From ea25b71ca66a7d81203bbfed7fa1a1d6fa79553f Mon Sep 17 00:00:00 2001
From: xiphon <xiphon@protonmail.com>
Date: Tue, 14 Apr 2020 21:03:15 +0000
Subject: updater: fetch signed hashes from getmonero.org, verify downloads

---
 src/qt/downloader.cpp | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

(limited to 'src/qt/downloader.cpp')

diff --git a/src/qt/downloader.cpp b/src/qt/downloader.cpp
index afd2049e..d925c77c 100644
--- a/src/qt/downloader.cpp
+++ b/src/qt/downloader.cpp
@@ -31,6 +31,8 @@
 #include <QReadLocker>
 #include <QWriteLocker>
 
+#include "updater.h"
+
 namespace
 {
 
@@ -112,10 +114,10 @@ void Downloader::cancel()
     m_contents.clear();
 }
 
-bool Downloader::get(const QString &url, const QJSValue &callback)
+bool Downloader::get(const QString &url, const QString &hash, const QJSValue &callback)
 {
     auto future = m_scheduler.run(
-        [this, url]() {
+        [this, url, hash]() {
             DownloaderStateGuard stateGuard(m_active, m_mutex, [this]() {
                 emit activeChanged();
             });
@@ -153,6 +155,19 @@ bool Downloader::get(const QString &url, const QJSValue &callback)
                 return QJSValueList({"empty response"});
             }
 
+            try
+            {
+                const QByteArray calculatedHash = Updater().getHash(&response[0], response.size());
+                if (QByteArray::fromHex(hash.toUtf8()) != calculatedHash)
+                {
+                    return QJSValueList({"hash sum mismatch"});
+                }
+            }
+            catch (const std::exception &e)
+            {
+                return QJSValueList({e.what()});
+            }
+
             {
                 QWriteLocker locker(&m_mutex);
 
-- 
cgit v1.2.3