From d2be6b116df46ec72a10c5f7bd324c4a304c7480 Mon Sep 17 00:00:00 2001 From: "Namhyeon, Go" Date: Thu, 4 Dec 2025 16:21:47 +0900 Subject: [PATCH] Improve the loader policy Improve the loader policy --- .../WelsonJS.Launcher/AssemblyLoader.cs | 13 +++++++++++-- WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs | 1 + 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/WelsonJS.Toolkit/WelsonJS.Launcher/AssemblyLoader.cs b/WelsonJS.Toolkit/WelsonJS.Launcher/AssemblyLoader.cs index bf6572d..77f9fe6 100644 --- a/WelsonJS.Toolkit/WelsonJS.Launcher/AssemblyLoader.cs +++ b/WelsonJS.Toolkit/WelsonJS.Launcher/AssemblyLoader.cs @@ -29,13 +29,16 @@ namespace WelsonJS.Launcher /// Must be set before Register() or LoadNativeModules(). /// public static string BaseUrl { get; set; } = null; + public static ICompatibleLogger Logger { get; set; } = null; private static readonly object SyncRoot = new object(); private static bool _registered; private static readonly string LoaderNamespace = typeof(AssemblyLoader).Namespace ?? "WelsonJS.Launcher"; - private static readonly HttpClient Http = new HttpClient(); - private static readonly ICompatibleLogger Logger = new TraceLogger(); + private static readonly HttpClient Http = new HttpClient + { + Timeout = TimeSpan.FromSeconds(300) // 5 minutes + }; // -------------------- kernel32 native loading -------------------- @@ -150,6 +153,12 @@ namespace WelsonJS.Launcher throw new InvalidOperationException("AssemblyLoader.BaseUrl must be configured before Register()."); } + if (!BaseUrl.StartsWith("https://", StringComparison.OrdinalIgnoreCase)) + { + Logger.Error("AssemblyLoader.BaseUrl must use HTTPS for security."); + throw new InvalidOperationException("AssemblyLoader.BaseUrl must use HTTPS."); + } + AppDomain.CurrentDomain.AssemblyResolve += OnAssemblyResolve; _registered = true; diff --git a/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs b/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs index 77fc01f..bfac5b5 100644 --- a/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs +++ b/WelsonJS.Toolkit/WelsonJS.Launcher/Program.cs @@ -34,6 +34,7 @@ namespace WelsonJS.Launcher // load external assemblies AssemblyLoader.BaseUrl = GetAppConfig("AssemblyBaseUrl"); + AssemblyLoader.Logger = _logger; AssemblyLoader.Register(); AssemblyLoader.LoadNativeModules("ChakraCore", new Version(1, 13, 0, 0), new[] { "ChakraCore.dll" });