

{
    if (plugin_key.empty())
        return true;
 
    PluginDescriptor descriptor;
    if (!PluginManager::instance().try_get_plugin_descriptor(plugin_key, descriptor) || descriptor.plugin_root.empty())
        return false;
 
    PluginInstallState state;
    read_install_state(boost::filesystem::path(descriptor.plugin_root), state);
 
    // Per bucket, keep only the targets that no earlier grant already covers. Dropping these
    // before prompting keeps a repeated declaration from asking again for what is on disk.
    struct MissingBucket {
        AuditEventCategory       category;
        std::vector<std::string> targets;
    };
    std::vector<MissingBucket> missing_buckets;
 
    // A network target counts as granted when either network list covers it, matched the same
    // way the audit hook matches it (canonical scheme://host, bare host, legacy address tuple),
    // so a declaration that is already reachable is not asked for again.
    const auto collect_missing = [&missing_buckets, &state](AuditEventCategory category,
                                                            const std::vector<std::string>& requested_targets,
                                                            const std::vector<std::string>& granted_targets) {
        // Only the filesystem buckets accept a tree grant. Network targets match by host and the
        // remaining buckets verbatim.
        const bool tree_grant_bucket =
            category == AuditEventCategory::FsRead || category == AuditEventCategory::FsReadWrite;
        MissingBucket bucket{category, {}};
        for (const std::string& requested_target : requested_targets) {
            if (requested_target.empty())
                continue;
            // A relative wildcard names a directory relative to the working directory the request
            // is made in, while the audit hook reports absolute targets. Resolve it once, here, so
            // the prompt shows and the sidecar stores the scope the grant actually covers.
            const std::string target = tree_grant_bucket
                                           ? PluginAuditDetail::absolute_tree_grant(requested_target)
                                           : requested_target;
            // A saved wildcard already covers a more specific request. Deduplicate inside the
            // request verbatim only: two requested entries may cover different sets.
            const bool already_granted =
                is_network_category(category)
                    ? PluginAuditDetail::has_network_permission(state.permissions, target)
                    : PluginAuditDetail::has_permission(category, /*by_event=*/false, granted_targets, target);
 
            if (!already_granted && std::find(bucket.targets.begin(), bucket.targets.end(), target) == bucket.targets.end())
                bucket.targets.push_back(target);
        }
        if (!bucket.targets.empty())
            missing_buckets.push_back(std::move(bucket));
    };
 
    collect_missing(AuditEventCategory::FsRead, requested.fs_read, state.permissions.fs_read);
    collect_missing(AuditEventCategory::FsReadWrite, requested.fs_readwrite, state.permissions.fs_readwrite);
    collect_missing(AuditEventCategory::Http, requested.network_http, state.permissions.network_http);
    collect_missing(AuditEventCategory::Socket, requested.network_socket, state.permissions.network_socket);
    collect_missing(AuditEventCategory::ProcessCreate, requested.process, state.permissions.process);
    collect_missing(AuditEventCategory::Threading, requested.threading, state.permissions.threading);
 
    if (missing_buckets.empty())
        return true;
 
    const auto build_message = [](const std::string& plugin_name, const std::vector<MissingBucket>& buckets) {
        wxString message;
        for (const MissingBucket& bucket : buckets) {
            wxString targets;
            for (const std::string& target : bucket.targets)
                targets += wxString::FromUTF8(target.c_str()) + "\n";
 
            if (!message.IsEmpty())
                message += "\n\n";
            message += PluginAuditDetail::audit_message(bucket.category, wxString::FromUTF8(plugin_name.c_str()),
                                                        wxEmptyString, targets, bucket.targets.size());
        }
        return message;
    };
 
    bool granted = false;
    if (PluginAuditDetail::s_permission_message_prompt_for_testing) {
        // Tests run without a wxApp to host the dialog: hand the seam the message it would show.
        granted = PluginAuditDetail::s_permission_message_prompt_for_testing(
            build_message(descriptor.name, missing_buckets).utf8_string());
    } else if (wxTheApp == nullptr || GUI::wxGetApp().is_closing()) {
        return false;
    } else if (wxIsMainThread()) {
        granted = PluginAuditDetail::prompt_for_permission_message(build_message(descriptor.name, missing_buckets));
    } else {
        auto result = std::make_shared<std::promise<bool>>();
        auto future = result->get_future();
        GUI::wxGetApp().CallAfter([result, plugin_name = descriptor.name, missing_buckets, build_message]() {
            result->set_value(PluginAuditDetail::prompt_for_permission_message(build_message(plugin_name, missing_buckets)));
        });
        granted = future.get();
    }
 
    if (!granted)
        return false;
 
    // The dialog can stay open while another grant is persisted; re-read before saving so this
    // request adds to the current state instead of replacing it.
    PluginInstallState latest_state;
    if (read_install_state(boost::filesystem::path(descriptor.plugin_root), latest_state))
        state = std::move(latest_state);
 
    PluginAuditDetail::seed_install_metadata(descriptor, state);
 
    for (const MissingBucket& bucket : missing_buckets) {
        std::vector<std::string>* permission_list =
            PluginAuditDetail::permission_list_for(bucket.category, /*by_event=*/false, state.permissions);
        if (!permission_list)
            continue;
        for (const std::string& target : bucket.targets)
            if (std::find(permission_list->begin(), permission_list->end(), target) == permission_list->end())
                permission_list->push_back(target);
    }
 
    return write_install_state(boost::filesystem::path(descriptor.plugin_root), state);
}

References Slic3r::PluginAuditDetail::absolute_tree_grant(), Slic3r::PluginAuditDetail::audit_message(), Slic3r::PluginPermissions::fs_read, Slic3r::PluginPermissions::fs_readwrite, Slic3r::FsRead, Slic3r::FsReadWrite, Slic3r::PluginAuditDetail::has_network_permission(), Slic3r::PluginAuditDetail::has_permission(), Slic3r::Http, Slic3r::PluginManager::instance(), Slic3r::is_network_category(), Slic3r::PluginDescriptor::name, Slic3r::PluginPermissions::network_http, Slic3r::PluginPermissions::network_socket, Slic3r::PluginAuditDetail::permission_list_for(), Slic3r::PluginInstallState::permissions, Slic3r::PluginDescriptor::plugin_root, Slic3r::PluginPermissions::process, Slic3r::ProcessCreate, Slic3r::PluginAuditDetail::prompt_for_permission_message(), Slic3r::read_install_state(), Slic3r::PluginAuditDetail::s_permission_message_prompt_for_testing, Slic3r::PluginAuditDetail::seed_install_metadata(), Slic3r::Socket, Slic3r::Threading, Slic3r::PluginPermissions::threading, and Slic3r::write_install_state().

Referenced by request_network_permissions().

Here is the call graph for this function:

Here is the caller graph for this function:

set_current_capability()

void Slic3r::PluginAuditManager::set_current_capability

(

const std::string &

capability_name

)

{ m_current_capability_name = capability_name; }

References m_current_capability_name.

Referenced by Slic3r::ScopedPluginAuditContext::ScopedPluginAuditContext(), and Slic3r::ScopedPluginAuditContext::~ScopedPluginAuditContext().

Here is the caller graph for this function:

set_current_plugin()

void Slic3r::PluginAuditManager::set_current_plugin

(

const std::string &

plugin_key

)

{ m_current_plugin_key = plugin_key; }

References m_current_plugin_key.

Referenced by Slic3r::ScopedPluginAuditContext::ScopedPluginAuditContext(), and Slic3r::ScopedPluginAuditContext::~ScopedPluginAuditContext().

Here is the caller graph for this function:

set_permission_message_prompt_for_testing()

void Slic3r::PluginAuditManager::set_permission_message_prompt_for_testing ( PermissionMessagePrompt prompt )

static

{
    PluginAuditDetail::s_permission_message_prompt_for_testing = std::move(prompt);
}

References Slic3r::PluginAuditDetail::s_permission_message_prompt_for_testing.

set_permission_prompt_for_testing()

void Slic3r::PluginAuditManager::set_permission_prompt_for_testing ( PermissionPrompt prompt )

static

{
    PluginAuditDetail::s_permission_prompt_for_testing = std::move(prompt);
}

References Slic3r::PluginAuditDetail::s_permission_prompt_for_testing.

Friends And Related Symbol Documentation

ScopedPluginAuditContext

friend class ScopedPluginAuditContext

friend

References ScopedPluginAuditContext.

Referenced by ScopedPluginAuditContext.

Member Data Documentation

m_audit_denial_pending

bool Slic3r::PluginAuditManager::m_audit_denial_pending = false

thread_localstaticprivate

Referenced by audit_denial_pending(), clear_audit_denial(), release_frames(), and report_violation().

m_current_capability_name

std::string Slic3r::PluginAuditManager::m_current_capability_name = ""

thread_localstaticprivate

Referenced by clear_current_capability(), current_capability(), and set_current_capability().

m_current_plugin_key

std::string Slic3r::PluginAuditManager::m_current_plugin_key = ""

thread_localstaticprivate

Referenced by clear_current_plugin(), current_plugin(), and set_current_plugin().

m_denied_filenames

std::vector<std::string> Slic3r::PluginAuditManager::m_denied_filenames

private

Referenced by add_denied_filename(), and is_denied_filename().

m_denied_path_keywords

std::vector<std::string> Slic3r::PluginAuditManager::m_denied_path_keywords

private

Referenced by add_denied_path_keyword(), and is_denied_path_keyword().

m_global_allowed_roots

std::vector<AllowedRoot> Slic3r::PluginAuditManager::m_global_allowed_roots

private

Referenced by add_global_allowed_root(), and check_path_access().

m_has_last_violation

bool Slic3r::PluginAuditManager::m_has_last_violation = false

thread_localstaticprivate

Referenced by clear_last_violation(), last_violation(), release_frames(), and report_violation().

m_last_violation

AuditViolation Slic3r::PluginAuditManager::m_last_violation

thread_localstaticprivate

Referenced by clear_last_violation(), last_violation(), release_frames(), and report_violation().

m_mutex

std::mutex Slic3r::PluginAuditManager::m_mutex

mutableprivate

Referenced by add_denied_filename(), add_denied_path_keyword(), add_global_allowed_root(), check_path_access(), is_denied_filename(), and is_denied_path_keyword().

m_releasing_frames

int Slic3r::PluginAuditManager::m_releasing_frames = 0

thread_localstaticprivate

Referenced by release_frames(), and releasing_frames().

m_root_frames

std::vector< PyObject * > Slic3r::PluginAuditManager::m_root_frames

thread_localstaticprivate

Referenced by Slic3r::ScopedPluginAuditContext::ScopedPluginAuditContext(), Slic3r::ScopedPluginAuditContext::~ScopedPluginAuditContext(), audit_hook(), covered_by_root_frame(), and record_root_frame().

m_scoped_allowed_roots

std::vector< AllowedRoot > Slic3r::PluginAuditManager::m_scoped_allowed_roots

thread_localstaticprivate

Referenced by Slic3r::ScopedPluginAuditContext::ScopedPluginAuditContext(), Slic3r::ScopedPluginAuditContext::~ScopedPluginAuditContext(), add_scoped_allowed_root(), and check_path_access().

verbose_events

bool Slic3r::PluginAuditManager::verbose_events = true

Referenced by audit_hook().

---

The documentation for this class was generated from the following files:

• /home/runner/work/OrcaSlicer/OrcaSlicer/src/slic3r/plugin/PluginAuditManager.hpp
• /home/runner/work/OrcaSlicer/OrcaSlicer/src/slic3r/plugin/PluginAuditManager.cpp