@theia/core 1.73.0-next.7 → 1.73.0

package/src/common/preferences/injectable-preference-proxy.ts

@@ -106,7 +106,13 @@ export class InjectablePreferenceProxy<T extends Record<string, JSONValue>> impl
         }
     }
 
-    get(target: unknown, property: string, receiver: unknown): unknown {
+    get(target: unknown, property: string | symbol, receiver: unknown): unknown {
+        // React 19 dev mode calls Object.prototype.toString when handling prop diffs, which
+        // probes Symbol.toStringTag. Throwing should be avoided in this case, it crashes the React DOM.
+        if (property === Symbol.toStringTag) {
+            return undefined;
+        }
+
         if (typeof property !== 'string') {
             throw new Error(`Unexpected property: ${String(property)}`);
         }
@@ -156,7 +162,7 @@ export class InjectablePreferenceProxy<T extends Record<string, JSONValue>> impl
         }
     }
 
-    set(target: unknown, property: string, value: unknown, receiver: unknown): boolean {
+    set(target: unknown, property: string | symbol, value: unknown, receiver: unknown): boolean {
         if (typeof property !== 'string') {
             throw new Error(`Unexpected property: ${String(property)}`);
         }
@@ -212,8 +218,8 @@ export class InjectablePreferenceProxy<T extends Record<string, JSONValue>> impl
         return properties;
     }
 
-    getOwnPropertyDescriptor(target: unknown, property: string): PropertyDescriptor {
-        if (this.ownKeys().includes(property)) {
+    getOwnPropertyDescriptor(target: unknown, property: string | symbol): PropertyDescriptor {
+        if (typeof property === 'string' && this.ownKeys().includes(property)) {
             return {
                 enumerable: true,
                 configurable: true

package/src/common/preferences/preference-proxy.ts

@@ -239,7 +239,7 @@ export function createPreferenceProxy<T>(preferences: PreferenceService, promise
         return properties;
     };
 
-    const set: (target: any, prop: string, value: any, receiver: any) => boolean = (_, property: string | symbol | number, value: any) => {
+    const set: (target: any, prop: string | symbol, value: any, receiver: any) => boolean = (_, property: string | symbol | number, value: any) => {
         if (typeof property !== 'string') {
             throw new Error(`unexpected property: ${String(property)}`);
         }
@@ -270,7 +270,13 @@ export function createPreferenceProxy<T>(preferences: PreferenceService, promise
         return false;
     };
 
-    const get: (target: any, prop: string) => any = (_, property: string | symbol | number) => {
+    const get: (target: any, prop: string | symbol) => any = (_, property: string | symbol | number) => {
+        // React 19 dev mode calls Object.prototype.toString when handling prop diffs, which
+        // probes Symbol.toStringTag. Throwing should be avoided in this case, it crashes the React DOM.
+        if (property === Symbol.toStringTag) {
+            return undefined;
+        }
+
         if (typeof property !== 'string') {
             throw new Error(`unexpected property: ${String(property)}`);
         }
@@ -347,8 +353,8 @@ export function createPreferenceProxy<T>(preferences: PreferenceService, promise
     return new Proxy({}, {
         get,
         ownKeys,
-        getOwnPropertyDescriptor: (_, property: string) => {
-            if (ownKeys().indexOf(property) !== -1) {
+        getOwnPropertyDescriptor: (_, property: string | symbol) => {
+            if (typeof property === 'string' && ownKeys().indexOf(property) !== -1) {
                 return {
                     enumerable: true,
                     configurable: true

package/src/electron-main/electron-main-application.ts

@@ -394,6 +394,8 @@ export class ElectronMainApplication {
         const cancelTokenSource = new CancellationTokenSource();
         const minTime = timeout(splashScreenOptions.minDuration ?? 0, cancelTokenSource.token);
         const maxTime = timeout(splashScreenOptions.maxDuration ?? 30000, cancelTokenSource.token);
+        // Swallow rejections that occur when the cancellation token is cancelled after one of the timers wins.
+        const ignoreCancellation = () => { /* timer was cancelled, intentionally ignored */ };
 
         const showWindowAndCloseSplashScreen = () => {
             cancelTokenSource.cancel();
@@ -404,10 +406,10 @@ export class ElectronMainApplication {
         };
         TheiaRendererAPI.onApplicationStateChanged(mainWindow.webContents, state => {
             if (state === 'ready') {
-                minTime.then(() => showWindowAndCloseSplashScreen());
+                minTime.then(() => showWindowAndCloseSplashScreen(), ignoreCancellation);
             }
         });
-        maxTime.then(() => showWindowAndCloseSplashScreen());
+        maxTime.then(() => showWindowAndCloseSplashScreen(), ignoreCancellation);
         return splashScreenWindow;
     }
 

package/src/electron-node/hosting/electron-ws-origin-validator.spec.ts

@@ -0,0 +1,69 @@
+// *****************************************************************************
+// Copyright (C) 2026 STMicroelectronics and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import { ElectronWsOriginValidator } from './electron-ws-origin-validator';
+import { BackendRemoteService } from '../../node/remote/backend-remote-service';
+
+describe('ElectronWsOriginValidator', () => {
+
+    function createValidator(isRemote = false): ElectronWsOriginValidator {
+        const remoteService = { isRemoteServer: () => isRemote } as BackendRemoteService;
+        const validator = new ElectronWsOriginValidator();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (validator as any)['backendRemoteService'] = remoteService;
+        return validator;
+    }
+
+    function createRequest(origin?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        return request;
+    }
+
+    it('should allow file:// origin (standard Electron case)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('file://'))).to.be.true;
+    });
+
+    it('should allow null origin (opaque origin from file:// pages)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('null'))).to.be.true;
+    });
+
+    it('should allow absent origin (same-origin polling requests)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest(undefined))).to.be.true;
+    });
+
+    it('should reject cross-origin requests', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('http://evil.com'))).to.be.false;
+    });
+
+    it('should reject http://localhost origin (not expected in Electron)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest('http://localhost:3000'))).to.be.false;
+    });
+
+    it('should allow empty string origin (treated as absent)', () => {
+        expect(createValidator().allowWsUpgrade(createRequest(''))).to.be.true;
+    });
+
+    it('should allow any origin when running as remote server', () => {
+        expect(createValidator(true).allowWsUpgrade(createRequest('http://remote-host.com'))).to.be.true;
+    });
+});

package/src/electron-node/hosting/electron-ws-origin-validator.ts

@@ -30,8 +30,11 @@ export class ElectronWsOriginValidator implements WsRequestValidatorContribution
         if (this.backendRemoteService.isRemoteServer()) {
             return true;
         }
+        const origin = request.headers.origin;
         // On Electron the main page is served from the `file` protocol.
-        // We don't expect the requests to come from anywhere else.
-        return request.headers.origin === 'file://';
+        // Chromium may send "file://" or "null" (opaque origin) or omit the
+        // header entirely depending on the request type (WebSocket upgrade vs
+        // HTTP polling). All three are expected for same-origin Electron requests.
+        return !origin || origin === 'file://' || origin === 'null';
     }
 }

package/src/electron-node/request/electron-backend-request-service.ts

@@ -14,15 +14,19 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 
-import { decorate, injectable } from 'inversify';
+import { decorate, injectable, inject, named } from 'inversify';
 import { NodeRequestOptions, NodeRequestService } from '@theia/request/lib/node-request-service';
 import { ElectronSecurityToken } from '../../electron-common/electron-token';
+import { ILogger } from '../../common';
 
 decorate(injectable(), NodeRequestService);
 
 @injectable()
 export class ElectronBackendRequestService extends NodeRequestService {
 
+    @inject(ILogger) @named('core:ElectronBackendRequestService')
+    protected readonly logger: ILogger;
+
     override async getProxyUrl(url: string): Promise<string | undefined> {
         if (this.proxyUrl) {
             return this.proxyUrl;
@@ -34,7 +38,7 @@ export class ElectronBackendRequestService extends NodeRequestService {
                 return this.buildProxyUrl(url, proxyHost);
             }
         } catch (e) {
-            console.error('Could not resolve electron proxy.', e);
+            this.logger.error('Could not resolve electron proxy.', e);
         }
         return super.getProxyUrl(url);
     }

package/src/electron-node/token/electron-token-backend-contribution.ts

@@ -15,9 +15,10 @@
 // *****************************************************************************
 
 import express = require('express');
-import { injectable, inject } from 'inversify';
+import { injectable, inject, named } from 'inversify';
 import { BackendApplicationContribution } from '../../node';
 import { ElectronTokenValidator } from './electron-token-validator';
+import { ILogger } from '../../common/logger';
 
 /**
  * This component contributes an Express middleware that will refuse all
@@ -26,6 +27,9 @@ import { ElectronTokenValidator } from './electron-token-validator';
 @injectable()
 export class ElectronTokenBackendContribution implements BackendApplicationContribution {
 
+    @inject(ILogger) @named('core:ElectronTokenBackendContribution')
+    protected readonly logger: ILogger;
+
     @inject(ElectronTokenValidator)
     protected readonly tokenValidator: ElectronTokenValidator;
 
@@ -40,7 +44,7 @@ export class ElectronTokenBackendContribution implements BackendApplicationContr
         if (this.tokenValidator.allowRequest(req)) {
             next();
         } else {
-            console.error(`refused an http request: ${req.connection.remoteAddress}`);
+            this.logger.error(`refused an http request: ${req.connection.remoteAddress}`);
             res.sendStatus(403);
         }
     }

package/src/electron-node/token/electron-token-validator.ts

@@ -17,10 +17,11 @@
 import * as http from 'http';
 import * as cookie from 'cookie';
 import * as crypto from 'crypto';
-import { injectable, postConstruct } from 'inversify';
+import { injectable, postConstruct, inject, named } from 'inversify';
 import { isObject, isString, MaybePromise } from '../../common';
 import { ElectronSecurityToken } from '../../electron-common/electron-token';
 import { WsRequestValidatorContribution } from '../../node/ws-request-validators';
+import { ILogger } from '../../common/logger';
 
 /**
  * On Electron, we want to make sure that only Electron's browser-windows access the backend services.
@@ -28,6 +29,9 @@ import { WsRequestValidatorContribution } from '../../node/ws-request-validators
 @injectable()
 export class ElectronTokenValidator implements WsRequestValidatorContribution {
 
+    @inject(ILogger) @named('core:ElectronTokenValidator')
+    protected readonly logger: ILogger;
+
     protected electronSecurityToken?: ElectronSecurityToken;
 
     @postConstruct()
@@ -70,7 +74,7 @@ export class ElectronTokenValidator implements WsRequestValidatorContribution {
                 const expected = Buffer.from(this.electronSecurityToken!.value, 'utf8');
                 return received.byteLength === expected.byteLength && crypto.timingSafeEqual(received, expected);
             } catch (error) {
-                console.error(error);
+                this.logger.error(error);
             }
         }
         return false;

package/src/node/backend-application-module.ts

@@ -36,7 +36,7 @@ import {
 } from '../common';
 import {
     BackendApplication, BackendApplicationContribution, BackendApplicationCliContribution,
-    BackendApplicationServer, BackendApplicationPath, RootContainer
+    BackendApplicationServer, BackendApplicationPath, EarlyExpressMiddleware, RootContainer
 } from './backend-application';
 import { CliManager, CliContribution } from './cli';
 import { IPCConnectionProvider } from './messaging';
@@ -55,7 +55,7 @@ import { ProcessUtils } from './process-utils';
 import { ProxyCliContribution } from './request/proxy-cli-contribution';
 import { bindNodeStopwatch, bindBackendStopwatchServer } from './performance';
 import { OSBackendProviderImpl } from './os-backend-provider';
-import { BackendRequestFacade } from './request/backend-request-facade';
+import { BackendRequestFacade, BackendRequestAllowedContribution } from './request/backend-request-facade';
 import { FileSystemLocking, FileSystemLockingImpl } from './filesystem-locking';
 import { BackendRemoteService } from './remote/backend-remote-service';
 import { RemoteCliContribution } from './remote/remote-cli-contribution';
@@ -89,6 +89,7 @@ export const backendApplicationModule = new ContainerModule(bind => {
     bind(BackendApplicationCliContribution).toSelf().inSingletonScope();
     bind(CliContribution).toService(BackendApplicationCliContribution);
 
+    bind(EarlyExpressMiddleware).toSelf().inSingletonScope();
     bind(BackendApplication).toSelf().inSingletonScope();
     bind(RootContainer).toDynamicValue(({ container }) => {
         let root = container;
@@ -152,6 +153,7 @@ export const backendApplicationModule = new ContainerModule(bind => {
 
     bindRootContributionProvider(bind, RemoteCliContribution);
     bind(BackendRemoteService).toSelf().inSingletonScope();
+    bindRootContributionProvider(bind, BackendRequestAllowedContribution);
     bind(BackendRequestFacade).toSelf().inSingletonScope();
     bind(ConnectionHandler).toDynamicValue(
         ctx => new RpcConnectionHandler(REQUEST_SERVICE_PATH, () => ctx.container.get(BackendRequestFacade))

package/src/node/backend-application.spec.ts

@@ -19,16 +19,17 @@ import * as sinon from 'sinon';
 import { Container, ContainerModule, injectable, preDestroy } from 'inversify';
 import { bindContributionProvider, ILogger, Stopwatch } from '../common';
 import { Deferred } from '../common/promise-util';
-import { MockLogger } from '../common/test/mock-logger';
 import { NodeStopwatch } from './performance/node-stopwatch';
 import { ProcessUtils } from './process-utils';
 import {
     BackendApplication,
     BackendApplicationCliContribution,
     BackendApplicationContribution,
+    EarlyExpressMiddleware,
     RootContainer
 } from './backend-application';
 import { CliContribution } from './cli';
+import { MockLogger } from '../common/test/mock-logger';
 
 /**
  * Test subclass that exposes the protected `gracefulShutdown` for direct testing.
@@ -82,12 +83,12 @@ describe('BackendApplication', () => {
         const container = new Container();
 
         container.bind(RootContainer).toConstantValue(container);
-
         container.bind(ILogger).to(MockLogger).inSingletonScope();
         container.bind(Stopwatch).to(NodeStopwatch).inSingletonScope();
         container.bind(ProcessUtils).toSelf().inSingletonScope();
         container.bind(BackendApplicationCliContribution).toSelf().inSingletonScope();
         container.bind(CliContribution).toService(BackendApplicationCliContribution);
+        container.bind(EarlyExpressMiddleware).toSelf().inSingletonScope();
         bindContributionProvider(container, BackendApplicationContribution);
 
         container.bind(TestBackendApplication).toSelf().inSingletonScope();
@@ -242,7 +243,8 @@ describe('BackendApplication', () => {
             container.bind(BackendApplicationContribution).toConstantValue({
                 onStop: () => { secondRan = true; }
             });
-            const errorStub = sandbox.stub(console, 'error');
+            const mockLogger = container.get(ILogger) as ILogger;
+            const errorStub = sandbox.stub(mockLogger, 'error');
 
             const app = container.get(TestBackendApplication);
             await app.invokeGracefulShutdown();

package/src/node/backend-application.ts

@@ -28,6 +28,7 @@ import { Deferred, timeoutReject } from '../common/promise-util';
 import { environment } from '../common/index';
 import { AddressInfo } from 'net';
 import { ProcessUtils } from './process-utils';
+import { ILogger } from '../common/logger';
 
 /**
  * The path to the application project directory. This is the directory where the application code is located.
@@ -53,6 +54,16 @@ const DEFAULT_HOST = 'localhost';
 const DEFAULT_SSL = false;
 const DEFAULT_DNS_DEFAULT_RESULT_ORDER: DnsResultOrder = 'ipv4first';
 
+/**
+ * Shared registry for Express middleware that must run before static file handlers.
+ * Contributions push handlers during `initialize()`, and `BackendApplication`
+ * applies them at the start of `configure()`, before gzipped handlers and `express.static()`.
+ */
+@injectable()
+export class EarlyExpressMiddleware {
+    readonly handlers: express.Handler[] = [];
+}
+
 export const BackendApplicationServer = Symbol('BackendApplicationServer');
 /**
  * This service is responsible for serving the frontend files.
@@ -174,12 +185,18 @@ export class BackendApplication {
 
     protected readonly app: express.Application = express();
 
+    @inject(EarlyExpressMiddleware)
+    protected readonly earlyMiddleware: EarlyExpressMiddleware;
+
     @inject(ProcessUtils)
     protected readonly processUtils: ProcessUtils;
 
     @inject(Stopwatch)
     protected readonly stopwatch: Stopwatch;
 
+    @inject(ILogger) @named('core:BackendApplication')
+    protected readonly logger: ILogger;
+
     @inject(RootContainer)
     protected readonly rootContainer: interfaces.Container;
 
@@ -201,7 +218,7 @@ export class BackendApplication {
         // Workaround for Electron not installing a handler to ignore SIGPIPE error
         // (https://github.com/electron/electron/issues/13254)
         process.on('SIGPIPE', () => {
-            console.error(new Error('Unexpected SIGPIPE'));
+            this.logger.error(new Error('Unexpected SIGPIPE'));
         });
 
         // Handles normal process termination.
@@ -221,7 +238,7 @@ export class BackendApplication {
                     await this.measureContribution(contribution, 'initialize',
                         () => contribution.initialize!());
                 } catch (error) {
-                    console.error('Could not initialize contribution', error);
+                    this.logger.error('Could not initialize contribution', error);
                 }
             }
         }));
@@ -240,6 +257,11 @@ export class BackendApplication {
     protected async configure(): Promise<void> {
         await this.initialize();
 
+        // Apply early middleware before static file handlers.
+        for (const handler of this.earlyMiddleware.handlers) {
+            this.app.use(handler);
+        }
+
         this.app.get('*.js', this.serveGzipped.bind(this, 'text/javascript'));
         this.app.get('*.js.map', this.serveGzipped.bind(this, 'application/json'));
         this.app.get('*.css', this.serveGzipped.bind(this, 'text/css'));
@@ -258,11 +280,11 @@ export class BackendApplication {
                     await this.measureContribution(contribution, 'configure',
                         () => contribution.configure!(this.app));
                 } catch (error) {
-                    console.error('Could not configure contribution', error);
+                    this.logger.error('Could not configure contribution', error);
                 }
             }
         }));
-        console.info('configured all backend app contributions');
+        this.logger.info('configured all backend app contributions');
     }
 
     use(...handlers: express.Handler[]): void {
@@ -297,14 +319,14 @@ export class BackendApplication {
             try {
                 key = await fs.readFile(this.cliParams.certkey as string);
             } catch (err) {
-                console.error("Can't read certificate key");
+                this.logger.error("Can't read certificate key");
                 throw err;
             }
 
             try {
                 cert = await fs.readFile(this.cliParams.cert as string);
             } catch (err) {
-                console.error("Can't read certificate");
+                this.logger.error("Can't read certificate");
                 throw err;
             }
             server = https.createServer({ key, cert }, this.app);
@@ -323,7 +345,7 @@ export class BackendApplication {
             // address should be defined at this point
             const address = server.address()!;
             const url = typeof address === 'string' ? address : this.getHttpUrl(address, this.cliParams.ssl);
-            console.info(`Theia app listening on ${url}.`);
+            this.logger.info(`Theia app listening on ${url}.`);
             deferred.resolve(server);
         });
 
@@ -336,7 +358,7 @@ export class BackendApplication {
                     await this.measureContribution(contribution, 'onStart',
                         () => contribution.onStart!(server));
                 } catch (error) {
-                    console.error('Could not start contribution', error);
+                    this.logger.error('Could not start contribution', error);
                 }
             }
         }
@@ -415,7 +437,7 @@ export class BackendApplication {
                 try {
                     await contrib.onStop(this.app);
                 } catch (error) {
-                    console.error('Could not stop contribution', error);
+                    this.logger.error('Could not stop contribution', error);
                 }
             }
         }));
@@ -466,9 +488,9 @@ export class BackendApplication {
 
     protected handleUncaughtError(error: Error): void {
         if (error) {
-            console.error('Uncaught Exception: ', error.toString());
+            this.logger.error('Uncaught Exception: ', error.toString());
             if (error.stack) {
-                console.error(error.stack);
+                this.logger.error(error.stack);
             }
         }
     }

package/src/node/hosting/backend-hosting-module.ts

@@ -15,12 +15,22 @@
 // *****************************************************************************
 
 import { ContainerModule } from 'inversify';
+import { BackendApplicationContribution } from '../backend-application';
 import { WsRequestValidatorContribution } from '../ws-request-validators';
 import { BackendApplicationHosts } from './backend-application-hosts';
+import {
+    BrowserConnectionToken, BrowserConnectionTokenBackendContribution, createBrowserConnectionToken
+} from './browser-connection-token';
 import { WsOriginValidator } from './ws-origin-validator';
 
 export default new ContainerModule(bind => {
     bind(BackendApplicationHosts).toSelf().inSingletonScope();
     bind(WsOriginValidator).toSelf().inSingletonScope();
     bind(WsRequestValidatorContribution).toService(WsOriginValidator);
+
+    // Cookie-based connection token protects both HTTP and WebSocket endpoints.
+    bind(BrowserConnectionToken).toConstantValue(createBrowserConnectionToken());
+    bind(BrowserConnectionTokenBackendContribution).toSelf().inSingletonScope();
+    bind(BackendApplicationContribution).toService(BrowserConnectionTokenBackendContribution);
+    bind(WsRequestValidatorContribution).toService(BrowserConnectionTokenBackendContribution);
 });