usbeam-hosts-editor

MEDIUM

maintainer lingdianshiren 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

Downloads a prebuilt .NET self-contained binary (plus bundled native .so libraries) from the project author's personal/blog domain (dogfight360.com) rather than an official forge release page; while the MD5 checksum is present and the domain appears to be the legitimate project site, the binary is unverifiable prebuilt code from a non-standard host that could be silently swapped, and it runs as root to edit /etc/hosts.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://www.dogfight360.com/blog/wp-content/uploads/${_pkgdate}/UsbEAm_Hosts_Editor.${pkgver}_X64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt .NET self-contained binary (plus bundled native .so libraries) from the project author's personal/blog domain (dogfight360.com) rather than an official forge release page; while the MD5 checksum is present and the domain appears to be the legitimate project site, the binary is unverifiable prebuilt code from a non-standard host that could be silently swapped, and it runs as root to edit /etc/hosts.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lingdianshiren <ldsrwu@foxmail.com>
    
      2pkgname=usbeam-hosts-editor
    
      3pkgver=5.0.1
    
      4_pkgdate=2026/01
    
      5pkgrel=3
    
      6pkgdesc="羽翼城制作的UsbEAm Hosts Editor,多平台hosts修改工具,使用uhe命令启动"
    
      7url="https://www.dogfight360.com/blog/18627/"
    
      8arch=('x86_64')
    
      9# 与同作者 steamcommunity302 一致
    
      10license=('CC-BY-NC-4.0')
    
      11optdepends=(
    
      12  'polkit: pkexec graphical privilege elevation (recommended)'
    
      13  'sudo: CLI privilege elevation fallback'
    
      14)
    
      15depends=(
    
      16  # self-contained .NET 单文件运行时 NEEDED
    
      17  'glibc' 'gcc-libs' 'zlib'
    
      18  # libSkiaSharp.so NEEDED
    
      19  'brotli' 'bzip2' 'expat' 'fontconfig' 'freetype2' 'libpng'
    
      20  # Avalonia X11 后端运行时 dlopen；xhost 在 root GUI 运行期间授权 X11
    
      21  'libx11' 'libxcursor' 'libxrandr' 'libxi' 'libxext' 'libice' 'libsm' 'libgl' 'xorg-xhost'
    
      22)
    
      23makedepends=('python')
    
      24source=("https://www.dogfight360.com/blog/wp-content/uploads/${_pkgdate}/UsbEAm_Hosts_Editor.${pkgver}_X64.tar.gz")
    
      25md5sums=('5da83cf0d86f4c99ba907ef8a9bffd69')
    
      26options=(!strip)
    
      27
    
      28_install_dir="/usr/lib/usbeam-hosts-editor"
    
      29
    
      30prepare() {
    
      31  local _root="${srcdir}/UsbEAm Hosts Editor"
    
      32  local _main="${_root}/UsbEAm Hosts Editor"
    
      33
    
      34  # 校验关键文件存在(结构变更立即报错)
    
      35  for f in "${_main}" "${_root}/libSkiaSharp.so" "${_root}/libHarfBuzzSharp.so" "${_root}/ip2region.xdb"; do
    
      36    [ -e "$f" ] || { printf 'ERROR: 上游缺失关键文件: %s\n' "$f" >&2; return 1; }
    
      37  done
    
      38
    
      39  # --- 1. 派生 uhe 启动器 ---
    
      40  # 上游 .sh 只支持终端 sudo -S；包提供的启动器改用 polkit 或 sudo
    
      41  # 的正常认证流程，绝不读取、缓存或管道传递用户密码。
    
      42  cat > "${srcdir}/uhe" << 'LAUNCHER_EOF'
    
      43#!/usr/bin/env bash
    
      44set -u
    
      45
    
      46INSTALL_DIR="/usr/lib/usbeam-hosts-editor"
    
      47EXEC_FILE="${INSTALL_DIR}/UsbEAm Hosts Editor"
    
      48CURRENT_DISPLAY="${DISPLAY:-}"
    
      49CURRENT_XAUTHORITY="${XAUTHORITY:-${HOME}/.Xauthority}"
    
      50
    
      51show_error() {
    
      52    printf '错误: %s\n' "$1" >&2
    
      53}
    
      54
    
      55if [[ ! -x "$EXEC_FILE" ]]; then
    
      56    show_error "未找到主程序: $EXEC_FILE"
    
      57    exit 1
    
      58fi
    
      59
    
      60# The program edits /etc/hosts. X11 rejects root even with the caller's
    
      61# XAUTHORITY in this Avalonia runtime, so grant local root access only while
    
      62# the elevated process runs and always revoke it on exit.
    
      63if [[ $EUID -eq 0 ]]; then
    
      64    exec "$EXEC_FILE"
    
      65fi
    
      66
    
      67[[ -n "$CURRENT_DISPLAY" ]] || {
    
      68    show_error "未检测到图形会话；请在 X11 图形会话中启动 uhe。"
    
      69    exit 1
    
      70}
    
      71command -v xhost >/dev/null 2>&1 || {
    
      72    show_error "缺少 xhost；请安装 xorg-xhost。"
    
      73    exit 1
    
      74}
    
      75
    
      76_xhost_granted=0
    
      77cleanup_xhost() {
    
      78    if (( _xhost_granted )); then
    
      79        xhost -SI:localuser:root >/dev/null 2>&1 || true
    
      80        _xhost_granted=0
    
      81    fi
    
      82}
    
      83trap cleanup_xhost EXIT
    
      84trap 'exit 1' HUP INT TERM
    
      85
    
      86if ! xhost +SI:localuser:root >/dev/null 2>&1; then
    
      87    show_error "无法授权 root 访问当前 X11 会话。"
    
      88    exit 1
    
      89fi
    
      90_xhost_granted=1
    
      91
    
      92# pkexec delegates credential collection to the desktop's polkit agent. Never
    
      93# collect a password in this launcher or pipe one to sudo.
    
      94if command -v pkexec >/dev/null 2>&1; then
    
      95    if pkexec env DISPLAY="$CURRENT_DISPLAY" XAUTHORITY="$CURRENT_XAUTHORITY" "$EXEC_FILE"; then
    
      96        exit 0
    
      97    fi
    
      98fi
    
      99
    
      100# sudo is safe only with the launcher's controlling terminal: the shell waits
    
      101# for the root GUI to exit before the EXIT trap revokes the X11 authorization.
    
      102if command -v sudo >/dev/null 2>&1 && [[ -t 0 ]]; then
    
      103    sudo env DISPLAY="$CURRENT_DISPLAY" XAUTHORITY="$CURRENT_XAUTHORITY" "$EXEC_FILE"
    
      104    exit $?
    
      105fi
    
      106
    
      107show_error "无法请求管理员权限；请在终端运行 uhe 使用 sudo。"
    
      108exit 1
    
      109LAUNCHER_EOF
    
      110  chmod +x "${srcdir}/uhe"
    
      111
    
      112  # --- 2. 派生 .desktop ---
    
      113  cat > "${srcdir}/usbeam-hosts-editor.desktop" << 'DESKTOP_EOF'
    
      114[Desktop Entry]
    
      115Version=1.0
    
      116Type=Application
    
      117Name=UsbEAm Hosts Editor
    
      118GenericName=Hosts Editor
    
      119Comment=Cross-platform hosts file editor for Steam/Origin/Uplay etc.
    
      120Comment[zh_CN]=多平台hosts修改工具(Steam/Origin/Uplay等加速)
    
      121Exec=/usr/bin/uhe
    
      122Icon=/usr/share/pixmaps/usbeam-hosts-editor.png
    
      123Terminal=false
    
      124Categories=Network;
    
      125StartupNotify=true
    
      126Keywords=hosts;steam;origin;uplay;epic;
    
      127DESKTOP_EOF
    
      128
    
      129  # --- 3. 提取内嵌图标(取最大方形 PNG,过滤界面截图) ---
    
      130  python3 - "${_main}" "${srcdir}/usbeam-hosts-editor.png" << 'PY_EOF'
    
      131import re, sys
    
      132
    
      133src, dst = sys.argv[1], sys.argv[2]
    
      134data = open(src, 'rb').read()
    
      135magic = b'\x89PNG\r\n\x1a\n'
    
      136best = None
    
      137for off in [m.start() for m in re.finditer(re.escape(magic), data)]:
    
      138    if off + 33 > len(data):
    
      139        continue
    
      140    w = int.from_bytes(data[off+16:off+20], 'big')
    
      141    h = int.from_bytes(data[off+20:off+24], 'big')
    
      142    if w != h:  # 仅方形,避免窗口截图
    
      143        continue
    
      144    iend = data.find(b'IEND', off + 8)
    
      145    if iend < 0:
    
      146        continue
    
      147    if best is None or w * h > best[0]:
    
      148        best = (w * h, off, iend + 8)
    
      149if best is None:
    
      150    sys.exit('ERROR: 未在二进制中找到方形 PNG 图标')
    
      151open(dst, 'wb').write(data[best[1]:best[2]])
    
      152PY_EOF
    
      153  [ -s "${srcdir}/usbeam-hosts-editor.png" ] || { printf '%s\n' 'ERROR: 图标提取失败' >&2; return 1; }
    
      154}
    
      155
    
      156package() {
    
      157  local _root="${srcdir}/UsbEAm Hosts Editor"
    
      158  local _main="${_root}/UsbEAm Hosts Editor"
    
      159
    
      160  # 主程序与运行时本机库必须同目录(.NET 单文件相对加载 libSkiaSharp 等)
    
      161  install -Dm755 "${_main}" "${pkgdir}${_install_dir}/UsbEAm Hosts Editor"
    
      162  install -Dm644 "${_root}/libSkiaSharp.so" "${pkgdir}${_install_dir}/libSkiaSharp.so"
    
      163  install -Dm644 "${_root}/libHarfBuzzSharp.so" "${pkgdir}${_install_dir}/libHarfBuzzSharp.so"
    
      164  install -Dm644 "${_root}/ip2region.xdb" "${pkgdir}${_install_dir}/ip2region.xdb"
    
      165
    
      166  install -Dm755 "${srcdir}/uhe" "${pkgdir}/usr/bin/uhe"
    
      167  install -Dm644 "${srcdir}/usbeam-hosts-editor.png" \
    
      168    "${pkgdir}/usr/share/pixmaps/usbeam-hosts-editor.png"
    
      169  install -Dm644 "${srcdir}/usbeam-hosts-editor.desktop" \
    
      170    "${pkgdir}/usr/share/applications/usbeam-hosts-editor.desktop"
    
      171}
    
      172

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Medium	3
2026-10-05 23:40:58	Medium	2