AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 38 Bitcoin

feat: embed plugin directory in plugin management (#7381)

Public commit record

What the developer wrote

Authored by thgO.O

70/100 · Adequate
feat: embed plugin directory in plugin management (#7381)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This commit refactors BTCPay Server's plugin management into a dedicated plugin and adds an embedded plugin directory that loads content from an external plugin catalog via an iframe. The change moves plugin URLs from the server settings area to a new plugin area, adds URL sanitization for author and documentation links, and introduces checks to prevent installing mismatched plugin identifiers. It is a feature/refactoring commit rather than a disclosed security fix, though it includes some defensive hardening.

Recommended action

Review the new UIPluginManagerController and PluginService for authorization bypasses, validate that iframe sandboxing/CSP restrictions are applied to the embedded plugin directory, ensure the plugin source URL cannot be redirected to attacker-controlled origins, and audit SafeExternalUrl coverage for all user-controlled plugin metadata fields rendered in views.

Security signals we found

01

New SafeExternalUrl helper filters plugin metadata URLs to http/https absolute URIs only, mitigating javascript: and relative-link injection in author/documentation fields

02

DownloadRemotePlugin now validates that the downloaded manifest identifier matches the requested plugin identifier

03

Plugin directory is rendered via iframe to an external, configurable plugin source, increasing attack surface if the source is compromised or MITM'd

04

Plugin source URL normalization strips query strings and fragments before building iframe and API URLs

05

Controller actions are protected by Policies.CanModifyServerSettings authorization

06

Removal of PluginUpdateFetcher scheduled task and PluginUpdateNotification handler reduces server-side update polling

Risk score

Why this scored 38/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 5/15
Affected reach 9/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.