Make using insecure connections opt-in (#1309)

* add insecure url checks

* rename variables

* add feature flags to expose Url properly

* fix test compile error

* fix feature errors

* remove comment

* add url crate and use it for url parsing

* fix compile errors

* satisfy the holy clippy

* fix typos and host loopback

* macro attribute, provide validation function in utils

* fix expected output of ui tests

* remove the success case for --allow-insecure because we cannot establish ws:// connection at the moment.

subxt/src/client/light_client/builder.rs

@@ -5,6 +5,8 @@
 use super::{rpc::LightClientRpc, LightClient, LightClientError};
 use crate::backend::rpc::RpcClient;
 use crate::client::RawLightClient;
+use crate::error::RpcError;
+use crate::utils::validate_url_is_secure;
 use crate::{config::Config, error::Error, OnlineClient};
 use std::num::NonZeroU32;
 use subxt_lightclient::{smoldot, AddedChain};
@@ -101,8 +103,19 @@ impl<T: Config> LightClientBuilder<T> {
     /// https://docs.rs/wasm-bindgen-futures/latest/wasm_bindgen_futures/fn.future_to_promise.html.
     #[cfg(feature = "jsonrpsee")]
     pub async fn build_from_url<Url: AsRef<str>>(self, url: Url) -> Result<LightClient<T>, Error> {
-        let chain_spec = fetch_url(url.as_ref()).await?;
+        validate_url_is_secure(url.as_ref())?;
+        self.build_from_insecure_url(url).await
+    }
 
+    /// Build the light client with specified URL to connect to. Allows insecure URLs (no SSL, ws:// or http://).
+    ///
+    /// For secure connections only, please use [`crate::LightClientBuilder::build_from_url`].
+    #[cfg(feature = "jsonrpsee")]
+    pub async fn build_from_insecure_url<Url: AsRef<str>>(
+        self,
+        url: Url,
+    ) -> Result<LightClient<T>, Error> {
+        let chain_spec = fetch_url(url.as_ref()).await?;
         self.build_client(chain_spec).await
     }
 
@@ -235,7 +248,6 @@ async fn build_client_from_rpc<T: Config>(
 #[cfg(feature = "jsonrpsee")]
 async fn fetch_url(url: impl AsRef<str>) -> Result<serde_json::Value, Error> {
     use jsonrpsee::core::client::ClientT;
-
     let client = jsonrpsee_helpers::client(url.as_ref()).await?;
 
     client

subxt/src/client/online_client.rs

@@ -66,7 +66,15 @@ impl<T: Config> OnlineClient<T> {
 
     /// Construct a new [`OnlineClient`], providing a URL to connect to.
     pub async fn from_url(url: impl AsRef<str>) -> Result<OnlineClient<T>, Error> {
-        let client = RpcClient::from_url(url).await?;
+        crate::utils::validate_url_is_secure(url.as_ref())?;
+        OnlineClient::from_insecure_url(url).await
+    }
+
+    /// Construct a new [`OnlineClient`], providing a URL to connect to.
+    ///
+    /// Allows insecure URLs without SSL encryption, e.g. (http:// and ws:// URLs).
+    pub async fn from_insecure_url(url: impl AsRef<str>) -> Result<OnlineClient<T>, Error> {
+        let client = RpcClient::from_insecure_url(url).await?;
         let backend = LegacyBackend::new(client);
         OnlineClient::from_backend(Arc::new(backend)).await
     }