@theia/core 1.73.0-next.7 → 1.73.0

package/lib/node/request/backend-request-facade.spec.js

@@ -0,0 +1,171 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const sinon = require("sinon");
+const backend_request_facade_1 = require("./backend-request-facade");
+const backend_application_config_provider_1 = require("../backend-application-config-provider");
+describe('isUrlAllowed', () => {
+    it('should allow a URL that matches an exact origin pattern', () => {
+        const patterns = ['https://open-vsx.org'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://open-vsx.org/api/extensions', patterns)).to.be.true;
+    });
+    it('should allow a URL with a path when pattern has no path', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/some/deep/path?query=1', patterns)).to.be.true;
+    });
+    it('should allow a URL that exactly matches the origin', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/', patterns)).to.be.true;
+    });
+    it('should reject a URL with a different scheme', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com/path', patterns)).to.be.false;
+    });
+    it('should reject a URL with a different host', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://evil.com/path', patterns)).to.be.false;
+    });
+    it('should reject a URL with a different port', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com:8443/path', patterns)).to.be.false;
+    });
+    it('should allow a URL when port matches explicitly', () => {
+        const patterns = ['https://example.com:8443'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com:8443/path', patterns)).to.be.true;
+    });
+    it('should treat default ports as equivalent', () => {
+        const patterns = ['https://example.com:443'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+        const httpPatterns = ['http://example.com:80'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com/path', httpPatterns)).to.be.true;
+        const implicitPatterns = ['http://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://example.com:80/path', implicitPatterns)).to.be.true;
+    });
+    it('should match wildcard subdomains', () => {
+        const patterns = ['https://*.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://foo.example.com/path', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://bar.baz.example.com/path', patterns)).to.be.true;
+    });
+    it('should not match the bare domain with a wildcard subdomain pattern', () => {
+        const patterns = ['https://*.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.false;
+    });
+    it('should reject non-http(s) schemes', () => {
+        const patterns = ['file:///etc/passwd'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('file:///etc/passwd', patterns)).to.be.false;
+    });
+    it('should reject ftp scheme', () => {
+        const patterns = ['ftp://files.example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('ftp://files.example.com/data', patterns)).to.be.false;
+    });
+    it('should reject a URL when target uses non-http(s) scheme even if patterns exist', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('file:///etc/passwd', patterns)).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('ftp://example.com/data', patterns)).to.be.false;
+    });
+    it('should reject all URLs when allowlist is empty', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://localhost:3000', [])).to.be.false;
+    });
+    it('should reject invalid URLs', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('not a url', patterns)).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('', patterns)).to.be.false;
+    });
+    it('should allow private IPs only when explicitly in the allowlist', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', ['https://example.com'])).to.be.false;
+        const patternsWithLoopback = ['http://127.0.0.1:8080'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://127.0.0.1:8080/secret', patternsWithLoopback)).to.be.true;
+    });
+    it('should reject cloud metadata endpoint by default', () => {
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://169.254.169.254/latest/meta-data/', [])).to.be.false;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('http://169.254.169.254/latest/meta-data/', ['https://example.com'])).to.be.false;
+    });
+    it('should merge multiple patterns correctly', () => {
+        const patterns = [
+            'https://open-vsx.org',
+            'https://marketplace.example.com',
+            'https://*.cdn.example.com'
+        ];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://open-vsx.org/api/v2/extensions', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://marketplace.example.com/download', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://files.cdn.example.com/ext.vsix', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://evil.com/malware', patterns)).to.be.false;
+    });
+    it('should handle patterns with trailing slashes', () => {
+        const patterns = ['https://example.com/'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+    });
+    it('should handle invalid patterns gracefully', () => {
+        const patterns = ['not a valid pattern', 'https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com/path', patterns)).to.be.true;
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://other.com/path', patterns)).to.be.false;
+    });
+    it('should prevent host spoofing via subdomain prefix', () => {
+        const patterns = ['https://example.com'];
+        (0, chai_1.expect)((0, backend_request_facade_1.isUrlAllowed)('https://example.com.evil.com/path', patterns)).to.be.false;
+    });
+});
+describe('BackendRequestFacade', () => {
+    describe('configure', () => {
+        let configProviderStub;
+        beforeEach(() => {
+            configProviderStub = sinon.stub(backend_application_config_provider_1.BackendApplicationConfigProvider, 'get');
+        });
+        afterEach(() => {
+            configProviderStub.restore();
+        });
+        it('should be a no-op when configureProxyFromPreferences is false', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: false
+            });
+            const facade = new backend_request_facade_1.BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            facade.requestService = {
+                configure: configureStub
+            };
+            await facade.configure({ proxyUrl: 'http://evil.com', strictSSL: false });
+            (0, chai_1.expect)(configureStub.called).to.be.false;
+        });
+        it('should pass through to the underlying request service when configureProxyFromPreferences is true', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: true
+            });
+            const facade = new backend_request_facade_1.BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            facade.requestService = {
+                configure: configureStub
+            };
+            const config = { proxyUrl: 'http://my-proxy.com:8080', strictSSL: true, proxyAuthorization: 'Bearer token' };
+            await facade.configure(config);
+            (0, chai_1.expect)(configureStub.calledOnce).to.be.true;
+            (0, chai_1.expect)(configureStub.firstCall.args[0]).to.deep.equal(config);
+        });
+    });
+});
+//# sourceMappingURL=backend-request-facade.spec.js.map

package/lib/node/request/backend-request-facade.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-request-facade.spec.js","sourceRoot":"","sources":["../../../src/node/request/backend-request-facade.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAC9B,+BAA+B;AAC/B,qEAA8E;AAC9E,gGAA0F;AAE1F,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAE1B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,4CAA4C,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC1D,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACjE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,sBAAsB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACnD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,uBAAuB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACvD,MAAM,QAAQ,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC9C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAEtE,MAAM,YAAY,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,yBAAyB,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAEzE,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,4BAA4B,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QACxC,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QAC1E,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC1E,MAAM,QAAQ,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC3C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACzC,MAAM,QAAQ,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACxC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAChC,MAAM,QAAQ,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACtF,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACjE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACtD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC5D,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACxD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACtE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACrE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAE1F,MAAM,oBAAoB,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QACxD,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QACjF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAChD,MAAM,QAAQ,GAAG;YACb,sBAAsB;YACtB,iCAAiC;YACjC,2BAA2B;SAC9B,CAAC;QACF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0CAA0C,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACtF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACpF,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACpD,MAAM,QAAQ,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;QAChE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACtE,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,wBAAwB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACzC,IAAA,aAAM,EAAC,IAAA,qCAAY,EAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACpF,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAElC,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QAEvB,IAAI,kBAAmC,CAAC;QAExC,UAAU,CAAC,GAAG,EAAE;YACZ,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,sEAAgC,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,GAAG,EAAE;YACX,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC3E,kBAAkB,CAAC,OAAO,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,yBAAyB,EAAE,CAAC;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,6BAA6B,EAAE,KAAK;aACvC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,6CAAoB,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,8DAA8D;YAC7D,MAAc,CAAC,cAAc,GAAG;gBAC7B,SAAS,EAAE,aAAa;aAC3B,CAAC;YACF,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,IAAA,aAAM,EAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;YAC9G,kBAAkB,CAAC,OAAO,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,yBAAyB,EAAE,CAAC;gBAC5B,mBAAmB,EAAE,QAAQ;gBAC7B,6BAA6B,EAAE,IAAI;aACtC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,6CAAoB,EAAE,CAAC;YAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC9C,8DAA8D;YAC7D,MAAc,CAAC,cAAc,GAAG;gBAC7B,SAAS,EAAE,aAAa;aAC3B,CAAC;YACF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,CAAC;YAC7G,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAA,aAAM,EAAC,aAAa,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;YAC5C,IAAA,aAAM,EAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@theia/core",
-  "version": "1.73.0-next.7+c60326bb9",
+  "version": "1.73.0",
   "description": "Theia is a cloud & desktop IDE framework implemented in TypeScript.",
   "main": "lib/common/index.js",
   "typings": "lib/common/index.d.ts",
   "dependencies": {
-    "@babel/runtime": "^7.29.2",
+    "@babel/runtime": "^7.29.7",
     "@lumino/algorithm": "^2.0.4",
     "@lumino/commands": "^2.3.3",
     "@lumino/coreutils": "^2.2.2",
@@ -17,8 +17,8 @@
     "@lumino/virtualdom": "^2.0.4",
     "@lumino/widgets": "2.7.5",
     "@parcel/watcher": "^2.5.6",
-    "@theia/application-package": "1.73.0-next.7+c60326bb9",
-    "@theia/request": "1.73.0-next.7+c60326bb9",
+    "@theia/application-package": "1.73.0",
+    "@theia/request": "1.73.0",
     "@types/body-parser": "^1.19.6",
     "@types/express": "^4.17.25",
     "@types/fs-extra": "^4.0.15",
@@ -26,21 +26,18 @@
     "@types/lodash.throttle": "^4.1.9",
     "@types/markdown-it": "^14.1.2",
     "@types/markdown-it-emoji": "^3.0.1",
-    "@types/react": "^18.3.28",
-    "@types/react-dom": "^18.3.7",
     "@types/route-parser": "^0.1.7",
     "@types/safer-buffer": "^2.1.3",
-    "@types/uuid": "^9.0.8",
     "@types/ws": "^8.18.1",
-    "@types/yargs": "^17",
+    "@types/yargs": "^17.0.35",
     "@vscode/codicons": "0.0.45",
     "ajv": "^6.15.0",
     "async-mutex": "^0.4.1",
     "body-parser": "^1.20.5",
     "cookie": "^1.1.1",
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.7",
     "drivelist": "^12.0.2",
-    "express": "^4.22.1",
+    "express": "^4.22.2",
     "fast-json-stable-stringify": "^2.1.0",
     "file-icons-js": "~1.0.3",
     "font-awesome": "^4.7.0",
@@ -54,14 +51,12 @@
     "keytar": "7.9.0",
     "lodash.debounce": "^4.0.8",
     "lodash.throttle": "^4.1.1",
-    "markdown-it": "^14.1.1",
+    "markdown-it": "^14.2.0",
     "markdown-it-anchor": "^9.2.0",
     "markdown-it-emoji": "^3.0.0",
     "msgpackr": "^1.11.12",
     "p-debounce": "^2.1.0",
     "perfect-scrollbar": "1.5.5",
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1",
     "react-tooltip": "^4.5.1",
     "react-virtuoso": "^2.19.1",
     "reflect-metadata": "^0.2.2",
@@ -70,18 +65,28 @@
     "socket.io": "^4.8.3",
     "socket.io-client": "^4.8.3",
     "tslib": "^2.8.1",
-    "uuid": "^9.0.1",
+    "uuid": "^11.1.1",
     "vscode-languageserver-protocol": "3.17.5",
     "vscode-uri": "3.0.8",
-    "ws": "^8.20.0",
+    "ws": "^8.21.0",
     "yargs": "^17.7.2"
   },
   "peerDependencies": {
-    "@theia/electron": "*"
+    "@theia/electron": "*",
+    "@types/react": "^18.3.0 || ^19.0.0",
+    "@types/react-dom": "^18.3.0 || ^19.0.0",
+    "react": "^18.3.1 || ^19.0.0",
+    "react-dom": "^18.3.1 || ^19.0.0"
   },
   "peerDependenciesMeta": {
     "@theia/electron": {
       "optional": true
+    },
+    "@types/react": {
+      "optional": true
+    },
+    "@types/react-dom": {
+      "optional": true
     }
   },
   "publishConfig": {
@@ -213,13 +218,17 @@
     "watch": "theiaext watch"
   },
   "devDependencies": {
-    "@theia/ext-scripts": "1.72.0",
-    "@theia/re-exports": "1.72.0",
+    "@theia/ext-scripts": "1.73.0",
+    "@theia/re-exports": "1.73.0",
+    "@types/react": "^18.3.28",
+    "@types/react-dom": "^18.3.7",
     "minimist": "^1.2.8",
-    "nodejs-file-downloader": "4.13.0"
+    "nodejs-file-downloader": "4.13.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1"
   },
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "c60326bb9abc480805eec58eed75e58f08c2569a"
+  "gitHead": "25e1b7fdf4c39ecea7066e1c8be3af1cc02e4d2e"
 }

package/src/browser/authentication-service.ts

@@ -20,13 +20,14 @@
  *--------------------------------------------------------------------------------------------*/
 // code copied and modified from https://github.com/microsoft/vscode/blob/1.47.3/src/vs/workbench/services/authentication/browser/authenticationService.ts
 
-import { injectable, inject, postConstruct } from 'inversify';
+import { injectable, inject, postConstruct, named } from 'inversify';
 import { Emitter, Event } from '../common/event';
 import { StorageService } from '../browser/storage-service';
 import { Disposable, DisposableCollection } from '../common/disposable';
 import { ACCOUNTS_MENU, ACCOUNTS_SUBMENU, MenuModelRegistry } from '../common/menu';
 import { Command, CommandRegistry } from '../common/command';
 import { nls } from '../common/nls';
+import { ILogger } from '../common/logger';
 
 export interface AuthenticationSessionAccountInformation {
     readonly id: string;
@@ -202,6 +203,8 @@ export class AuthenticationServiceImpl implements AuthenticationService {
     @inject(MenuModelRegistry) protected readonly menus: MenuModelRegistry;
     @inject(CommandRegistry) protected readonly commands: CommandRegistry;
     @inject(StorageService) protected readonly storageService: StorageService;
+    @inject(ILogger) @named('core:AuthenticationServiceImpl')
+    protected readonly logger: ILogger;
 
     @postConstruct()
     init(): void {
@@ -308,7 +311,7 @@ export class AuthenticationServiceImpl implements AuthenticationService {
             this.onDidUnregisterAuthenticationProviderEmitter.fire({ id, label: provider.label });
             this.updateAccountsMenuItem();
         } else {
-            console.error(`Failed to unregister an authentication provider. A provider with id '${id}' was not found.`);
+            this.logger.error(`Failed to unregister an authentication provider. A provider with id '${id}' was not found.`);
         }
         this.authenticationProviderDisposables.get(id)?.dispose();
         this.authenticationProviderDisposables.delete(id);
@@ -325,7 +328,7 @@ export class AuthenticationServiceImpl implements AuthenticationService {
                 await this.updateNewSessionRequests(provider);
             }
         } else {
-            console.error(`Failed to update an authentication session. An authentication provider with id '${id}' was not found.`);
+            this.logger.error(`Failed to update an authentication session. An authentication provider with id '${id}' was not found.`);
         }
     }
 

package/src/browser/frontend-application.ts

@@ -27,6 +27,7 @@ import { CorePreferences } from '../common/core-preferences';
 import { WindowService } from './window/window-service';
 import { TooltipService } from './tooltip-service';
 import { FrontendApplicationContribution } from './frontend-application-contribution';
+import { ILogger } from '../common/logger';
 
 const TIMER_WARNING_THRESHOLD = 100;
 
@@ -48,6 +49,9 @@ export class FrontendApplication {
     @inject(BackendStopwatch)
     protected readonly backendStopwatch: BackendStopwatch;
 
+    @inject(ILogger) @named('core:FrontendApplication')
+    protected readonly logger: ILogger;
+
     private settlementContext?: MeasurementContext<FrontendApplicationContribution>;
 
     constructor(
@@ -217,10 +221,10 @@ export class FrontendApplication {
             return await this.layoutRestorer.restoreLayout(this);
         } catch (error) {
             if (ApplicationShellLayoutMigrationError.is(error)) {
-                console.warn(error.message);
-                console.info('Initializing the default layout instead...');
+                this.logger.warn(error.message);
+                this.logger.info('Initializing the default layout instead...');
             } else {
-                console.error('Could not restore layout', error);
+                this.logger.error('Could not restore layout', error);
             }
             return false;
         }
@@ -258,7 +262,7 @@ export class FrontendApplication {
                     await this.measureContribution(contribution, 'initialize',
                         () => contribution.initialize!());
                 } catch (error) {
-                    console.error('Could not initialize contribution', error);
+                    this.logger.error('Could not initialize contribution', error);
                 }
             }
         }
@@ -269,7 +273,7 @@ export class FrontendApplication {
                     await this.measureContribution(contribution, 'configure',
                         () => contribution.configure!(this));
                 } catch (error) {
-                    console.error('Could not configure contribution', error);
+                    this.logger.error('Could not configure contribution', error);
                 }
             }
         }
@@ -294,7 +298,7 @@ export class FrontendApplication {
                     await this.measureContribution(contribution, 'onStart',
                         () => contribution.onStart!(this));
                 } catch (error) {
-                    console.error('Could not start contribution', error);
+                    this.logger.error('Could not start contribution', error);
                 }
             }
         }
@@ -304,17 +308,17 @@ export class FrontendApplication {
      * Stop the frontend application contributions. This is called when the window is unloaded.
      */
     protected stopContributions(): void {
-        console.info('>>> Stopping frontend contributions...');
+        this.logger.info('>>> Stopping frontend contributions...');
         for (const contribution of this.contributions.getContributions()) {
             if (contribution.onStop) {
                 try {
                     contribution.onStop(this);
                 } catch (error) {
-                    console.error('Could not stop contribution', error);
+                    this.logger.error('Could not stop contribution', error);
                 }
             }
         }
-        console.info('<<< All frontend contributions have been stopped.');
+        this.logger.info('<<< All frontend contributions have been stopped.');
     }
 
     protected async measureContribution<T>(contribution: FrontendApplicationContribution, hook: string, fn: () => MaybePromise<T>): Promise<T> {

package/src/browser/json-schema-store.ts

@@ -20,6 +20,7 @@ import { FrontendApplicationContribution } from './frontend-application-contribu
 import { Emitter, MaybePromise, URI } from '../common';
 import { timeout, Deferred } from '../common/promise-util';
 import { IJSONSchema } from '../common/json-schema';
+import { ILogger } from '../common/logger';
 
 export interface JsonSchemaConfiguration {
     fileMatch: string | string[];
@@ -41,6 +42,9 @@ export class JsonSchemaStore implements FrontendApplicationContribution {
     @inject(ContributionProvider) @named(JsonSchemaContribution)
     protected readonly contributions: ContributionProvider<JsonSchemaContribution>;
 
+    @inject(ILogger) @named('core:JsonSchemaStore')
+    protected readonly logger: ILogger;
+
     protected readonly _schemas = new Deferred<JsonSchemaConfiguration[]>();
     get schemas(): Promise<JsonSchemaConfiguration[]> {
         return this._schemas.promise;
@@ -68,9 +72,9 @@ export class JsonSchemaStore implements FrontendApplicationContribution {
             if (result) {
                 pendingRegistrations.push(result.then(() => { }, e => {
                     if (e instanceof Error && e.message === frozenErrorCode) {
-                        console.error(`${contribution.constructor.name}.registerSchemas is taking more than ${registerTimeout.toFixed(1)} ms, new schemas are ignored.`);
+                        this.logger.error(`${contribution.constructor.name}.registerSchemas is taking more than ${registerTimeout.toFixed(1)} ms, new schemas are ignored.`);
                     } else {
-                        console.error(e);
+                        this.logger.error(e);
                     }
                 }));
             }

package/src/browser/keybinding.ts

@@ -128,7 +128,7 @@ export class KeybindingRegistry {
     @inject(StatusBar)
     protected readonly statusBar: StatusBar;
 
-    @inject(ILogger)
+    @inject(ILogger) @named('core:KeybindingRegistry')
     protected readonly logger: ILogger;
 
     @inject(ContextKeyService)
@@ -545,7 +545,7 @@ export class KeybindingRegistry {
             if (command) {
                 if (this.commandRegistry.isEnabled(binding.command, binding.args)) {
                     this.commandRegistry.executeCommand(binding.command, binding.args)
-                        .catch(e => console.error('Failed to execute command:', e));
+                        .catch(e => this.logger.error('Failed to execute command:', e));
                 }
 
                 /* Note that if a keybinding is in context but the command is

package/src/browser/markdown-rendering/markdown.tsx

@@ -157,10 +157,10 @@ export function useMarkdown(
     markdownRenderer: MarkdownRenderer,
     markdownOptions?: MarkdownProps['markdownOptions'],
     onRender?: (element: HTMLElement | undefined) => void
-): React.RefObject<HTMLDivElement> {
+): React.Ref<HTMLDivElement> {
     // eslint-disable-next-line no-null/no-null
     const containerRef = React.useRef<HTMLDivElement>(null);
-    const renderResultRef = React.useRef<MarkdownRenderResult | undefined>();
+    const renderResultRef = React.useRef<MarkdownRenderResult | undefined>(undefined);
 
     const renderedElement = React.useMemo(() => {
         renderResultRef.current?.dispose();

package/src/browser/menu/composite-menu-node.ts

@@ -31,11 +31,11 @@ export class SubMenuLink implements CompoundMenuNode {
 
     get sortString(): string { return this._sortString || this.delegate.sortString; };
     isVisible<T>(effectiveMenuPath: MenuPath, contextMatcher: ContextExpressionMatcher<T>, context: T | undefined, ...args: unknown[]): boolean {
-        return this.delegate.isVisible(effectiveMenuPath, contextMatcher, context) && (!this._when || contextMatcher.match(this._when, context));
+        return this.delegate.isVisible(effectiveMenuPath, contextMatcher, context, ...args) && (!this._when || contextMatcher.match(this._when, context));
     }
 
     isEmpty<T>(effectiveMenuPath: MenuPath, contextMatcher: ContextExpressionMatcher<T>, context: T | undefined, ...args: unknown[]): boolean {
-        return this.delegate.isEmpty(effectiveMenuPath, contextMatcher, context, args);
+        return this.delegate.isEmpty(effectiveMenuPath, contextMatcher, context, ...args);
     }
 }
 
@@ -78,8 +78,8 @@ export abstract class AbstractCompoundMenuImpl implements MenuNode {
 
     isEmpty<T>(effectiveMenuPath: MenuPath, contextMatcher: ContextExpressionMatcher<T>, context: T | undefined, ...args: unknown[]): boolean {
         for (const child of this.children) {
-            if (child.isVisible(effectiveMenuPath, contextMatcher, context, args)) {
-                if (!CompoundMenuNode.is(child) || !child.isEmpty(effectiveMenuPath, contextMatcher, context, args)) {
+            if (child.isVisible(effectiveMenuPath, contextMatcher, context, ...args)) {
+                if (!CompoundMenuNode.is(child) || !child.isEmpty(effectiveMenuPath, contextMatcher, context, ...args)) {
                     return false;
                 }
             }

package/src/browser/messaging/ws-connection-source.ts

@@ -208,12 +208,7 @@ export class WebSocketConnectionSource implements ConnectionSource {
             reconnection: true,
             reconnectionDelay: 1000,
             reconnectionDelayMax: 10000,
-            reconnectionAttempts: Infinity,
-            extraHeaders: {
-                // Socket.io strips the `origin` header
-                // We need to provide our own for validation
-                'fix-origin': window.location.origin
-            }
+            reconnectionAttempts: Infinity
         });
     }
 

package/src/browser/preferences/frontend-config-preference-contributions.ts

@@ -14,16 +14,21 @@
 // SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
 // *****************************************************************************
 
-import { injectable } from 'inversify';
+import { injectable, named, inject } from 'inversify';
 import { PreferenceContribution, PreferenceSchema, PreferenceSchemaService } from '../../common/preferences/preference-schema';
 import { FrontendApplicationConfigProvider } from '../frontend-application-config-provider';
 import { FrontendApplicationPreferenceConfig } from './preference-contribution';
 import { PreferenceLanguageOverrideService } from '../../common/preferences/preference-language-override-service';
 import { PreferenceScope } from '../../common/preferences';
 import { DefaultTheme } from '@theia/application-package/lib/application-props';
+import { ILogger } from '../../common/logger';
 
 @injectable()
 export class FrontendConfigPreferenceContribution implements PreferenceContribution {
+
+    @inject(ILogger) @named('core:FrontendConfigPreferenceContribution')
+    protected readonly logger: ILogger;
+
     schema: PreferenceSchema = { scope: PreferenceScope.Folder, properties: {} };
     async initSchema(service: PreferenceSchemaService): Promise<void> {
         const config = FrontendApplicationConfigProvider.get();
@@ -44,7 +49,7 @@ export class FrontendConfigPreferenceContribution implements PreferenceContribut
                     }
                 }
             } catch (e) {
-                console.error('Failed to load preferences from frontend configuration.', e);
+                this.logger.error('Failed to load preferences from frontend configuration.', e);
             }
         }
     }

package/src/browser/preferences/preference-proxy.spec.ts

@@ -162,6 +162,14 @@ describe('Preference Proxy', () => {
                 expect(Object.keys(proxy).join()).to.equal(['my.pref'].join());
             });
 
+            it('supports object introspection through Symbol.toStringTag', async () => {
+                const { proxy, promisedSchema } = getProxy();
+                if (promisedSchema) {
+                    await promisedSchema;
+                }
+                expect(Object.prototype.toString.call(proxy)).to.equal('[object Object]');
+            });
+
             it('it should provide access in deep style but not flat', async () => {
                 const { proxy, promisedSchema } = getProxy(undefined, { style: 'deep' });
                 if (promisedSchema) {

package/src/browser/preferences/preference-schema-provider.spec.ts

@@ -24,6 +24,8 @@ import { bindPreferenceService } from '../frontend-application-bindings';
 import { FrontendApplicationConfigProvider } from '../frontend-application-config-provider';
 import { IndexedAccess, PreferenceDataProperty, PreferenceSchemaService } from '../../common/preferences/preference-schema';
 import { PreferenceProvider, PreferenceProviderProvider, PreferenceScope } from '../../common/preferences';
+import { ILogger } from '../../common';
+import { MockLogger } from '../../common/test/mock-logger';
 
 disableJSDOM();
 
@@ -38,6 +40,9 @@ let testContainer: Container;
 function createTestContainer(): Container {
     const result = new Container();
     bindPreferenceService(result.bind.bind(result));
+
+    result.bind(ILogger).to(MockLogger).inSingletonScope();
+
     return result;
 }
 

package/src/browser/preferences/preference-validation-service.spec.ts

@@ -21,9 +21,10 @@ import { JSONValue } from '@lumino/coreutils';
 import { IJSONSchema, JsonType } from '../../common/json-schema';
 import {
     DefaultsPreferenceProvider, Disposable, PreferenceDataProperty, PreferenceProvider,
-    PreferenceSchemaService, PreferenceSchemaServiceImpl, PreferenceScope
+    PreferenceSchemaService, PreferenceSchemaServiceImpl, PreferenceScope, ILogger
 } from '../../common';
 import { PreferenceLanguageOverrideService } from '../../common/preferences/preference-language-override-service';
+import { MockLogger } from '../../common/test/mock-logger';
 
 /* eslint-disable no-null/no-null */
 
@@ -35,6 +36,7 @@ describe('Preference Validation Service', () => {
     } as unknown as PreferenceSchemaService);
     container.bind(PreferenceLanguageOverrideService).to(PreferenceLanguageOverrideService).inSingletonScope();
     container.bind(PreferenceProvider).to(DefaultsPreferenceProvider).inSingletonScope().whenTargetNamed(PreferenceScope.Default);
+    container.bind(ILogger).to(MockLogger).inSingletonScope();
 
     const validator = container.resolve(PreferenceValidationService);
     const validateBySchema: (value: JSONValue, schema: PreferenceDataProperty) => JSONValue = validator.validateBySchema.bind(validator, 'dummy');