@theia/core 1.73.0-next.43 → 1.73.0-next.52

package/src/browser/tree/tree-view-welcome-widget.tsx

@@ -209,22 +209,14 @@ export class TreeViewWelcomeWidget extends TreeWidget {
                     className='theia-button theia-WelcomeViewButton'
                     disabled={!this.isEnabledClick(enablement)}
                     onClick={e => this.openLinkOrCommand(e, node.href)}>
-                    {node.label}
+                    {this.renderLabelWithIcons(node.label)}
                 </button>
             </div>
         );
     }
 
     protected renderTextNode(node: string, textKey: string | number): React.ReactNode {
-        return <span key={`text-${textKey}`}>
-            {this.labelParser.parse(node)
-                .map((segment, index) =>
-                    LabelIcon.is(segment)
-                        ? <span
-                            key={index}
-                            className={codicon(segment.name)}
-                        />
-                        : <span key={index}>{segment}</span>)}</span>;
+        return <span key={`text-${textKey}`}>{this.renderLabelWithIcons(node)}</span>;
     }
 
     protected renderLinkNode(node: ILink, linkKey: string | number, enablement: string | undefined): React.ReactNode {
@@ -233,11 +225,18 @@ export class TreeViewWelcomeWidget extends TreeWidget {
                 className={this.getLinkClassName(node.href, enablement)}
                 title={node.title || ''}
                 onClick={e => this.openLinkOrCommand(e, node.href)}>
-                {node.label}
+                {this.renderLabelWithIcons(node.label)}
             </a>
         );
     }
 
+    protected renderLabelWithIcons(label: string): React.ReactNode[] {
+        return this.labelParser.parse(label).map((segment, index) =>
+            LabelIcon.is(segment)
+                ? <span key={index} className={codicon(segment.name)} />
+                : <span key={index}>{segment}</span>);
+    }
+
     protected getLinkClassName(href: string, enablement: string | undefined): string {
         const classNames = ['theia-WelcomeViewCommandLink'];
         // Only command-backed links can be disabled. All other, https:, file: remain enabled

package/src/electron-node/hosting/electron-ws-origin-validator.spec.ts

@@ -0,0 +1,69 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import { ElectronWsOriginValidator } from './electron-ws-origin-validator';
+import { BackendRemoteService } from '../../node/remote/backend-remote-service';
+
+describe('ElectronWsOriginValidator', () => {
+
+    function createValidator(isRemote = false): ElectronWsOriginValidator {
+        const remoteService = { isRemoteServer: () => isRemote } as BackendRemoteService;
+        const validator = new ElectronWsOriginValidator();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (validator as any)['backendRemoteService'] = remoteService;
+        return validator;
+    }
+
+    function createRequest(origin?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        return request;
+    }
+
+    it('should allow file:// origin (standard Electron case)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('file://'))).to.be.true;
+    });
+
+    it('should allow null origin (opaque origin from file:// pages)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('null'))).to.be.true;
+    });
+
+    it('should allow absent origin (same-origin polling requests)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest(undefined))).to.be.true;
+    });
+
+    it('should reject cross-origin requests', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('http://evil.com'))).to.be.false;
+    });
+
+    it('should reject http://localhost origin (not expected in Electron)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('http://localhost:3000'))).to.be.false;
+    });
+
+    it('should allow empty string origin (treated as absent)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest(''))).to.be.true;
+    });
+
+    it('should allow any origin when running as remote server', () => {
+        expect(createValidator(true).allowWsUpgrade(createRequest('http://remote-host.com'))).to.be.true;
+    });
+});

package/src/electron-node/hosting/electron-ws-origin-validator.ts

@@ -30,8 +30,11 @@ export class ElectronWsOriginValidator implements WsRequestValidatorContribution
         if (this.backendRemoteService.isRemoteServer()) {
             return true;
         }
+        const origin = request.headers.origin;
         // On Electron the main page is served from the `file` protocol.
-        // We don't expect the requests to come from anywhere else.
-        return request.headers.origin === 'file://';
+        // Chromium may send "file://" or "null" (opaque origin) or omit the
+        // header entirely depending on the request type (WebSocket upgrade vs
+        // HTTP polling). All three are expected for same-origin Electron requests.
+        return !origin || origin === 'file://' || origin === 'null';
     }
 }

package/src/node/backend-application-module.ts

@@ -36,7 +36,7 @@ import {
 } from '../common';
 import {
     BackendApplication, BackendApplicationContribution, BackendApplicationCliContribution,
-    BackendApplicationServer, BackendApplicationPath, RootContainer
+    BackendApplicationServer, BackendApplicationPath, EarlyExpressMiddleware, RootContainer
 } from './backend-application';
 import { CliManager, CliContribution } from './cli';
 import { IPCConnectionProvider } from './messaging';
@@ -55,7 +55,7 @@ import { ProcessUtils } from './process-utils';
 import { ProxyCliContribution } from './request/proxy-cli-contribution';
 import { bindNodeStopwatch, bindBackendStopwatchServer } from './performance';
 import { OSBackendProviderImpl } from './os-backend-provider';
-import { BackendRequestFacade } from './request/backend-request-facade';
+import { BackendRequestFacade, BackendRequestAllowedContribution } from './request/backend-request-facade';
 import { FileSystemLocking, FileSystemLockingImpl } from './filesystem-locking';
 import { BackendRemoteService } from './remote/backend-remote-service';
 import { RemoteCliContribution } from './remote/remote-cli-contribution';
@@ -89,6 +89,7 @@ export const backendApplicationModule = new ContainerModule(bind => {
     bind(BackendApplicationCliContribution).toSelf().inSingletonScope();
     bind(CliContribution).toService(BackendApplicationCliContribution);
 
+    bind(EarlyExpressMiddleware).toSelf().inSingletonScope();
     bind(BackendApplication).toSelf().inSingletonScope();
     bind(RootContainer).toDynamicValue(({ container }) => {
         let root = container;
@@ -152,6 +153,7 @@ export const backendApplicationModule = new ContainerModule(bind => {
 
     bindRootContributionProvider(bind, RemoteCliContribution);
     bind(BackendRemoteService).toSelf().inSingletonScope();
+    bindRootContributionProvider(bind, BackendRequestAllowedContribution);
     bind(BackendRequestFacade).toSelf().inSingletonScope();
     bind(ConnectionHandler).toDynamicValue(
         ctx => new RpcConnectionHandler(REQUEST_SERVICE_PATH, () => ctx.container.get(BackendRequestFacade))

package/src/node/backend-application.spec.ts

@@ -25,6 +25,7 @@ import {
     BackendApplication,
     BackendApplicationCliContribution,
     BackendApplicationContribution,
+    EarlyExpressMiddleware,
     RootContainer
 } from './backend-application';
 import { CliContribution } from './cli';
@@ -87,6 +88,7 @@ describe('BackendApplication', () => {
         container.bind(ProcessUtils).toSelf().inSingletonScope();
         container.bind(BackendApplicationCliContribution).toSelf().inSingletonScope();
         container.bind(CliContribution).toService(BackendApplicationCliContribution);
+        container.bind(EarlyExpressMiddleware).toSelf().inSingletonScope();
         bindContributionProvider(container, BackendApplicationContribution);
 
         container.bind(TestBackendApplication).toSelf().inSingletonScope();

package/src/node/backend-application.ts

@@ -54,6 +54,16 @@ const DEFAULT_HOST = 'localhost';
 const DEFAULT_SSL = false;
 const DEFAULT_DNS_DEFAULT_RESULT_ORDER: DnsResultOrder = 'ipv4first';
 
+/**
+ * Shared registry for Express middleware that must run before static file handlers.
+ * Contributions push handlers during `initialize()`, and `BackendApplication`
+ * applies them at the start of `configure()`, before gzipped handlers and `express.static()`.
+ */
+@injectable()
+export class EarlyExpressMiddleware {
+    readonly handlers: express.Handler[] = [];
+}
+
 export const BackendApplicationServer = Symbol('BackendApplicationServer');
 /**
  * This service is responsible for serving the frontend files.
@@ -175,6 +185,9 @@ export class BackendApplication {
 
     protected readonly app: express.Application = express();
 
+    @inject(EarlyExpressMiddleware)
+    protected readonly earlyMiddleware: EarlyExpressMiddleware;
+
     @inject(ProcessUtils)
     protected readonly processUtils: ProcessUtils;
 
@@ -244,6 +257,11 @@ export class BackendApplication {
     protected async configure(): Promise<void> {
         await this.initialize();
 
+        // Apply early middleware before static file handlers.
+        for (const handler of this.earlyMiddleware.handlers) {
+            this.app.use(handler);
+        }
+
         this.app.get('*.js', this.serveGzipped.bind(this, 'text/javascript'));
         this.app.get('*.js.map', this.serveGzipped.bind(this, 'application/json'));
         this.app.get('*.css', this.serveGzipped.bind(this, 'text/css'));

package/src/node/hosting/backend-hosting-module.ts

@@ -15,12 +15,22 @@
 // *****************************************************************************
 
 import { ContainerModule } from 'inversify';
+import { BackendApplicationContribution } from '../backend-application';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
+import {
+    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, createBrowserConnectionToken
+} from './browser-connection-token';
 import { WsOriginValidator } from './ws-origin-validator';
 
 export default new ContainerModule(bind => {
     bind(BackendApplicationHosts).toSelf().inSingletonScope();
     bind(WsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(WsOriginValidator);
+
+    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    bind(BrowserConnectionToken).toConstantValue(createBrowserConnectionToken());
+    bind(BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
+    bind(BackendApplicationContribution).toService(BrowserConnectionTokenBackendContribution);
+    bind(WsRequestValidatorContribution).toService(BrowserConnectionTokenBackendContribution);
 });

package/src/node/hosting/browser-connection-token.spec.ts

@@ -0,0 +1,167 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import {
+    BrowserConnectionToken,
+    BrowserConnectionTokenBackendContribution,
+    BROWSER_TOKEN_COOKIE_NAME,
+    createBrowserConnectionToken
+} from './browser-connection-token';
+
+describe('BrowserConnectionToken', () => {
+
+    it('should generate unique tokens', () => {
+        const token1 = createBrowserConnectionToken();
+        const token2 = createBrowserConnectionToken();
+        expect(token1.value).to.not.equal(token2.value);
+    });
+
+    it('should generate tokens of sufficient length', () => {
+        const token = createBrowserConnectionToken();
+        expect(token.value.length).to.be.greaterThan(16);
+    });
+});
+
+describe('BrowserConnectionTokenBackendContribution', () => {
+
+    const token: BrowserConnectionToken = createBrowserConnectionToken();
+
+    function createContribution(): BrowserConnectionTokenBackendContribution {
+        const contribution = new BrowserConnectionTokenBackendContribution();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (contribution as any)['browserConnectionToken'] = token;
+        return contribution;
+    }
+
+    function createRequest(cookieValue?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (cookieValue !== undefined) {
+            request.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+        }
+        return request;
+    }
+
+    describe('allowWsUpgrade (WebSocket validation)', () => {
+
+        it('should allow WebSocket with valid token cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest(token.value))).to.be.true;
+        });
+
+        it('should reject WebSocket with no cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest())).to.be.false;
+        });
+
+        it('should reject WebSocket with invalid token', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest('wrong-token'))).to.be.false;
+        });
+
+        it('should reject WebSocket with stale token from previous server', () => {
+            const contribution = createContribution();
+            const staleToken = createBrowserConnectionToken().value;
+            expect(contribution.allowWsUpgrade(createRequest(staleToken))).to.be.false;
+        });
+
+        it('should reject WebSocket with empty token', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest(''))).to.be.false;
+        });
+
+        it('should handle multiple cookies correctly', () => {
+            const contribution = createContribution();
+            const request = {
+                headers: {
+                    cookie: `other-cookie=foo; ${BROWSER_TOKEN_COOKIE_NAME}=${token.value}; another=bar`
+                } as http.IncomingHttpHeaders
+            } as http.IncomingMessage;
+            expect(contribution.allowWsUpgrade(request)).to.be.true;
+        });
+    });
+
+    describe('expressMiddleware (HTTP cookie flow)', () => {
+
+        interface CookieCall {
+            name: string;
+            value: string;
+            options: Record<string, unknown>;
+        }
+
+        interface MockResponse {
+            cookieCalls: CookieCall[];
+            nextCalled: boolean;
+        }
+
+        function callMiddleware(cookieValue?: string): MockResponse {
+            const contribution = createContribution();
+            const result: MockResponse = { cookieCalls: [], nextCalled: false };
+
+            const req = {
+                headers: {} as Record<string, string | undefined>,
+                socket: { remoteAddress: '127.0.0.1' }
+            };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+
+            const res = {
+                cookie: (name: string, value: string, options: Record<string, unknown>) => {
+                    result.cookieCalls.push({ name, value, options });
+                }
+            };
+
+            const next = (): void => { result.nextCalled = true; };
+
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).expressMiddleware(req, res, next);
+            return result;
+        }
+
+        it('should set cookie and allow request when no cookie present', () => {
+            const result = callMiddleware();
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(1);
+            expect(result.cookieCalls[0].name).to.equal(BROWSER_TOKEN_COOKIE_NAME);
+            expect(result.cookieCalls[0].value).to.equal(token.value);
+        });
+
+        it('should set cookie with HttpOnly, SameSite=Strict, and path=/', () => {
+            const result = callMiddleware();
+            const opts = result.cookieCalls[0].options;
+            expect(opts.httpOnly).to.be.true;
+            expect(opts.sameSite).to.equal('strict');
+            expect(opts.path).to.equal('/');
+        });
+
+        it('should allow request with valid cookie without re-setting it', () => {
+            const result = callMiddleware(token.value);
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(0);
+        });
+
+        it('should refresh stale cookie and allow request', () => {
+            const result = callMiddleware('stale-token-from-old-server');
+            expect(result.nextCalled).to.be.true;
+            expect(result.cookieCalls).to.have.length(1);
+            expect(result.cookieCalls[0].value).to.equal(token.value);
+        });
+    });
+});

package/src/node/hosting/browser-connection-token.ts

@@ -0,0 +1,126 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import * as cookie from 'cookie';
+import * as crypto from 'crypto';
+import * as http from 'http';
+import express = require('express');
+import { inject, injectable } from 'inversify';
+import { environment } from '../../common/index';
+import { MaybePromise } from '../../common';
+import { BackendApplicationContribution, EarlyExpressMiddleware } from '../backend-application';
+import { WsRequestValidatorContribution } from '../ws-request-validators';
+import { generateUuid } from '../../common/uuid';
+
+export const BrowserConnectionToken = Symbol('BrowserConnectionToken');
+
+export const BROWSER_TOKEN_COOKIE_NAME = 'theia-connection-token';
+
+export interface BrowserConnectionToken {
+    value: string;
+}
+
+/**
+ * Validates WebSocket and HTTP requests using a cookie-based connection token.
+ *
+ * In browser deployments, the server generates a random token at startup and sets it
+ * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
+ * cannot obtain or send this cookie, so their requests are rejected.
+ *
+ * This complements the origin validator: non-browser callers that omit the Origin
+ * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
+ *
+ * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
+ */
+@injectable()
+export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+
+    @inject(BrowserConnectionToken)
+    protected readonly browserConnectionToken: BrowserConnectionToken;
+
+    @inject(EarlyExpressMiddleware)
+    protected readonly earlyMiddleware: EarlyExpressMiddleware;
+
+    /**
+     * Register the cookie middleware during `initialize()` via `EarlyExpressMiddleware`
+     * so it runs before `express.static()` (which is registered later during `configure()`).
+     * This ensures the browser receives the token cookie on the initial page load.
+     */
+    initialize(): void {
+        if (environment.electron.is()) {
+            return;
+        }
+        this.earlyMiddleware.handlers.push((req, res, next) => this.expressMiddleware(req, res, next));
+    }
+
+    /**
+     * Validate the connection token cookie on WebSocket upgrade requests.
+     * Non-browser callers that omit the Origin header (e.g. Node.js scripts)
+     * cannot provide the `SameSite=Strict` cookie either, so they are rejected.
+     */
+    allowWsUpgrade(request: http.IncomingMessage): MaybePromise<boolean> {
+        if (environment.electron.is()) {
+            return true;
+        }
+        const token = this.getTokenFromCookie(request);
+        if (token) {
+            return this.isTokenValid(token);
+        }
+        // No cookie: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load.
+        return false;
+    }
+
+    protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void {
+        const existing = this.getTokenFromCookie(req);
+        if (!existing || !this.isTokenValid(existing)) {
+            // No cookie or stale cookie (e.g. after server restart) so (re-)issue it.
+            // The browser will use the fresh token on subsequent requests.
+            res.cookie(BROWSER_TOKEN_COOKIE_NAME, this.browserConnectionToken.value, {
+                httpOnly: true,
+                sameSite: 'strict',
+                path: '/'
+            });
+        }
+        next();
+    }
+
+    protected getTokenFromCookie(req: http.IncomingMessage): string | undefined {
+        const cookieHeader = req.headers.cookie;
+        if (cookieHeader) {
+            return cookie.parse(cookieHeader)[BROWSER_TOKEN_COOKIE_NAME];
+        }
+        return undefined;
+    }
+
+    protected isTokenValid(token: string): boolean {
+        try {
+            const received = Buffer.from(token, 'utf8');
+            const expected = Buffer.from(this.browserConnectionToken.value, 'utf8');
+            return received.byteLength === expected.byteLength && crypto.timingSafeEqual(received, expected);
+        } catch (error) {
+            console.error(error);
+        }
+        return false;
+    }
+}
+
+/**
+ * Creates a new browser connection token.
+ */
+export function createBrowserConnectionToken(): BrowserConnectionToken {
+    return { value: generateUuid() };
+}