@browserless.io/browserless 2.33.0 → 2.34.0

package/src/routes/management/tests/management.spec.ts

@@ -21,7 +21,7 @@ describe('Management APIs', function () {
     it('allows Single Origin OPTIONS requests', async () => {
       const config = new Config();
       config.enableCORS(true);
-      config.setCORSOrigin('https://example.com');
+      config.setCORSOrigin('https://one.one.one.one');
       await start({ config });
 
       const r = await fetch(
@@ -29,14 +29,14 @@ describe('Management APIs', function () {
         {
           method: 'OPTIONS',
           headers: {
-            Origin: 'https://example.com',
+            Origin: 'https://one.one.one.one',
           },
         },
       );
 
       expect(r.status).to.equal(204);
       expect(r.headers.get('access-control-allow-origin')).to.equal(
-        'https://example.com',
+        'https://one.one.one.one',
       );
     });
 
@@ -51,21 +51,21 @@ describe('Management APIs', function () {
         {
           method: 'OPTIONS',
           headers: {
-            Origin: 'https://example.com',
+            Origin: 'https://one.one.one.one',
           },
         },
       );
 
       expect(r.status).to.equal(204);
       expect(r.headers.get('access-control-allow-origin')).to.equal(
-        'https://example.com',
+        'https://one.one.one.one',
       );
     });
 
     it('allows glob-matched OPTIONS requests', async () => {
       const config = new Config();
       config.enableCORS(true);
-      config.setCORSOrigin('*.example.com');
+      config.setCORSOrigin('*.one.one.one.one');
       await start({ config });
 
       const r = await fetch(
@@ -73,21 +73,21 @@ describe('Management APIs', function () {
         {
           method: 'OPTIONS',
           headers: {
-            Origin: 'https://subdomain.example.com',
+            Origin: 'https://subdomain.one.one.one.one',
           },
         },
       );
 
       expect(r.status).to.equal(204);
       expect(r.headers.get('access-control-allow-origin')).to.equal(
-        'https://subdomain.example.com',
+        'https://subdomain.one.one.one.one',
       );
     });
 
     it('allows glob-matched OPTIONS requests with OR patterns', async () => {
       const config = new Config();
       config.enableCORS(true);
-      config.setCORSOrigin('https://(abc|xyz).example.com');
+      config.setCORSOrigin('https://(abc|xyz).one.one.one.one');
       await start({ config });
 
       const r = await fetch(
@@ -95,14 +95,14 @@ describe('Management APIs', function () {
         {
           method: 'OPTIONS',
           headers: {
-            Origin: 'https://abc.example.com',
+            Origin: 'https://abc.one.one.one.one',
           },
         },
       );
 
       expect(r.status).to.equal(204);
       expect(r.headers.get('access-control-allow-origin')).to.equal(
-        'https://abc.example.com',
+        'https://abc.one.one.one.one',
       );
     });
 
@@ -110,7 +110,7 @@ describe('Management APIs', function () {
       const config = new Config();
       config.enableCORS(true);
       config.setCORSOrigin(
-        '(https://(abc|xyz).example.com|https://deploy-preview-*.netlify.app)',
+        '(https://(abc|xyz).one.one.one.one|https://deploy-preview-*.netlify.app)',
       );
       await start({ config });
 
@@ -142,7 +142,7 @@ describe('Management APIs', function () {
         {
           method: 'OPTIONS',
           headers: {
-            Origin: 'https://subdomain.example.com',
+            Origin: 'https://subdomain.one.one.one.one',
           },
         },
       );

package/src/server.ts

@@ -19,6 +19,7 @@ import {
   contentTypes,
   convertPathToURL,
   isMatch,
+  moveTokenToHeader,
   queryParamsToObject,
   readBody,
   shimLegacyRequests,
@@ -131,8 +132,9 @@ export class HTTPServer extends EventEmitter {
     request: http.IncomingMessage,
     res: http.ServerResponse,
   ) {
+    request.url = moveTokenToHeader(request);
     this.logger.trace(
-      `Handling inbound HTTP request on "${request.method}: ${request.url}"`,
+      `Handling inbound HTTP request on "${request.method}: ${request.url || ''}"`,
     );
 
     const req = request as Request;
@@ -193,8 +195,12 @@ export class HTTPServer extends EventEmitter {
 
     this.logger.trace(`Found matching HTTP route handler "${route.path}"`);
 
+    if (route.before && !(await route.before(req, res))) {
+      return;
+    }
+
     if (route?.auth) {
-      this.logger.trace(`Authorizing HTTP request to "${request.url}"`);
+      this.logger.trace(`Authorizing HTTP request to "${request.url || ''}"`);
       const isPermitted = await this.token.isAuthorized(req, route);
 
       if (!isPermitted) {
@@ -320,7 +326,11 @@ export class HTTPServer extends EventEmitter {
     socket: stream.Duplex,
     head: Buffer,
   ) {
-    this.logger.trace(`Handling inbound WebSocket request on "${request.url}"`);
+    request.url = moveTokenToHeader(request);
+
+    this.logger.trace(
+      `Handling inbound WebSocket request on "${request.url || ''}"`,
+    );
 
     const req = request as Request;
     const proceed = await this.hooks.before({ head, req, socket });
@@ -338,6 +348,10 @@ export class HTTPServer extends EventEmitter {
         `Found matching WebSocket route handler "${route.path}"`,
       );
 
+      if (route.before && !(await route.before(req, socket, head))) {
+        return;
+      }
+
       if (route?.auth) {
         this.logger.trace(
           `Authorizing WebSocket request to "${req.parsed.href}"`,

package/src/shared/content.http.ts

@@ -18,6 +18,7 @@ import {
   bestAttempt,
   bestAttemptCatch,
   contentTypes,
+  isBase64Encoded,
   noop,
   rejectRequestPattern,
   rejectResourceTypes,
@@ -174,7 +175,14 @@ export default class ChromiumContentPostRoute extends BrowserHTTPRoute {
           req.url().match(r.pattern),
         );
         if (interceptor) {
-          return req.respond(interceptor.response);
+          return req.respond({
+            ...interceptor.response,
+            body: interceptor.response.body
+              ? isBase64Encoded(interceptor.response.body as string)
+                ? Buffer.from(interceptor.response.body, 'base64')
+                : interceptor.response.body
+              : undefined,
+          });
         }
         return req.continue();
       });

package/src/shared/pdf.http.ts

@@ -19,6 +19,7 @@ import {
   bestAttemptCatch,
   contentTypes,
   dedent,
+  isBase64Encoded,
   noop,
   rejectRequestPattern,
   rejectResourceTypes,
@@ -179,7 +180,14 @@ export default class ChromiumPDFPostRoute extends BrowserHTTPRoute {
           req.url().match(r.pattern),
         );
         if (interceptor) {
-          return req.respond(interceptor.response);
+          return req.respond({
+            ...interceptor.response,
+            body: interceptor.response.body
+              ? isBase64Encoded(interceptor.response.body as string)
+                ? Buffer.from(interceptor.response.body, 'base64')
+                : interceptor.response.body
+              : undefined,
+          });
         }
         return req.continue();
       });

package/src/shared/scrape.http.ts

@@ -25,6 +25,7 @@ import {
   contentTypes,
   debugScreenshotOpts,
   dedent,
+  isBase64Encoded,
   jsonResponse,
   noop,
   rejectRequestPattern,
@@ -345,7 +346,14 @@ export default class ChromiumScrapePostRoute extends BrowserHTTPRoute {
           req.url().match(r.pattern),
         );
         if (interceptor) {
-          return req.respond(interceptor.response);
+          return req.respond({
+            ...interceptor.response,
+            body: interceptor.response.body
+              ? isBase64Encoded(interceptor.response.body as string)
+                ? Buffer.from(interceptor.response.body, 'base64')
+                : interceptor.response.body
+              : undefined,
+          });
         }
         return req.continue();
       });

package/src/shared/screenshot.http.ts

@@ -19,6 +19,7 @@ import {
   bestAttemptCatch,
   contentTypes,
   dedent,
+  isBase64Encoded,
   noop,
   rejectRequestPattern,
   rejectResourceTypes,
@@ -189,7 +190,14 @@ export default class ScreenshotPost extends BrowserHTTPRoute {
           req.url().match(r.pattern),
         );
         if (interceptor) {
-          return req.respond(interceptor.response);
+          return req.respond({
+            ...interceptor.response,
+            body: interceptor.response.body
+              ? isBase64Encoded(interceptor.response.body as string)
+                ? Buffer.from(interceptor.response.body, 'base64')
+                : interceptor.response.body
+              : undefined,
+          });
         }
         return req.continue();
       });

package/src/shim.spec.ts

@@ -1,5 +1,9 @@
+import * as http from 'http';
 import { expect } from 'chai';
-import { shimLegacyRequests } from '@browserless.io/browserless';
+import {
+  shimLegacyRequests,
+  moveTokenToHeader,
+} from '@browserless.io/browserless';
 
 describe('Request Shimming', () => {
   describe('headless', () => {
@@ -169,4 +173,39 @@ describe('Request Shimming', () => {
       expect(decodeURIComponent(shimmed.href)).to.equal(final);
     });
   });
+
+  describe('token shimming', () => {
+    it('converts token query parameters to an authorization header', () => {
+      const url = 'wss://localhost?token=12345';
+      const shimmed = moveTokenToHeader({
+        url,
+        headers: {},
+      } as unknown as http.IncomingMessage);
+
+      expect(shimmed).not.to.include('?token=');
+    });
+
+    it('converts the token to a proper header', () => {
+      const url = 'wss://localhost?token=12345';
+      const request = { url, headers: {} } as unknown as http.IncomingMessage;
+
+      moveTokenToHeader(request);
+
+      expect(request.headers.authorization).to.eql('Bearer 12345');
+    });
+
+    it('does no conversion if an authorization header is already present', () => {
+      const oldAuth = 'Bearer foo-bar';
+      const url = 'wss://localhost?token=12345';
+      const request = {
+        url,
+        headers: { authorization: oldAuth },
+      } as unknown as http.IncomingMessage;
+
+      const shimmed = moveTokenToHeader(request);
+
+      expect(shimmed).not.to.include('?token=');
+      expect(request.headers.authorization).to.eql(oldAuth);
+    });
+  });
 });

package/src/shim.ts

@@ -1,3 +1,4 @@
+import * as http from 'http';
 import {
   CDPLaunchOptions,
   convertIfBase64,
@@ -6,6 +7,22 @@ import {
 
 const shimParam = ['headless', 'stealth', 'ignoreDefaultArgs', 'slowMo'];
 
+/**
+ * Obfuscates the ?token parameter by shifting it to a header instead of a query-parameter.
+ */
+export function moveTokenToHeader(req: http.IncomingMessage): string {
+  const parsed = new URL(req.url || '', 'http://localhost');
+  const token = parsed.searchParams.get('token');
+
+  if (token) {
+    parsed.searchParams.delete('token');
+    req.headers.authorization = req.headers.authorization ?? `Bearer ${token}`;
+    req.url = parsed.pathname + parsed.search;
+  }
+
+  return req.url!;
+}
+
 /**
  * Given a legacy connect or API call, this shim will
  * re-order the arguments to make them valid in the 2.0

package/src/types.ts

@@ -238,6 +238,13 @@ abstract class BasicHTTPRoute extends Route {
    * The allowed methods ("GET", "POST", etc) this route can utilize and match against.
    */
   abstract method: Methods;
+
+  /**
+   * A function that can run before the requests is parsed and any query or body validation is run.
+   * Useful if you need to alter something about the request to conform it or otherwise. This
+   * hook is ran after any "global" hooks have run.
+   */
+  before?: (req: Request, res: http.ServerResponse) => Promise<boolean>;
 }
 
 /**
@@ -299,6 +306,15 @@ export abstract class WebSocketRoute extends Route {
     head: Buffer,
     logger: Logger,
   ): Promise<unknown>;
+
+  /**
+   * Handles an inbound HTTP request, and supplies the Request and Response objects from node's HTTP request event
+   */
+  before?: (
+    req: Request,
+    socket: stream.Duplex,
+    head: Buffer,
+  ) => Promise<boolean>;
 }
 
 /**
@@ -328,6 +344,15 @@ export abstract class BrowserWebsocketRoute extends Route {
    * creation. Useful for injecting behaviors or other functionality.
    */
   onNewPage?: (url: URL, page: Page) => Promise<void>;
+
+  /**
+   * Handles an inbound HTTP request, and supplies the Request and Response objects from node's HTTP request event
+   */
+  before?: (
+    req: Request,
+    socket: stream.Duplex,
+    head: Buffer,
+  ) => Promise<boolean>;
 }
 
 interface BrowserlessLaunch {
@@ -517,7 +542,13 @@ export type requestInterceptors = {
    * corresponding responses to use in order to fulfill those requests.
    */
   pattern: string;
-  response: Partial<ResponseForRequest>;
+  response: Partial<Omit<ResponseForRequest, 'body'>> & {
+    /**
+     * A string representation of the body to return. Can be a base64-encoded
+     * string but please omit any leading content-type data (eg "data:image/png;base64,").
+     */
+    body?: string;
+  };
 };
 
 export interface IResourceLoad {

package/src/utils.ts

@@ -230,7 +230,7 @@ export const fetchJson = (
   });
 
 export const getTokenFromRequest = (req: Request) => {
-  const authHeader = req.headers['authorization'];
+  const authHeader = req.headers.authorization;
   const tokenParam = req.parsed.searchParams.get('token');
   return tokenParam ?? getAuthHeaderToken(authHeader || '');
 };
@@ -344,7 +344,7 @@ export const readBody = async (
 ): Promise<ReturnType<typeof safeParse>> => {
   if (
     typeof req.body === 'string' &&
-    (isBase64.test(req.body) || req.body.startsWith('{'))
+    (isBase64Encoded(req.body) || req.body.startsWith('{'))
   ) {
     return safeParse(convertIfBase64(req.body));
   }
@@ -500,8 +500,10 @@ export const fileExists = async (path: string): Promise<boolean> =>
 const isBase64 =
   /^([0-9a-zA-Z+/]{4})*(([0-9a-zA-Z+/]{2}==)|([0-9a-zA-Z+/]{3}=))?$/;
 
+export const isBase64Encoded = (item: string): boolean => isBase64.test(item);
+
 export const convertIfBase64 = (item: string): string =>
-  isBase64.test(item) ? Buffer.from(item, 'base64').toString() : item;
+  isBase64Encoded(item) ? Buffer.from(item, 'base64').toString() : item;
 
 export const availableBrowsers = Promise.all([
   exists(playwright.chromium.executablePath()),