@theia/core 1.73.0-next.40 → 1.73.0-next.51

package/lib/node/hosting/ws-origin-validator.spec.js

@@ -0,0 +1,131 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const ws_origin_validator_1 = require("./ws-origin-validator");
+const backend_application_hosts_1 = require("./backend-application-hosts");
+describe('WsOriginValidator', () => {
+    function createValidator(hosts) {
+        const backendHosts = new backend_application_hosts_1.BackendApplicationHosts();
+        if (hosts) {
+            for (const h of hosts) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                backendHosts['_hosts'].add(h);
+            }
+        }
+        const validator = new ws_origin_validator_1.WsOriginValidator();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        validator['backendApplicationHosts'] = backendHosts;
+        return validator;
+    }
+    function createRequest(origin, host) {
+        const request = {
+            headers: {}
+        };
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        if (host !== undefined) {
+            request.headers.host = host;
+        }
+        return request;
+    }
+    describe('when THEIA_HOSTS is not set', () => {
+        it('should allow same-origin requests', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://localhost:3000', 'localhost:3000'))).to.be.true;
+        });
+        it('should allow same-origin requests on default ports', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://myhost.com', 'myhost.com'))).to.be.true;
+        });
+        it('should reject cross-origin requests', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://evil.com', 'localhost:3000'))).to.be.false;
+        });
+        it('should allow requests with no Origin header (same-origin polling)', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest(undefined, 'localhost:3000'))).to.be.true;
+        });
+        it('should reject requests with no Host header when Origin is present', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://localhost:3000', undefined))).to.be.false;
+        });
+        it('should reject requests with malformed Origin', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('not-a-valid-url', 'localhost:3000'))).to.be.false;
+        });
+    });
+    describe('when THEIA_HOSTS is set', () => {
+        it('should allow requests from a listed host', () => {
+            const validator = createValidator(['myhost.com']);
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://myhost.com', 'myhost.com'))).to.be.true;
+        });
+        it('should allow requests from a listed host with port', () => {
+            const validator = createValidator(['myhost.com:8080']);
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://myhost.com:8080', 'myhost.com:8080'))).to.be.true;
+        });
+        it('should reject requests from an unlisted host', () => {
+            const validator = createValidator(['myhost.com']);
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://evil.com', 'myhost.com'))).to.be.false;
+        });
+        it('should allow requests with no Origin header (same-origin polling)', () => {
+            const validator = createValidator(['myhost.com']);
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest(undefined, 'myhost.com'))).to.be.true;
+        });
+        it('should allow when origin host is in the allowlist regardless of Host header', () => {
+            const validator = createValidator(['myhost.com']);
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://myhost.com', 'internal-host:3000'))).to.be.true;
+        });
+        it('should reject malformed Origin even with THEIA_HOSTS', () => {
+            const validator = createValidator(['myhost.com']);
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('not-a-valid-url', 'myhost.com'))).to.be.false;
+        });
+    });
+    describe('edge cases', () => {
+        it('should reject cross-origin with port mismatch', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://localhost:4000', 'localhost:3000'))).to.be.false;
+        });
+        it('should handle HTTPS origins', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('https://localhost:3000', 'localhost:3000'))).to.be.true;
+        });
+        it('should reject Origin: null (opaque origin from sandboxed pages)', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('null', 'localhost:3000'))).to.be.false;
+        });
+        it('should allow empty Origin string (treated as absent)', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('', 'localhost:3000'))).to.be.true;
+        });
+        it('should handle IPv6 same-origin', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://[::1]:3000', '[::1]:3000'))).to.be.true;
+        });
+        it('should strip credentials from Origin when comparing', () => {
+            const validator = createValidator();
+            // new URL('http://user:pass@localhost:3000').host === 'localhost:3000'
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://user:pass@localhost:3000', 'localhost:3000'))).to.be.true;
+        });
+        it('should ignore path component in Origin', () => {
+            const validator = createValidator();
+            (0, chai_1.expect)(validator.allowWsUpgrade(createRequest('http://localhost:3000/some/path', 'localhost:3000'))).to.be.true;
+        });
+    });
+});
+//# sourceMappingURL=ws-origin-validator.spec.js.map

package/lib/node/hosting/ws-origin-validator.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-origin-validator.spec.js","sourceRoot":"","sources":["../../../src/node/hosting/ws-origin-validator.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAE9B,+DAA0D;AAC1D,2EAAsE;AAEtE,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAE/B,SAAS,eAAe,CAAC,KAAgB;QACrC,MAAM,YAAY,GAAG,IAAI,mDAAuB,EAAE,CAAC;QACnD,IAAI,KAAK,EAAE,CAAC;YACR,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpB,8DAA8D;gBAC7D,YAAoB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,uCAAiB,EAAE,CAAC;QAC1C,8DAA8D;QAC7D,SAAiB,CAAC,yBAAyB,CAAC,GAAG,YAAY,CAAC;QAC7D,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,SAAS,aAAa,CAAC,MAAe,EAAE,IAAa;QACjD,MAAM,OAAO,GAAG;YACZ,OAAO,EAAE,EAA8B;SAClB,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;QAEzC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACzC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC1D,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,mBAAmB,EAAE,YAAY,CAAC,CACnD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC3C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CACrD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YACzE,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAC7C,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YACzE,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,uBAAuB,EAAE,SAAS,CAAC,CACpD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACpD,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CACrD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QAErC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,mBAAmB,EAAE,YAAY,CAAC,CACnD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;YAC1D,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACvD,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAC7D,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACpD,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,iBAAiB,EAAE,YAAY,CAAC,CACjD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YACzE,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CACzC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;YACnF,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC5D,MAAM,SAAS,GAAG,eAAe,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,iBAAiB,EAAE,YAAY,CAAC,CACjD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAExB,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACrD,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,uBAAuB,EAAE,gBAAgB,CAAC,CAC3D,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACnC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAC5D,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACvE,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAC1C,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;YAC5D,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,EAAE,EAAE,gBAAgB,CAAC,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACtC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,mBAAmB,EAAE,YAAY,CAAC,CACnD,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;YAC3D,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,uEAAuE;YACvE,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,iCAAiC,EAAE,gBAAgB,CAAC,CACrE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;YACpC,IAAA,aAAM,EAAC,SAAS,CAAC,cAAc,CAC3B,aAAa,CAAC,iCAAiC,EAAE,gBAAgB,CAAC,CACrE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/lib/node/index.d.ts

@@ -6,4 +6,5 @@ export * from './messaging';
 export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
+export { BackendRequestAllowedContribution } from './request/backend-request-facade';
 //# sourceMappingURL=index.d.ts.map

package/lib/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAgBA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,aAAa,CAAC;AAC5B,cAAc,OAAO,CAAC;AACtB,cAAc,mBAAmB,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC"}

package/lib/node/index.js

@@ -15,7 +15,7 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileSystemLocking = void 0;
+exports.BackendRequestAllowedContribution = exports.FileSystemLocking = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./backend-application"), exports);
 tslib_1.__exportStar(require("./backend-global"), exports);
@@ -26,4 +26,6 @@ tslib_1.__exportStar(require("./cli"), exports);
 tslib_1.__exportStar(require("./setting-service"), exports);
 var filesystem_locking_1 = require("./filesystem-locking");
 Object.defineProperty(exports, "FileSystemLocking", { enumerable: true, get: function () { return filesystem_locking_1.FileSystemLocking; } });
+var backend_request_facade_1 = require("./request/backend-request-facade");
+Object.defineProperty(exports, "BackendRequestAllowedContribution", { enumerable: true, get: function () { return backend_request_facade_1.BackendRequestAllowedContribution; } });
 //# sourceMappingURL=index.js.map

package/lib/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAEhF,gEAAsC;AACtC,2DAAiC;AACjC,kDAAwB;AACxB,6DAAmC;AACnC,sDAA4B;AAC5B,gDAAsB;AACtB,4DAAkC;AAClC,2DAAyD;AAAhD,uHAAA,iBAAiB,OAAA;AAC1B,2EAAqF;AAA5E,2IAAA,iCAAiC,OAAA"}

package/lib/node/messaging/websocket-endpoint.d.ts

@@ -16,6 +16,11 @@ export declare class WebsocketEndpoint implements BackendApplicationContribution
     protected readonly wsHandlers: ConnectionHandlers<Socket<import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, import("socket.io").DefaultEventsMap, any>>;
     registerConnectionHandler(spec: string, callback: (params: MessagingService.PathParams, socket: Socket) => void): void;
     onStart(server: http.Server | https.Server): void;
+    /**
+     * Secondary validation after connection. The primary check happens in the
+     * Socket.IO `allowRequest` callback at handshake time; this is kept as
+     * defense-in-depth in case a Socket.IO upgrade path bypasses `allowRequest`.
+     */
     protected allowConnect(request: http.IncomingMessage): Promise<boolean>;
     protected handleConnection(socket: Socket): Promise<void>;
 }

package/lib/node/messaging/websocket-endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-endpoint.d.ts","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAU,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,qBACa,iBAAkB,YAAW,8BAA8B;IAEpE,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAG1D,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAGxD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEnC,SAAS,CAAC,iBAAiB,SAAS;IACpC,SAAS,CAAC,iBAAiB,SAAO;IAElC,SAAS,CAAC,QAAQ,CAAC,UAAU,oJAAoC;IAEjE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAItH,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI;cAqBjC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;cAQ7D,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}
+{"version":3,"file":"websocket-endpoint.d.ts","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAU,MAAM,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,qBACa,iBAAkB,YAAW,8BAA8B;IAEpE,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAG1D,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAGxD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEnC,SAAS,CAAC,iBAAiB,SAAS;IACpC,SAAS,CAAC,iBAAiB,SAAO;IAElC,SAAS,CAAC,QAAQ,CAAC,UAAU,oJAAoC;IAEjE,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAItH,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI;IA4BjD;;;;OAIG;cACa,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;cAQ7D,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAMlE"}

package/lib/node/messaging/websocket-endpoint.js

@@ -35,14 +35,18 @@ let WebsocketEndpoint = class WebsocketEndpoint {
         const socketServer = new socket_io_1.Server(server, {
             pingInterval: this.checkAliveTimeout,
             pingTimeout: this.checkAliveTimeout * 2,
-            maxHttpBufferSize: this.maxHttpBufferSize
+            maxHttpBufferSize: this.maxHttpBufferSize,
+            allowRequest: (req, callback) => {
+                // eslint-disable-next-line no-null/no-null
+                const noError = null;
+                this.wsRequestValidator.allowWsUpgrade(req).then(allowed => callback(noError, allowed), error => {
+                    console.error('Error during WebSocket allowRequest validation:', error);
+                    callback(error?.message ?? 'Validation error', false);
+                });
+            }
         });
         // Accept every namespace by using /.*/
         socketServer.of(/.*/).on('connection', async (socket) => {
-            const request = socket.request;
-            // Socket.io strips the `origin` header of the incoming request
-            // We provide a `fix-origin` header in the `WebSocketConnectionProvider`
-            request.headers.origin = request.headers['fix-origin'];
             if (await this.allowConnect(socket.request)) {
                 await this.handleConnection(socket);
                 this.messagingListener.onDidWebSocketUpgrade(socket.request, socket);
@@ -52,6 +56,11 @@ let WebsocketEndpoint = class WebsocketEndpoint {
             }
         });
     }
+    /**
+     * Secondary validation after connection. The primary check happens in the
+     * Socket.IO `allowRequest` callback at handshake time; this is kept as
+     * defense-in-depth in case a Socket.IO upgrade path bypasses `allowRequest`.
+     */
     async allowConnect(request) {
         try {
             return this.wsRequestValidator.allowWsUpgrade(request);

package/lib/node/messaging/websocket-endpoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"websocket-endpoint.js","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;;;;AAKhF,yCAAsD;AACtD,yCAA2C;AAC3C,oEAA8D;AAC9D,+DAA0D;AAC1D,2EAAiE;AAEjE,gDAA8C;AAGvC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAAvB;QAUO,sBAAiB,GAAG,KAAK,CAAC,CAAC,aAAa;QACxC,sBAAiB,GAAG,GAAG,CAAC,CAAC,SAAS;QAEzB,eAAU,GAAG,IAAI,8CAAkB,EAAU,CAAC;IAyCrE,CAAC;IAvCG,yBAAyB,CAAC,IAAY,EAAE,QAAuE;QAC3G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,MAAkC;QACtC,MAAM,YAAY,GAAG,IAAI,kBAAM,CAAC,MAAM,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,iBAAiB;YACpC,WAAW,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC5C,CAAC,CAAC;QACH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YAClD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,+DAA+D;YAC/D,wEAAwE;YACxE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAW,CAAC;YACjE,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,OAA6B;QACtD,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAA;AAtDY,8CAAiB;AAEP;IADlB,IAAA,kBAAM,EAAC,0CAAkB,CAAC;sCACY,0CAAkB;6DAAC;AAGvC;IADlB,IAAA,kBAAM,EAAC,uCAAiB,CAAC;sCACY,uCAAiB;4DAAC;AAGrC;IADlB,IAAA,kBAAM,EAAC,gBAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,wBAAwB,CAAC;;iDACd;4BAR1B,iBAAiB;IAD7B,IAAA,sBAAU,GAAE;GACA,iBAAiB,CAsD7B"}
+{"version":3,"file":"websocket-endpoint.js","sourceRoot":"","sources":["../../../src/node/messaging/websocket-endpoint.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;;;;AAKhF,yCAAsD;AACtD,yCAA2C;AAC3C,oEAA8D;AAC9D,+DAA0D;AAC1D,2EAAiE;AAEjE,gDAA8C;AAGvC,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAAvB;QAUO,sBAAiB,GAAG,KAAK,CAAC,CAAC,aAAa;QACxC,sBAAiB,GAAG,GAAG,CAAC,CAAC,SAAS;QAEzB,eAAU,GAAG,IAAI,8CAAkB,EAAU,CAAC;IAqDrE,CAAC;IAnDG,yBAAyB,CAAC,IAAY,EAAE,QAAuE;QAC3G,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,MAAkC;QACtC,MAAM,YAAY,GAAG,IAAI,kBAAM,CAAC,MAAM,EAAE;YACpC,YAAY,EAAE,IAAI,CAAC,iBAAiB;YACpC,WAAW,EAAE,IAAI,CAAC,iBAAiB,GAAG,CAAC;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;gBAC5B,2CAA2C;gBAC3C,MAAM,OAAO,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,CAC5C,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,EACrC,KAAK,CAAC,EAAE;oBACJ,OAAO,CAAC,KAAK,CAAC,iDAAiD,EAAE,KAAK,CAAC,CAAC;oBACxE,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,kBAAkB,EAAE,KAAK,CAAC,CAAC;gBAC1D,CAAC,CACJ,CAAC;YACN,CAAC;SACJ,CAAC,CAAC;QACH,uCAAuC;QACvC,YAAY,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;YAClD,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,YAAY,CAAC,OAA6B;QACtD,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAA;AAlEY,8CAAiB;AAEP;IADlB,IAAA,kBAAM,EAAC,0CAAkB,CAAC;sCACY,0CAAkB;6DAAC;AAGvC;IADlB,IAAA,kBAAM,EAAC,uCAAiB,CAAC;sCACY,uCAAiB;4DAAC;AAGrC;IADlB,IAAA,kBAAM,EAAC,gBAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,wBAAwB,CAAC;;iDACd;4BAR1B,iBAAiB;IAD7B,IAAA,sBAAU,GAAE;GACA,iBAAiB,CAkE7B"}

package/lib/node/request/backend-request-facade.d.ts

@@ -14,10 +14,29 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 import { RequestConfiguration, RequestContext, RequestOptions, RequestService } from '@theia/request';
+import { ContributionProvider, MaybePromise } from '../../common';
+export declare const BackendRequestAllowedContribution: unique symbol;
+export interface BackendRequestAllowedContribution {
+    /**
+     * Returns URL patterns that should be allowed through the backend request facade.
+     * Patterns are matched against request URLs.
+     *
+     * Supports:
+     * - Exact base URLs: `https://open-vsx.org` (allows any path under this origin)
+     * - Wildcard subdomains: `https://*.github.com` (allows any subdomain)
+     *
+     * Only `http:` and `https:` schemes are permitted.
+     */
+    getAllowedUrlPatterns(): MaybePromise<string[]>;
+}
+export declare function isUrlAllowed(url: string, allowedPatterns: string[]): boolean;
 export declare class BackendRequestFacade implements RequestService {
     protected readonly requestService: RequestService;
+    protected readonly allowedContributions?: ContributionProvider<BackendRequestAllowedContribution>;
+    protected cachedAllowedPatterns: string[] | undefined;
     configure(config: RequestConfiguration): Promise<void>;
     request(options: RequestOptions): Promise<RequestContext>;
     resolveProxy(url: string): Promise<string | undefined>;
+    protected getAllowedPatterns(): Promise<string[]>;
 }
 //# sourceMappingURL=backend-request-facade.d.ts.map

package/lib/node/request/backend-request-facade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backend-request-facade.d.ts","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAGlF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEtG,qBACa,oBAAqB,YAAW,cAAc;IAGvD,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAElD,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAK/D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAIzD"}
+{"version":3,"file":"backend-request-facade.d.ts","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;kFAckF;AAGlF,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGlE,eAAO,MAAM,iCAAiC,eAA8C,CAAC;AAC7F,MAAM,WAAW,iCAAiC;IAC9C;;;;;;;;;OASG;IACH,qBAAqB,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;CACnD;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,OAAO,CAgB5E;AA4CD,qBACa,oBAAqB,YAAW,cAAc;IAGvD,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAGlD,SAAS,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,iCAAiC,CAAC,CAAC;IAElG,SAAS,CAAC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAEhD,SAAS,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMtD,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/D,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;cAItC,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;CAc1D"}

package/lib/node/request/backend-request-facade.js

@@ -15,27 +15,117 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackendRequestFacade = void 0;
+exports.BackendRequestFacade = exports.BackendRequestAllowedContribution = void 0;
+exports.isUrlAllowed = isUrlAllowed;
 const tslib_1 = require("tslib");
 const inversify_1 = require("inversify");
 const request_1 = require("@theia/request");
+const common_1 = require("../../common");
+const backend_application_config_provider_1 = require("../backend-application-config-provider");
+exports.BackendRequestAllowedContribution = Symbol('BackendRequestAllowedContribution');
+const ALLOWED_SCHEMES = new Set(['http:', 'https:']);
+function isUrlAllowed(url, allowedPatterns) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+        return false;
+    }
+    for (const pattern of allowedPatterns) {
+        if (matchesPattern(parsed, pattern)) {
+            return true;
+        }
+    }
+    return false;
+}
+function matchesPattern(target, pattern) {
+    let patternUrl;
+    try {
+        patternUrl = new URL(pattern);
+    }
+    catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(patternUrl.protocol)) {
+        return false;
+    }
+    if (target.protocol !== patternUrl.protocol) {
+        return false;
+    }
+    const targetPort = getEffectivePort(target);
+    const patternPort = getEffectivePort(patternUrl);
+    if (targetPort !== patternPort) {
+        return false;
+    }
+    return matchesHost(target.hostname, patternUrl.hostname);
+}
+function getEffectivePort(url) {
+    if (url.port) {
+        return url.port;
+    }
+    if (url.protocol === 'https:') {
+        return '443';
+    }
+    if (url.protocol === 'http:') {
+        return '80';
+    }
+    return '';
+}
+function matchesHost(targetHost, patternHost) {
+    if (patternHost.startsWith('*.')) {
+        const suffix = patternHost.substring(1); // e.g. ".example.com"
+        return targetHost.endsWith(suffix) && targetHost.length > suffix.length;
+    }
+    return targetHost === patternHost;
+}
 let BackendRequestFacade = class BackendRequestFacade {
-    configure(config) {
-        return this.requestService.configure(config);
+    async configure(config) {
+        if (backend_application_config_provider_1.BackendApplicationConfigProvider.get().configureProxyFromPreferences) {
+            return this.requestService.configure(config);
+        }
     }
     async request(options) {
+        const patterns = await this.getAllowedPatterns();
+        const url = options.url;
+        if (!url || !isUrlAllowed(url, patterns)) {
+            throw new Error(`Request to URL '${url}' is not allowed. The URL does not match any allowed pattern.`);
+        }
         const context = await this.requestService.request(options);
         return request_1.RequestContext.compress(context);
     }
     resolveProxy(url) {
         return this.requestService.resolveProxy(url);
     }
+    async getAllowedPatterns() {
+        if (this.cachedAllowedPatterns) {
+            return this.cachedAllowedPatterns;
+        }
+        const patterns = [];
+        if (this.allowedContributions) {
+            for (const contribution of this.allowedContributions.getContributions()) {
+                const contributed = await contribution.getAllowedUrlPatterns();
+                patterns.push(...contributed);
+            }
+        }
+        this.cachedAllowedPatterns = patterns;
+        return patterns;
+    }
 };
 exports.BackendRequestFacade = BackendRequestFacade;
 tslib_1.__decorate([
     (0, inversify_1.inject)(request_1.RequestService),
     tslib_1.__metadata("design:type", Object)
 ], BackendRequestFacade.prototype, "requestService", void 0);
+tslib_1.__decorate([
+    (0, inversify_1.inject)(common_1.ContributionProvider),
+    (0, inversify_1.named)(exports.BackendRequestAllowedContribution),
+    (0, inversify_1.optional)(),
+    tslib_1.__metadata("design:type", Object)
+], BackendRequestFacade.prototype, "allowedContributions", void 0);
 exports.BackendRequestFacade = BackendRequestFacade = tslib_1.__decorate([
     (0, inversify_1.injectable)()
 ], BackendRequestFacade);

package/lib/node/request/backend-request-facade.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend-request-facade.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;;;AAElF,yCAA+C;AAC/C,4CAAsG;AAG/F,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAK7B,SAAS,CAAC,MAA4B;QAClC,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,wBAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CAEJ,CAAA;AAlBY,oDAAoB;AAGV;IADlB,IAAA,kBAAM,EAAC,wBAAc,CAAC;;4DAC2B;+BAHzC,oBAAoB;IADhC,IAAA,sBAAU,GAAE;GACA,oBAAoB,CAkBhC"}
+{"version":3,"file":"backend-request-facade.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;kFAckF;;;AAwBlF,oCAgBC;;AAtCD,yCAAgE;AAChE,4CAAsG;AACtG,yCAAkE;AAClE,gGAA0F;AAE7E,QAAA,iCAAiC,GAAG,MAAM,CAAC,mCAAmC,CAAC,CAAC;AAe7F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD,SAAgB,YAAY,CAAC,GAAW,EAAE,eAAyB;IAC/D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,MAAW,EAAE,OAAe;IAChD,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACD,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAC9B,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB,EAAE,WAAmB;IACxD,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB;QAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,KAAK,WAAW,CAAC;AACtC,CAAC;AAGM,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAU7B,KAAK,CAAC,SAAS,CAAC,MAA4B;QACxC,IAAI,sEAAgC,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACxB,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,+DAA+D,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,wBAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,YAAY,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAES,KAAK,CAAC,kBAAkB;QAC9B,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,qBAAqB,CAAC;QACtC,CAAC;QACD,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,CAAC;gBACtE,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,qBAAqB,EAAE,CAAC;gBAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC;QACtC,OAAO,QAAQ,CAAC;IACpB,CAAC;CACJ,CAAA;AA5CY,oDAAoB;AAGV;IADlB,IAAA,kBAAM,EAAC,wBAAc,CAAC;;4DAC2B;AAG/B;IADlB,IAAA,kBAAM,EAAC,6BAAoB,CAAC;IAAE,IAAA,iBAAK,EAAC,yCAAiC,CAAC;IAAE,IAAA,oBAAQ,GAAE;;kEACe;+BANzF,oBAAoB;IADhC,IAAA,sBAAU,GAAE;GACA,oBAAoB,CA4ChC"}

package/lib/node/request/backend-request-facade.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=backend-request-facade.spec.d.ts.map

package/lib/node/request/backend-request-facade.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-request-facade.spec.d.ts","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.spec.ts"],"names":[],"mappings":""}

package/lib/node/request/backend-request-facade.spec.js

@@ -0,0 +1,171 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon = require("sinon");
+const backend_request_facade_1 = require("./backend-request-facade");
+const backend_application_config_provider_1 = require("../backend-application-config-provider");
+describe('isUrlAllowed', () => {
+    it('should allow a URL that matches an exact origin pattern', () => {
+        const patterns = ['https://open-vsx.org'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://open-vsx.org/api/extensions', patterns)).to.be.true;
+    });
+    it('should allow a URL with a path when pattern has no path', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/some/deep/path?query=1', patterns)).to.be.true;
+    });
+    it('should allow a URL that exactly matches the origin', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/', patterns)).to.be.true;
+    });
+    it('should reject a URL with a different scheme', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com/path', patterns)).to.be.false;
+    });
+    it('should reject a URL with a different host', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://evil.com/path', patterns)).to.be.false;
+    });
+    it('should reject a URL with a different port', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com:8443/path', patterns)).to.be.false;
+    });
+    it('should allow a URL when port matches explicitly', () => {
+        const patterns = ['https://example.com:8443'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com:8443/path', patterns)).to.be.true;
+    });
+    it('should treat default ports as equivalent', () => {
+        const patterns = ['https://example.com:443'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+        const httpPatterns = ['http://example.com:80'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com/path', httpPatterns)).to.be.true;
+        const implicitPatterns = ['http://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com:80/path', implicitPatterns)).to.be.true;
+    });
+    it('should match wildcard subdomains', () => {
+        const patterns = ['https://*.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://foo.example.com/path', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://bar.baz.example.com/path', patterns)).to.be.true;
+    });
+    it('should not match the bare domain with a wildcard subdomain pattern', () => {
+        const patterns = ['https://*.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.false;
+    });
+    it('should reject non-http(s) schemes', () => {
+        const patterns = ['file:///etc/passwd'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('file:///etc/passwd', patterns)).to.be.false;
+    });
+    it('should reject ftp scheme', () => {
+        const patterns = ['ftp://files.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('ftp://files.example.com/data', patterns)).to.be.false;
+    });
+    it('should reject a URL when target uses non-http(s) scheme even if patterns exist', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('file:///etc/passwd', patterns)).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('ftp://example.com/data', patterns)).to.be.false;
+    });
+    it('should reject all URLs when allowlist is empty', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://localhost:3000', [])).to.be.false;
+    });
+    it('should reject invalid URLs', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('not a url', patterns)).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('', patterns)).to.be.false;
+    });
+    it('should allow private IPs only when explicitly in the allowlist', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', ['https://example.com'])).to.be.false;
+        const patternsWithLoopback = ['http://127.0.0.1:8080'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', patternsWithLoopback)).to.be.true;
+    });
+    it('should reject cloud metadata endpoint by default', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://169.254.169.254/latest/meta-data/', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://169.254.169.254/latest/meta-data/', ['https://example.com'])).to.be.false;
+    });
+    it('should merge multiple patterns correctly', () => {
+        const patterns = [
+            'https://open-vsx.org',
+            'https://marketplace.example.com',
+            'https://*.cdn.example.com'
+        ];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://open-vsx.org/api/v2/extensions', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://marketplace.example.com/download', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://files.cdn.example.com/ext.vsix', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://evil.com/malware', patterns)).to.be.false;
+    });
+    it('should handle patterns with trailing slashes', () => {
+        const patterns = ['https://example.com/'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+    });
+    it('should handle invalid patterns gracefully', () => {
+        const patterns = ['not a valid pattern', 'https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://other.com/path', patterns)).to.be.false;
+    });
+    it('should prevent host spoofing via subdomain prefix', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com.evil.com/path', patterns)).to.be.false;
+    });
+});
+describe('BackendRequestFacade', () => {
+    describe('configure', () => {
+        let configProviderStub;
+        beforeEach(() => {
+            configProviderStub = sinon.stub(backend_application_config_provider_1.BackendApplicationConfigProvider, 'get');
+        });
+        afterEach(() => {
+            configProviderStub.restore();
+        });
+        it('should be a no-op when configureProxyFromPreferences is false', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: false
+            });
+            const facade = new backend_request_facade_1.BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            facade.requestService = {
+                configure: configureStub
+            };
+            await facade.configure({ proxyUrl: 'http://evil.com', strictSSL: false });
+            (0, chai_1.expect)(configureStub.called).to.be.false;
+        });
+        it('should pass through to the underlying request service when configureProxyFromPreferences is true', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: true
+            });
+            const facade = new backend_request_facade_1.BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            facade.requestService = {
+                configure: configureStub
+            };
+            const config = { proxyUrl: 'http://my-proxy.com:8080', strictSSL: true, proxyAuthorization: 'Bearer token' };
+            await facade.configure(config);
+            (0, chai_1.expect)(configureStub.calledOnce).to.be.true;
+            (0, chai_1.expect)(configureStub.firstCall.args[0]).to.deep.equal(config);
+        });
+    });
+});
+//# sourceMappingURL=backend-request-facade.spec.js.map

package/lib/node/request/backend-request-facade.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-request-facade.spec.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAC9B,+BAA+B;AAC/B,qEAA8E;AAC9E,gGAA0F;AAE1F,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAE1B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,4CAA4C,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACjE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,QAAQ,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC9C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAEtE,MAAM,YAAY,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAEzE,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC1E,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,MAAM,QAAQ,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACtF,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACjE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC5D,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACxD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACtE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAE1F,MAAM,oBAAoB,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACxD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACjF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG;YACb,sBAAsB;YACtB,iCAAiC;YACjC,2BAA2B;SAC9B,CAAC;QACF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACtF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;QAChE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACtE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACpF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAElC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QAEvB,IAAI,kBAAmC,CAAC;QAExC,UAAU,CAAC,GAAG,EAAE;YACZ,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,sEAAgC,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACX,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC3E,kBAAkB,CAAC,OAAO,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,yBAAyB,EAAE,CAAC;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,6BAA6B,EAAE,KAAK;aACvC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,6CAAoB,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,8DAA8D;YAC7D,MAAc,CAAC,cAAc,GAAG;gBAC7B,SAAS,EAAE,aAAa;aAC3B,CAAC;YACF,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAA,aAAM,EAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;YAC9G,kBAAkB,CAAC,OAAO,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,yBAAyB,EAAE,CAAC;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,6BAA6B,EAAE,IAAI;aACtC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,6CAAoB,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,8DAA8D;YAC7D,MAAc,CAAC,cAAc,GAAG;gBAC7B,SAAS,EAAE,aAAa;aAC3B,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC;YAC7G,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAA,aAAM,EAAC,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YAC5C,IAAA,aAAM,EAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}