security(marketplace): restrict extension download URLs (HTTPS allowlist, SSRF protection)

[ZhuchkaTriplesix]

Summary

HttpMarketplaceRepository.download() accepts any URL from manifest.downloadUrl with no scheme/host validation. Unlike remote theme install (ThemeRemoteInstallPolicy), this allows:

• http:// cleartext downloads
• Requests to private/loopback addresses (SSRF when catalog is compromised)
• Non-HTTP schemes if passed through (e.g. file:// depending on platform)

Default API base is also cleartext: http://localhost:8000/api/v1.

Affected code

• lib/core/market/http_marketplace_repository.dart (download(), default baseUrl)
• Consider reusing or extending ThemeRemoteInstallPolicy patterns

Proposed fix

1. Download URLs: HTTPS only; block private/loopback/link-local IPs in release builds (same rules as theme install).
2. Allowlist: only permit downloads from trusted hosts (MarketApi CDN domain + configured baseUrl host).
3. API base URL: default to HTTPS; reject cleartext in release (debug may allow localhost).
4. Redirect policy: limit redirects; re-validate final URL.

Acceptance criteria

• download() rejects disallowed schemes and hosts with clear errors.
• Tests for blocked http://, 127.0.0.1, 169.254.x.x, file://.
• Production default / config uses HTTPS for MarketApi.

Severity

Medium — SSRF and cleartext MITM when HttpMarketplace is wired to production.

Related

• lib/core/theme/theme_remote_install_policy.dart (reference implementation)
• Security review 0.4.11