@theia/core 1.73.0-next.43 → 1.73.0-next.52

package/src/node/hosting/ws-origin-validator.spec.ts

@@ -0,0 +1,193 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import { WsOriginValidator } from './ws-origin-validator';
+import { BackendApplicationHosts } from './backend-application-hosts';
+
+describe('WsOriginValidator', () => {
+
+    function createValidator(hosts?: string[]): WsOriginValidator {
+        const backendHosts = new BackendApplicationHosts();
+        if (hosts) {
+            for (const h of hosts) {
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                (backendHosts as any)['_hosts'].add(h);
+            }
+        }
+        const validator = new WsOriginValidator();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (validator as any)['backendApplicationHosts'] = backendHosts;
+        return validator;
+    }
+
+    function createRequest(origin?: string, host?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        if (host !== undefined) {
+            request.headers.host = host;
+        }
+        return request;
+    }
+
+    describe('when THEIA_HOSTS is not set', () => {
+
+        it('should allow same-origin requests', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:3000', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should allow same-origin requests on default ports', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com', 'myhost.com')
+            )).to.be.true;
+        });
+
+        it('should reject cross-origin requests', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://evil.com', 'localhost:3000')
+            )).to.be.false;
+        });
+
+        it('should allow requests with no Origin header (same-origin polling)', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest(undefined, 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should reject requests with no Host header when Origin is present', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:3000', undefined)
+            )).to.be.false;
+        });
+
+        it('should reject requests with malformed Origin', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('not-a-valid-url', 'localhost:3000')
+            )).to.be.false;
+        });
+    });
+
+    describe('when THEIA_HOSTS is set', () => {
+
+        it('should allow requests from a listed host', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com', 'myhost.com')
+            )).to.be.true;
+        });
+
+        it('should allow requests from a listed host with port', () => {
+            const validator = createValidator(['myhost.com:8080']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com:8080', 'myhost.com:8080')
+            )).to.be.true;
+        });
+
+        it('should reject requests from an unlisted host', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://evil.com', 'myhost.com')
+            )).to.be.false;
+        });
+
+        it('should allow requests with no Origin header (same-origin polling)', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest(undefined, 'myhost.com')
+            )).to.be.true;
+        });
+
+        it('should allow when origin host is in the allowlist regardless of Host header', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('http://myhost.com', 'internal-host:3000')
+            )).to.be.true;
+        });
+
+        it('should reject malformed Origin even with THEIA_HOSTS', () => {
+            const validator = createValidator(['myhost.com']);
+            expect(validator.allowWsUpgrade(
+                createRequest('not-a-valid-url', 'myhost.com')
+            )).to.be.false;
+        });
+    });
+
+    describe('edge cases', () => {
+
+        it('should reject cross-origin with port mismatch', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:4000', 'localhost:3000')
+            )).to.be.false;
+        });
+
+        it('should handle HTTPS origins', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('https://localhost:3000', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should reject Origin: null (opaque origin from sandboxed pages)', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('null', 'localhost:3000')
+            )).to.be.false;
+        });
+
+        it('should allow empty Origin string (treated as absent)', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should handle IPv6 same-origin', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://[::1]:3000', '[::1]:3000')
+            )).to.be.true;
+        });
+
+        it('should strip credentials from Origin when comparing', () => {
+            const validator = createValidator();
+            // new URL('http://user:pass@localhost:3000').host === 'localhost:3000'
+            expect(validator.allowWsUpgrade(
+                createRequest('http://user:pass@localhost:3000', 'localhost:3000')
+            )).to.be.true;
+        });
+
+        it('should ignore path component in Origin', () => {
+            const validator = createValidator();
+            expect(validator.allowWsUpgrade(
+                createRequest('http://localhost:3000/some/path', 'localhost:3000')
+            )).to.be.true;
+        });
+    });
+});

package/src/node/hosting/ws-origin-validator.ts

@@ -16,7 +16,6 @@
 
 import * as http from 'http';
 import { inject, injectable } from 'inversify';
-import * as url from 'url';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
 
@@ -27,10 +26,30 @@ export class WsOriginValidator implements WsRequestValidatorContribution {
     protected readonly backendApplicationHosts: BackendApplicationHosts;
 
     allowWsUpgrade(request: http.IncomingMessage): boolean {
-        if (!this.backendApplicationHosts.hasKnownHosts() || !request.headers.origin) {
+        if (!request.headers.origin) {
+            // Browsers omit the Origin header for same-origin requests (e.g. Socket.IO polling).
+            // Absent Origin is safe: cross-origin browser requests always include it.
             return true;
         }
-        const origin = url.parse(request.headers.origin);
-        return this.backendApplicationHosts.hosts.has(origin.host!);
+
+        let originHost: string;
+        try {
+            originHost = new URL(request.headers.origin).host;
+        } catch {
+            return false;
+        }
+
+        if (this.backendApplicationHosts.hasKnownHosts()) {
+            // When THEIA_HOSTS is configured, validate against the explicit allowlist.
+            return this.backendApplicationHosts.hosts.has(originHost);
+        }
+
+        // When THEIA_HOSTS is not configured (the common development/default case),
+        // enforce same-origin: the Origin's host must match the request's Host header.
+        const hostHeader = request.headers.host;
+        if (!hostHeader) {
+            return false;
+        }
+        return originHost === hostHeader;
     }
 }

package/src/node/index.ts

@@ -22,3 +22,4 @@ export * from './messaging';
 export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
+export { BackendRequestAllowedContribution } from './request/backend-request-facade';

package/src/node/messaging/websocket-endpoint.ts

@@ -48,14 +48,21 @@ export class WebsocketEndpoint implements BackendApplicationContribution {
         const socketServer = new Server(server, {
             pingInterval: this.checkAliveTimeout,
             pingTimeout: this.checkAliveTimeout * 2,
-            maxHttpBufferSize: this.maxHttpBufferSize
+            maxHttpBufferSize: this.maxHttpBufferSize,
+            allowRequest: (req, callback) => {
+                // eslint-disable-next-line no-null/no-null
+                const noError = null;
+                this.wsRequestValidator.allowWsUpgrade(req).then(
+                    allowed => callback(noError, allowed),
+                    error => {
+                        console.error('Error during WebSocket allowRequest validation:', error);
+                        callback(error?.message ?? 'Validation error', false);
+                    }
+                );
+            }
         });
         // Accept every namespace by using /.*/
         socketServer.of(/.*/).on('connection', async socket => {
-            const request = socket.request;
-            // Socket.io strips the `origin` header of the incoming request
-            // We provide a `fix-origin` header in the `WebSocketConnectionProvider`
-            request.headers.origin = request.headers['fix-origin'] as string;
             if (await this.allowConnect(socket.request)) {
                 await this.handleConnection(socket);
                 this.messagingListener.onDidWebSocketUpgrade(socket.request, socket);
@@ -65,6 +72,11 @@ export class WebsocketEndpoint implements BackendApplicationContribution {
         });
     }
 
+    /**
+     * Secondary validation after connection. The primary check happens in the
+     * Socket.IO `allowRequest` callback at handshake time; this is kept as
+     * defense-in-depth in case a Socket.IO upgrade path bypasses `allowRequest`.
+     */
     protected async allowConnect(request: http.IncomingMessage): Promise<boolean> {
         try {
             return this.wsRequestValidator.allowWsUpgrade(request);

package/src/node/request/backend-request-facade.spec.ts

@@ -0,0 +1,203 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as sinon from 'sinon';
+import { BackendRequestFacade, isUrlAllowed } from './backend-request-facade';
+import { BackendApplicationConfigProvider } from '../backend-application-config-provider';
+
+describe('isUrlAllowed', () => {
+
+    it('should allow a URL that matches an exact origin pattern', () => {
+        const patterns = ['https://open-vsx.org'];
+        expect(isUrlAllowed('https://open-vsx.org/api/extensions', patterns)).to.be.true;
+    });
+
+    it('should allow a URL with a path when pattern has no path', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com/some/deep/path?query=1', patterns)).to.be.true;
+    });
+
+    it('should allow a URL that exactly matches the origin', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com', patterns)).to.be.true;
+        expect(isUrlAllowed('https://example.com/', patterns)).to.be.true;
+    });
+
+    it('should reject a URL with a different scheme', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('http://example.com/path', patterns)).to.be.false;
+    });
+
+    it('should reject a URL with a different host', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://evil.com/path', patterns)).to.be.false;
+    });
+
+    it('should reject a URL with a different port', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com:8443/path', patterns)).to.be.false;
+    });
+
+    it('should allow a URL when port matches explicitly', () => {
+        const patterns = ['https://example.com:8443'];
+        expect(isUrlAllowed('https://example.com:8443/path', patterns)).to.be.true;
+    });
+
+    it('should treat default ports as equivalent', () => {
+        const patterns = ['https://example.com:443'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.true;
+
+        const httpPatterns = ['http://example.com:80'];
+        expect(isUrlAllowed('http://example.com/path', httpPatterns)).to.be.true;
+
+        const implicitPatterns = ['http://example.com'];
+        expect(isUrlAllowed('http://example.com:80/path', implicitPatterns)).to.be.true;
+    });
+
+    it('should match wildcard subdomains', () => {
+        const patterns = ['https://*.example.com'];
+        expect(isUrlAllowed('https://foo.example.com/path', patterns)).to.be.true;
+        expect(isUrlAllowed('https://bar.baz.example.com/path', patterns)).to.be.true;
+    });
+
+    it('should not match the bare domain with a wildcard subdomain pattern', () => {
+        const patterns = ['https://*.example.com'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.false;
+    });
+
+    it('should reject non-http(s) schemes', () => {
+        const patterns = ['file:///etc/passwd'];
+        expect(isUrlAllowed('file:///etc/passwd', patterns)).to.be.false;
+    });
+
+    it('should reject ftp scheme', () => {
+        const patterns = ['ftp://files.example.com'];
+        expect(isUrlAllowed('ftp://files.example.com/data', patterns)).to.be.false;
+    });
+
+    it('should reject a URL when target uses non-http(s) scheme even if patterns exist', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('file:///etc/passwd', patterns)).to.be.false;
+        expect(isUrlAllowed('ftp://example.com/data', patterns)).to.be.false;
+    });
+
+    it('should reject all URLs when allowlist is empty', () => {
+        expect(isUrlAllowed('https://example.com', [])).to.be.false;
+        expect(isUrlAllowed('http://localhost:3000', [])).to.be.false;
+    });
+
+    it('should reject invalid URLs', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('not a url', patterns)).to.be.false;
+        expect(isUrlAllowed('', patterns)).to.be.false;
+    });
+
+    it('should allow private IPs only when explicitly in the allowlist', () => {
+        expect(isUrlAllowed('http://127.0.0.1:8080/secret', [])).to.be.false;
+        expect(isUrlAllowed('http://127.0.0.1:8080/secret', ['https://example.com'])).to.be.false;
+
+        const patternsWithLoopback = ['http://127.0.0.1:8080'];
+        expect(isUrlAllowed('http://127.0.0.1:8080/secret', patternsWithLoopback)).to.be.true;
+    });
+
+    it('should reject cloud metadata endpoint by default', () => {
+        expect(isUrlAllowed('http://169.254.169.254/latest/meta-data/', [])).to.be.false;
+        expect(isUrlAllowed('http://169.254.169.254/latest/meta-data/', ['https://example.com'])).to.be.false;
+    });
+
+    it('should merge multiple patterns correctly', () => {
+        const patterns = [
+            'https://open-vsx.org',
+            'https://marketplace.example.com',
+            'https://*.cdn.example.com'
+        ];
+        expect(isUrlAllowed('https://open-vsx.org/api/v2/extensions', patterns)).to.be.true;
+        expect(isUrlAllowed('https://marketplace.example.com/download', patterns)).to.be.true;
+        expect(isUrlAllowed('https://files.cdn.example.com/ext.vsix', patterns)).to.be.true;
+        expect(isUrlAllowed('https://evil.com/malware', patterns)).to.be.false;
+    });
+
+    it('should handle patterns with trailing slashes', () => {
+        const patterns = ['https://example.com/'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.true;
+    });
+
+    it('should handle invalid patterns gracefully', () => {
+        const patterns = ['not a valid pattern', 'https://example.com'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.true;
+        expect(isUrlAllowed('https://other.com/path', patterns)).to.be.false;
+    });
+
+    it('should prevent host spoofing via subdomain prefix', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com.evil.com/path', patterns)).to.be.false;
+    });
+});
+
+describe('BackendRequestFacade', () => {
+
+    describe('configure', () => {
+
+        let configProviderStub: sinon.SinonStub;
+
+        beforeEach(() => {
+            configProviderStub = sinon.stub(BackendApplicationConfigProvider, 'get');
+        });
+
+        afterEach(() => {
+            configProviderStub.restore();
+        });
+
+        it('should be a no-op when configureProxyFromPreferences is false', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: false
+            });
+
+            const facade = new BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (facade as any).requestService = {
+                configure: configureStub
+            };
+            await facade.configure({ proxyUrl: 'http://evil.com', strictSSL: false });
+            expect(configureStub.called).to.be.false;
+        });
+
+        it('should pass through to the underlying request service when configureProxyFromPreferences is true', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: true
+            });
+
+            const facade = new BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (facade as any).requestService = {
+                configure: configureStub
+            };
+            const config = { proxyUrl: 'http://my-proxy.com:8080', strictSSL: true, proxyAuthorization: 'Bearer token' };
+            await facade.configure(config);
+            expect(configureStub.calledOnce).to.be.true;
+            expect(configureStub.firstCall.args[0]).to.deep.equal(config);
+        });
+    });
+});

package/src/node/request/backend-request-facade.ts

@@ -14,8 +14,87 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 
-import { inject, injectable } from 'inversify';
+import { inject, injectable, named, optional } from 'inversify';
 import { RequestConfiguration, RequestContext, RequestOptions, RequestService } from '@theia/request';
+import { ContributionProvider, MaybePromise } from '../../common';
+import { BackendApplicationConfigProvider } from '../backend-application-config-provider';
+
+export const BackendRequestAllowedContribution = Symbol('BackendRequestAllowedContribution');
+export interface BackendRequestAllowedContribution {
+    /**
+     * Returns URL patterns that should be allowed through the backend request facade.
+     * Patterns are matched against request URLs.
+     *
+     * Supports:
+     * - Exact base URLs: `https://open-vsx.org` (allows any path under this origin)
+     * - Wildcard subdomains: `https://*.github.com` (allows any subdomain)
+     *
+     * Only `http:` and `https:` schemes are permitted.
+     */
+    getAllowedUrlPatterns(): MaybePromise<string[]>;
+}
+
+const ALLOWED_SCHEMES = new Set(['http:', 'https:']);
+
+export function isUrlAllowed(url: string, allowedPatterns: string[]): boolean {
+    let parsed: URL;
+    try {
+        parsed = new URL(url);
+    } catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+        return false;
+    }
+    for (const pattern of allowedPatterns) {
+        if (matchesPattern(parsed, pattern)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+function matchesPattern(target: URL, pattern: string): boolean {
+    let patternUrl: URL;
+    try {
+        patternUrl = new URL(pattern);
+    } catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(patternUrl.protocol)) {
+        return false;
+    }
+    if (target.protocol !== patternUrl.protocol) {
+        return false;
+    }
+    const targetPort = getEffectivePort(target);
+    const patternPort = getEffectivePort(patternUrl);
+    if (targetPort !== patternPort) {
+        return false;
+    }
+    return matchesHost(target.hostname, patternUrl.hostname);
+}
+
+function getEffectivePort(url: URL): string {
+    if (url.port) {
+        return url.port;
+    }
+    if (url.protocol === 'https:') {
+        return '443';
+    }
+    if (url.protocol === 'http:') {
+        return '80';
+    }
+    return '';
+}
+
+function matchesHost(targetHost: string, patternHost: string): boolean {
+    if (patternHost.startsWith('*.')) {
+        const suffix = patternHost.substring(1); // e.g. ".example.com"
+        return targetHost.endsWith(suffix) && targetHost.length > suffix.length;
+    }
+    return targetHost === patternHost;
+}
 
 @injectable()
 export class BackendRequestFacade implements RequestService {
@@ -23,11 +102,23 @@ export class BackendRequestFacade implements RequestService {
     @inject(RequestService)
     protected readonly requestService: RequestService;
 
-    configure(config: RequestConfiguration): Promise<void> {
-        return this.requestService.configure(config);
+    @inject(ContributionProvider) @named(BackendRequestAllowedContribution) @optional()
+    protected readonly allowedContributions?: ContributionProvider<BackendRequestAllowedContribution>;
+
+    protected cachedAllowedPatterns: string[] | undefined;
+
+    async configure(config: RequestConfiguration): Promise<void> {
+        if (BackendApplicationConfigProvider.get().configureProxyFromPreferences) {
+            return this.requestService.configure(config);
+        }
     }
 
     async request(options: RequestOptions): Promise<RequestContext> {
+        const patterns = await this.getAllowedPatterns();
+        const url = options.url;
+        if (!url || !isUrlAllowed(url, patterns)) {
+            throw new Error(`Request to URL '${url}' is not allowed. The URL does not match any allowed pattern.`);
+        }
         const context = await this.requestService.request(options);
         return RequestContext.compress(context);
     }
@@ -36,4 +127,18 @@ export class BackendRequestFacade implements RequestService {
         return this.requestService.resolveProxy(url);
     }
 
+    protected async getAllowedPatterns(): Promise<string[]> {
+        if (this.cachedAllowedPatterns) {
+            return this.cachedAllowedPatterns;
+        }
+        const patterns: string[] = [];
+        if (this.allowedContributions) {
+            for (const contribution of this.allowedContributions.getContributions()) {
+                const contributed = await contribution.getAllowedUrlPatterns();
+                patterns.push(...contributed);
+            }
+        }
+        this.cachedAllowedPatterns = patterns;
+        return patterns;
+    }
 }