@theia/core 1.73.0-next.40 → 1.73.0-next.51

package/src/node/request/backend-request-facade.ts

@@ -14,8 +14,87 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 
-import { inject, injectable } from 'inversify';
+import { inject, injectable, named, optional } from 'inversify';
 import { RequestConfiguration, RequestContext, RequestOptions, RequestService } from '@theia/request';
+import { ContributionProvider, MaybePromise } from '../../common';
+import { BackendApplicationConfigProvider } from '../backend-application-config-provider';
+
+export const BackendRequestAllowedContribution = Symbol('BackendRequestAllowedContribution');
+export interface BackendRequestAllowedContribution {
+    /**
+     * Returns URL patterns that should be allowed through the backend request facade.
+     * Patterns are matched against request URLs.
+     *
+     * Supports:
+     * - Exact base URLs: `https://open-vsx.org` (allows any path under this origin)
+     * - Wildcard subdomains: `https://*.github.com` (allows any subdomain)
+     *
+     * Only `http:` and `https:` schemes are permitted.
+     */
+    getAllowedUrlPatterns(): MaybePromise<string[]>;
+}
+
+const ALLOWED_SCHEMES = new Set(['http:', 'https:']);
+
+export function isUrlAllowed(url: string, allowedPatterns: string[]): boolean {
+    let parsed: URL;
+    try {
+        parsed = new URL(url);
+    } catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+        return false;
+    }
+    for (const pattern of allowedPatterns) {
+        if (matchesPattern(parsed, pattern)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+function matchesPattern(target: URL, pattern: string): boolean {
+    let patternUrl: URL;
+    try {
+        patternUrl = new URL(pattern);
+    } catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(patternUrl.protocol)) {
+        return false;
+    }
+    if (target.protocol !== patternUrl.protocol) {
+        return false;
+    }
+    const targetPort = getEffectivePort(target);
+    const patternPort = getEffectivePort(patternUrl);
+    if (targetPort !== patternPort) {
+        return false;
+    }
+    return matchesHost(target.hostname, patternUrl.hostname);
+}
+
+function getEffectivePort(url: URL): string {
+    if (url.port) {
+        return url.port;
+    }
+    if (url.protocol === 'https:') {
+        return '443';
+    }
+    if (url.protocol === 'http:') {
+        return '80';
+    }
+    return '';
+}
+
+function matchesHost(targetHost: string, patternHost: string): boolean {
+    if (patternHost.startsWith('*.')) {
+        const suffix = patternHost.substring(1); // e.g. ".example.com"
+        return targetHost.endsWith(suffix) && targetHost.length > suffix.length;
+    }
+    return targetHost === patternHost;
+}
 
 @injectable()
 export class BackendRequestFacade implements RequestService {
@@ -23,11 +102,23 @@ export class BackendRequestFacade implements RequestService {
     @inject(RequestService)
     protected readonly requestService: RequestService;
 
-    configure(config: RequestConfiguration): Promise<void> {
-        return this.requestService.configure(config);
+    @inject(ContributionProvider) @named(BackendRequestAllowedContribution) @optional()
+    protected readonly allowedContributions?: ContributionProvider<BackendRequestAllowedContribution>;
+
+    protected cachedAllowedPatterns: string[] | undefined;
+
+    async configure(config: RequestConfiguration): Promise<void> {
+        if (BackendApplicationConfigProvider.get().configureProxyFromPreferences) {
+            return this.requestService.configure(config);
+        }
     }
 
     async request(options: RequestOptions): Promise<RequestContext> {
+        const patterns = await this.getAllowedPatterns();
+        const url = options.url;
+        if (!url || !isUrlAllowed(url, patterns)) {
+            throw new Error(`Request to URL '${url}' is not allowed. The URL does not match any allowed pattern.`);
+        }
         const context = await this.requestService.request(options);
         return RequestContext.compress(context);
     }
@@ -36,4 +127,18 @@ export class BackendRequestFacade implements RequestService {
         return this.requestService.resolveProxy(url);
     }
 
+    protected async getAllowedPatterns(): Promise<string[]> {
+        if (this.cachedAllowedPatterns) {
+            return this.cachedAllowedPatterns;
+        }
+        const patterns: string[] = [];
+        if (this.allowedContributions) {
+            for (const contribution of this.allowedContributions.getContributions()) {
+                const contributed = await contribution.getAllowedUrlPatterns();
+                patterns.push(...contributed);
+            }
+        }
+        this.cachedAllowedPatterns = patterns;
+        return patterns;
+    }
 }