Allow HTTP connections to fetch database

[jrozner]

Introduce a new config option to allow requests over HTTP when fetching a database from a URL.

Closes #2324

Checklist

• CHANGELOG.md has been updated to incorporate all user visible changes made by this pull request.
• Issues have been created for any UI or other user-facing changes made by this pull request.
• [Maintainers only] If this pull request makes user-facing changes that require documentation changes, open a corresponding docs pull request in the github/codeql repo and add the ready-for-doc-review label there.

[aeisenberg]

Thanks for your contribution. This looks reasonable to me. I have a few suggestions.

[aeisenberg]

Suggested change

	"description": "Allow databases to be downloaded via HTTP"
	"description": "Allow databases to be downloaded via HTTP. Warning: enabling this option will allow downloading from insecure servers."

[aeisenberg]

Please make it clear that this is related to database downloads only.

Suggested change

	"codeQL.allowHttp": {
	"codeQL.databaseDownload.allowHttp": {

[aeisenberg]

Suggested change

	export const ALLOW_HTTP = new Setting(
	"allowHttp",
	ROOT_SETTING,
	);
	const DATABASE_DOWNLOAD_SETTING = new Setting("databaseDownload", ROOT_SETTING);
	export const ALLOW_HTTP_SETTING = new Setting(
	"allowHttp",
	DATABASE_DOWNLOAD_SETTING,
	);

[aeisenberg]

Suggested change

	import { ALLOW_HTTP } from "./config";
	import { ALLOW_HTTP_SETTING } from "./config";

[aeisenberg]

Suggested change

	if (!ALLOW_HTTP.getValue()) {
	if (!ALLOW_HTTP_SETTING.getValue()) {

[aeisenberg]

Actually, on a deeper thought, can you push this check into the validateHttpsUrl method? Rename the method to validateUrl? This method parses the URL as well as check for https. It's probably better to continue to check that the URL parses regardless of whether or not it is https.

Something like this maybe:

function validateUrl(databaseUrl: string) {
  let uri;
  try {
    uri = Uri.parse(databaseUrl, true);
  } catch (e) {
    throw new Error(`Invalid url: ${databaseUrl}`);
  }

  if (!ALLOW_HTTP_SETTING.getValue() && uri.scheme !== "https") {
    throw new Error("Must use https for downloading a database.");
  }
}

[jrozner]

All changes made and fixed the linting issue from before. Ready for review

[aeisenberg]

Thanks for the quick turnaround. Typo found.

[aeisenberg]

I pushed a few minor changes to your branch: changelog note, typo fix in config description, and invalid variable reference fix.

[jrozner]

Awesome. Changes look good. Anything else you need from me?

[aeisenberg]

Nope. Let's wait for the checks to pass...

[aeisenberg]

Thanks again for your contribution! I hope this is what you need.