Add Modrinth modpack support #1352

Pyroglyph · 2022-06-03T22:31:15Z

Purpose

Currently, GDLauncher does not support downloading mods/modpacks hosted on the Modrinth platform. This feature has been requested in issue #768.

I'm aware of GDevs' other project ferium which already supports Modrinth, and also the gdlib-refactor branch (which I assume may eventually succeed GDLauncher?), but that branch is far from completion.

Approach

This PR allows users to search for and install mods and modpacks hosted on Modrinth in the same way that they can currently be installed from CurseForge and FTB.

The implementation is highly based on the existing CurseForge/FTB installer code so it adds no new dependencies, which I see as an advantage.

Open Questions and Pre-Merge TODOs

Add support for searching for and installing modpacks from Modrinth
Add support for searching for and installing individual mods from Modrinth
Add a proper way to show errors to the user (i.e. when a mod fails to download, or when the user tried to install an unsupported pack type like Quilt)
Modrinth provides fallback download links for overrides. If an override file fails to download, the launcher should retry the download using given alternate links.
Should we send a Google Analytics event for Modrinth API calls?

Learning

I have read the Modrinth API docs (linked below).

Resources

Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

* Change Maximum Value for Max Memory in Global Settings * Change Maximum Value for Max Memory in Instance Settings Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

s/syncronizing/synchronizing Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

CurseForge doesn't (or no longer) users the yarn property in the manifest to specify the fabric version. Instead they now include the version in id property, ex: `fabric-0.11.6`. When importing an instance we'll check for the yarn property first, for backwards compatibility, but will then try to extract it from the id if it's missing. For exporting we'll now include the loader version in the id and omit the yarn property, exactly like CurseForge. Fixes gorilla-devs#942 Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

…s | Better progress update (gorilla-devs#962) * Changed updatePercentage() function to defaut Changed the function to what all the other Downloads use. - Checking if progress changed => less CPU load - Using parseInt() function to prevent errors * Applied concurrent download setting to FTB file-download on instance creation * Codacity means I should do that :/

* Added usual MacOS default menu New Features: - option to open About Page - Services Submenu - Hide Others - Show All * Changed requested Edits - Wrong quote on line 78 - Revert to original click lambda * …And another wrong quote * ...fixed wrong quote Wow, seems that this happend quite often :/ Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

Co-Authored-By: Mr. Hallway <git@mrhallway.me> Co-authored-by: Mr. Hallway <git@mrhallway.me>

* Fixed Problem whit hidden accounts in modal Just had to add overflow: auto; and a padding to the parent element. * Moved CSS-Fix for Account Modal to container initialization Co-Authored-By: Mr. Hallway <git@mrhallway.me> Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com> Co-authored-by: Mr. Hallway <git@mrhallway.me>

Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

* Auto-detect CurseForge modpack loader type Currently all CurseForge modpacks are assumed to be using Forge, whereas they may actually be using Fabric. Instead of hardcoding which one is being used, we can parse the type from the manifest. Fixes gorilla-devs#961 * Support changes versions of fabric modpacks A few refactors were needed to enable this: - Created a utility for extracting the fabric version from a manifest - Revised the change version flow to properly parse fabric vs forge loader versions (previously it just assumed it was a forge modpack) - Reworked the CreateInstance flow to better support code-sharing Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

* Add social links * Fix eslint

Eskaan · 2022-06-20T19:50:18Z

Honestly, that's Modrinths problem. It's just not our part to deal with potentially malicious executables. They could do that way more effectively and they can be uploaded as plain mods the same way.

Pyroglyph · 2022-06-20T21:02:33Z

It's just not our part to deal with potentially malicious executables

Good point. It's a reasonable expectation that the user has a functioning AV on their system. Be it a paid product or just Windows Defender, if something like that isn't running then that's on them.

blarfoon · 2022-06-20T21:54:01Z

I think it is our responsibility to protect our users the best we can, we should wait for modrinth to implement some kind of filters and validation on what type of files can be uploaded before merging this.

Pyroglyph · 2022-06-21T09:00:03Z

In the interest of getting this finished sooner, I've come up with another option we could implement while Modrinth do things on their side.
What if, upon detecting an executable file or script in the mrpack, we simply show users a message that the pack is invalid and to try another version? This prevents scripts leaving the archive but still allows players to play versions of the pack that are fine. This should strike a balance between security and user experience.
Obviously, not allowing potentially dangerous files on Modrinth in the first place would be the ideal solution, but since that's not a thing right now, this (and the 3 options I mentioned earlier) is the best I can come up with.

DioEgizio · 2022-06-21T09:11:53Z

imo it's not a big issue, if there's a malicious file you can report and modrinth will remove it

Pyroglyph · 2022-06-21T09:26:48Z

if there's a malicious file you can report and modrinth will remove it

Except you can't. At least, there is no official channel for reporting malicious content on Modrinth yet. To report something you'd have to go out of your way to find someone to tell, and not many people want to do that.

The point of this conversation is how we can protect users. Sure, adding a report button to the Modrinth page is good, but that won't stop a user downloading a dangerous pack that hasn't been reported yet. We should be doing what we can to prevent that happening.

DioEgizio · 2022-06-21T09:59:26Z

if there's a malicious file you can report and modrinth will remove it

Except you can't. At least, there is no official channel for reporting malicious content on Modrinth yet. To report something you'd have to go out of your way to find someone to tell, and not many people want to do that.

The point of this conversation is how we can protect users. Sure, adding a report button to the Modrinth page is good, but that won't stop a user downloading a dangerous pack that hasn't been reported yet. We should be doing what we can to prevent that happening.

Just so you know

Pyroglyph · 2022-06-21T10:28:59Z

My bad, I never signed into the website so I never saw that button.

My point still stands though. Not many normal users will have a GitHub account, nor will they sign into the Modrinth website in order to find the report button. Most likely their only interaction with the platform is going to be through the launcher itself, not signed in through the website.

This can be removed once Modrinth begin blocking potentially malicious scripts/binaries

Ecorous · 2022-06-21T17:53:20Z

.sh and .AppImage aren't on there @Pyroglyph

Eskaan · 2022-06-21T19:53:14Z

An executable dosen't even need a specific extension (see Linux). It could be any extension and still be executed. Another question would be how those files would be executed in the first place

AshtakaOOf · 2022-06-21T20:04:39Z

It can, but extension are used to identify, what type of executable it is from a glance.
And yes if we have to find a way to stop the download of malicious executable like .exe and other it’s going to be really hard.
On linux there are a lot of executable, Here a few: .sh .py .jar .AppImage .x86_64 and more.
The solution would be to make gdlauncher scans every files to see if they are executable, or wait for modrinth to do something about it.

Eskaan · 2022-06-21T20:52:33Z

Ok Linux you can use any extension for literally anything as long as you include the shebang
Edit: So the filter is practically worthless against a hacker trying to circumvent it.

Pyroglyph · 2022-06-22T15:10:45Z

Another question would be how those files would be executed in the first place

That's something I hadn't really thought of. The only way I can think of is if there is also a rogue mod included in the pack. And if that's the case then the bad actor could easily have made that mod a dropper or made it do what the script/binary would have done anyway.

the filter is practically worthless against a hacker trying to circumvent it

Considering the above, I agree. I suppose this stuff really is for Modrinth to deal with, as I don't think we can do anything to effectively combat it on our side. While we wait for that to happen, I'll continue to work on the rest of the PR.

This reverts commit ab04524.

DioEgizio · 2022-06-23T05:53:05Z

My point still stands though. Not many normal users will have a GitHub account, nor will they sign into the Modrinth website in order to find the report button. Most likely their only interaction with the platform is going to be through the launcher itself, not signed in through the website.

Looks like it's not necessary anymore (modrinth/knossos@371f14d)

Ecorous · 2022-06-23T18:25:22Z

[ x ] TODO: Swap reading dependencies for reading manifest

AshtakaOOf · 2022-06-27T18:21:23Z

@Pyroglyph Something is wrong i can feel it

CLAassistant · 2022-06-30T12:36:19Z

All committers have signed the CLA.

Whoops

blarfoon and others added 30 commits June 1, 2021 06:42

Fix changelogs discord button

38da4e0

improve add account modal (gorilla-devs#917)

75f99d4

Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

fix menu overflow

9c0c67a

Update all deps + native modules to NAPI

0a480cb

fix linting

934723f

downgrade node

0832eb1

fix upload

e3e2d7b

fix macos 7z path

6a5cc3d

v1.1.9

88f54a3

v1.1.10

228bd46

mcVersionChangerFix (gorilla-devs#946)

1967d09

fix (gorilla-devs#954)

a644a60

Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

empty mods list message fix (gorilla-devs#955)

43a22e0

Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

Increase Maximum Value on Memory Sliders (gorilla-devs#950)

a13eefc

* Change Maximum Value for Max Memory in Global Settings * Change Maximum Value for Max Memory in Instance Settings Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

fix minor spelling mistake in mod sync (gorilla-devs#935)

e55b31f

s/syncronizing/synchronizing Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

1.1.11

91e2162

Corrected Lint error - Original Commit by @MrHallway0 (gorilla-devs#964)

b815b1e

Co-Authored-By: Mr. Hallway <git@mrhallway.me> Co-authored-by: Mr. Hallway <git@mrhallway.me>

Update Screenshots.js (gorilla-devs#966)

67e61cc

Limited memory sliders to max system memory (gorilla-devs#967)

3a93317

Co-authored-by: Davide Ceschia <10165264+killpowa@users.noreply.github.com>

Now accurate Kb to Mb calculation (gorilla-devs#1003)

bfef749

Update FUNDING.yml

22962b9

Update README.md

d74031f

Update README.md

a8d5439

Add social links to the setting's sidebar (gorilla-devs#1012)

5a266a6

* Add social links * Fix eslint

Add security check for accounts

fb85a28

mock napi files

0e6dbdf

blarfoon and others added 2 commits June 20, 2022 23:50

Update readme

316b0b4

Merge branch 'master' into modrinth-support

d2aad18

Pyroglyph marked this pull request as draft June 21, 2022 08:03

Add heuristic scanning for mrpack files

ab04524

This can be removed once Modrinth begin blocking potentially malicious scripts/binaries

Revert "Add heuristic scanning for mrpack files"

ed2091f

This reverts commit ab04524.

Pyroglyph added 4 commits June 30, 2022 21:21

Re-add imports that I removed by accident

660041e

Whoops

Properly use the mrpack manifest to download mods

419af4a

Fix MR pack updates not downloading new mods

471ffb5

Appease ESLint

08a2995

blarfoon closed this Jul 4, 2022

blarfoon force-pushed the master branch from 06fd8d2 to 8ec97ba Compare July 4, 2022 21:12

Pyroglyph mentioned this pull request Jul 4, 2022

Add Modrinth mod/modpack support #1391

Draft

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Modrinth modpack support #1352

Add Modrinth modpack support #1352

Pyroglyph commented Jun 3, 2022 •

edited

Eskaan commented Jun 20, 2022

Pyroglyph commented Jun 20, 2022

blarfoon commented Jun 20, 2022

Pyroglyph commented Jun 21, 2022

DioEgizio commented Jun 21, 2022

Pyroglyph commented Jun 21, 2022 •

edited

DioEgizio commented Jun 21, 2022

Pyroglyph commented Jun 21, 2022

Ecorous commented Jun 21, 2022

Eskaan commented Jun 21, 2022

AshtakaOOf commented Jun 21, 2022

Eskaan commented Jun 21, 2022 •

edited

Pyroglyph commented Jun 22, 2022

DioEgizio commented Jun 23, 2022

Ecorous commented Jun 23, 2022 •

edited

AshtakaOOf commented Jun 27, 2022

CLAassistant commented Jun 30, 2022 •

edited

Add Modrinth modpack support #1352

Add Modrinth modpack support #1352

Conversation

Pyroglyph commented Jun 3, 2022 • edited

Purpose

Approach

Open Questions and Pre-Merge TODOs

Learning

Resources

Eskaan commented Jun 20, 2022

Pyroglyph commented Jun 20, 2022

blarfoon commented Jun 20, 2022

Pyroglyph commented Jun 21, 2022

DioEgizio commented Jun 21, 2022

Pyroglyph commented Jun 21, 2022 • edited

DioEgizio commented Jun 21, 2022

Pyroglyph commented Jun 21, 2022

Ecorous commented Jun 21, 2022

Eskaan commented Jun 21, 2022

AshtakaOOf commented Jun 21, 2022

Eskaan commented Jun 21, 2022 • edited

Pyroglyph commented Jun 22, 2022

DioEgizio commented Jun 23, 2022

Ecorous commented Jun 23, 2022 • edited

AshtakaOOf commented Jun 27, 2022

CLAassistant commented Jun 30, 2022 • edited

Pyroglyph commented Jun 3, 2022 •

edited

Pyroglyph commented Jun 21, 2022 •

edited

Eskaan commented Jun 21, 2022 •

edited

Ecorous commented Jun 23, 2022 •

edited

CLAassistant commented Jun 30, 2022 •

edited