fix: force https for extension registry fetch to prevent MITM catalog tampering

[matiaspalmac]

[Fix]: Force https for extension registry fetch

Description

The prod registry URL in ExtensionContext.tsx was hardcoded to
http://raw.githubusercontent.com/.... Plain HTTP lets a network attacker
rewrite the catalog in flight, injecting arbitrary repository/data
entries. Those entries are then fed straight to install_extension in
Rust, which hands them to git clone. Combined with the unvalidated git
URL path (issue #55), that turns a MITM into code execution on the user's
machine.

Context / Problem

HTTPS for raw.githubusercontent.com is free and available today; there
is no reason to fetch the catalog over clear text. Switching the URL alone
fixes the immediate vector, but nothing stopped a future caller of
get_registry_catalog from passing another http:// URL. So the fix is
applied in two layers.

Change

• Frontend (apps/desktop/src/context/ExtensionContext.tsx): change
  the prod registryUrl to https://raw.githubusercontent.com/....
  Removed a stale comment about an HTTP/local fallback that never existed
  — the ternary picks exactly one branch based on NODE_ENV.
• Backend (apps/desktop/src-tauri/src/extensions.rs): in
  get_registry_catalog, reject http:// URLs outright with a clear
  error instead of fetching them. Only https:// and local file paths
  (dev mode) are accepted.

Trade-offs

• A self-hosted registry served over http:// (e.g., on an internal LAN)
  would now be blocked. That is intentional: the command cannot tell a
  legitimate intranet HTTP server apart from a MITM, so HTTPS is required
  for any remote fetch.
• Domain-allowlisting the response host (suggestion 2 in the issue) is
  left out — the current catalog is expected to come from
  raw.githubusercontent.com, but forks and self-hosted catalogs on other
  HTTPS origins are a legitimate use case. Catalog signing (suggestion 3)
  is a larger piece of work and belongs in its own PR.

Verification

• cargo check (src-tauri) → clean.
• pnpm tsc --noEmit across the desktop app → clean.
• Hand-traced get_registry_catalog: http://... hits the early return,
  https://... goes through shared_client, and local paths still fall
  through to std::fs::read_to_string for dev mode.

Related Issue

Fixes #56

Checklist

• I have tested this on the latest version.
• I have followed the project's coding guidelines.
• My changes generate no new warnings or errors.
• I have verified the fix on:
  • OS: Windows
  • Version: v1.0.10

[github-actions]

Thanks for the contribution! I'll review it as soon as possible. If you have still changes, please mark this PR as draft and all reviews will be cancelled. Tests reviews will be re-run only when the PR is marked as ready for review.

[Copilot]

Pull request overview

This PR mitigates a registry-catalog MITM vector by ensuring the extension marketplace catalog is only fetched over HTTPS, with an additional backend guardrail to reject insecure registry URLs.

Changes:

• Updated the production registry URL in the desktop frontend to use https://raw.githubusercontent.com/....
• Updated the Tauri backend get_registry_catalog command to reject http:// registry URLs with an explicit error.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
apps/desktop/src/context/ExtensionContext.tsx	Switches the production registry catalog fetch to HTTPS.
apps/desktop/src-tauri/src/extensions.rs	Adds backend-side rejection of insecure http:// registry URLs before fetching.

Comments suppressed due to low confidence (1)

apps/desktop/src-tauri/src/extensions.rs:74

• get_registry_catalog doesn’t check response.status() before reading/parsing the body. If the host returns a 404/500 HTML page, the error becomes “Failed to parse registry JSON…” which hides the real HTTP failure and makes troubleshooting harder. Consider calling error_for_status() (or checking is_success() and returning a status-aware error) before parsing.

        let response = shared_client()
            .get(&url)
            .timeout(DEFAULT_REQUEST_TIMEOUT)
            .send()
            .await
            .map_err(|e| e.to_string())?;

        let body = read_text_capped(response, MAX_RESPONSE_BYTES).await?;
        let catalog: RegistryCatalog = serde_json::from_str(&body).map_err(|e| {
            let err = format!("Failed to parse registry JSON from {}: {}", url, e);
            error!("{}", err);
            err
        })?;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.