@theia/core 1.73.0-next.9 → 1.73.1

package/src/node/messaging/default-messaging-service.ts

@@ -22,6 +22,7 @@ import Route = require('route-parser');
 import { Channel, ChannelMultiplexer } from '../../common/message-rpc/channel';
 import { FrontendConnectionService } from './frontend-connection-service';
 import { BackendApplicationContribution } from '../backend-application';
+import { ILogger } from '../../common/logger';
 
 export const MessagingContainer = Symbol('MessagingContainer');
 export const MainChannel = Symbol('MainChannel');
@@ -37,6 +38,9 @@ export class DefaultMessagingService implements MessagingService, BackendApplica
     @inject(ContributionProvider) @named(ConnectionContainerModule)
     protected readonly connectionModules: ContributionProvider<interfaces.ContainerModule>;
 
+    @inject(ILogger) @named('core:DefaultMessagingService')
+    protected readonly logger: ILogger;
+
     @inject(ContributionProvider) @named(MessagingService.Contribution)
     protected readonly contributions: ContributionProvider<MessagingService.Contribution>;
 
@@ -62,8 +66,8 @@ export class DefaultMessagingService implements MessagingService, BackendApplica
         const channelHandlers = this.getConnectionChannelHandlers(channel);
         multiplexer.onDidOpenChannel(event => {
             if (channelHandlers.route(event.id, event.channel)) {
-                console.debug(`Opening channel for service path '${event.id}'.`);
-                event.channel.onClose(() => console.info(`Closing channel on service path '${event.id}'.`));
+                this.logger.debug(`Opening channel for service path '${event.id}'.`);
+                event.channel.onClose(() => this.logger.info(`Closing channel on service path '${event.id}'.`));
             }
         });
     }

package/src/node/messaging/test/default-messaging-service.spec.ts

@@ -16,13 +16,14 @@
 
 import { expect } from 'chai';
 import { Container, injectable, preDestroy } from 'inversify';
-import { ConnectionHandler, bindContributionProvider, servicesPath } from '../../../common';
+import { ConnectionHandler, bindContributionProvider, servicesPath, ILogger } from '../../../common';
 import { BasicChannel, Channel } from '../../../common/message-rpc/channel';
 import { Uint8ArrayWriteBuffer } from '../../../common/message-rpc/uint8-array-message-buffer';
 import { ConnectionContainerModule } from '../connection-container-module';
 import { DefaultMessagingService, MessagingContainer } from '../default-messaging-service';
 import { FrontendConnectionService } from '../frontend-connection-service';
 import { MessagingService } from '../messaging-service';
+import { MockLogger } from '../../../common/test/mock-logger';
 
 describe('DefaultMessagingService', () => {
 
@@ -63,6 +64,7 @@ describe('DefaultMessagingService', () => {
                 }
             };
             container.bind(FrontendConnectionService).toConstantValue(frontendConnectionService);
+            container.bind(ILogger).to(MockLogger).inSingletonScope();
 
             const messagingService = container.get(DefaultMessagingService);
             messagingService.initialize();

package/src/node/messaging/websocket-endpoint.ts

@@ -16,12 +16,13 @@
 import { MessagingService } from './messaging-service';
 import * as http from 'http';
 import * as https from 'https';
-import { inject, injectable } from 'inversify';
+import { inject, injectable, named } from 'inversify';
 import { Server, Socket } from 'socket.io';
 import { WsRequestValidator } from '../ws-request-validators';
 import { MessagingListener } from './messaging-listeners';
 import { ConnectionHandlers } from './default-messaging-service';
 import { BackendApplicationContribution } from '../backend-application';
+import { ILogger } from '../../common/logger';
 
 @injectable()
 export class WebsocketEndpoint implements BackendApplicationContribution {
@@ -31,6 +32,9 @@ export class WebsocketEndpoint implements BackendApplicationContribution {
     @inject(MessagingListener)
     protected readonly messagingListener: MessagingListener;
 
+    @inject(ILogger) @named('core:WebsocketEndpoint')
+    protected readonly logger: ILogger;
+
     protected checkAliveTimeout = 30000; // 30 seconds
     protected maxHttpBufferSize = 1e8; // 100 MB
 
@@ -44,14 +48,21 @@ export class WebsocketEndpoint implements BackendApplicationContribution {
         const socketServer = new Server(server, {
             pingInterval: this.checkAliveTimeout,
             pingTimeout: this.checkAliveTimeout * 2,
-            maxHttpBufferSize: this.maxHttpBufferSize
+            maxHttpBufferSize: this.maxHttpBufferSize,
+            allowRequest: (req, callback) => {
+                // eslint-disable-next-line no-null/no-null
+                const noError = null;
+                this.wsRequestValidator.allowWsUpgrade(req).then(
+                    allowed => callback(noError, allowed),
+                    error => {
+                        console.error('Error during WebSocket allowRequest validation:', error);
+                        callback(error?.message ?? 'Validation error', false);
+                    }
+                );
+            }
         });
         // Accept every namespace by using /.*/
         socketServer.of(/.*/).on('connection', async socket => {
-            const request = socket.request;
-            // Socket.io strips the `origin` header of the incoming request
-            // We provide a `fix-origin` header in the `WebSocketConnectionProvider`
-            request.headers.origin = request.headers['fix-origin'] as string;
             if (await this.allowConnect(socket.request)) {
                 await this.handleConnection(socket);
                 this.messagingListener.onDidWebSocketUpgrade(socket.request, socket);
@@ -61,6 +72,11 @@ export class WebsocketEndpoint implements BackendApplicationContribution {
         });
     }
 
+    /**
+     * Secondary validation after connection. The primary check happens in the
+     * Socket.IO `allowRequest` callback at handshake time; this is kept as
+     * defense-in-depth in case a Socket.IO upgrade path bypasses `allowRequest`.
+     */
     protected async allowConnect(request: http.IncomingMessage): Promise<boolean> {
         try {
             return this.wsRequestValidator.allowWsUpgrade(request);
@@ -72,7 +88,7 @@ export class WebsocketEndpoint implements BackendApplicationContribution {
     protected async handleConnection(socket: Socket): Promise<void> {
         const pathname = socket.nsp.name;
         if (pathname && !this.wsHandlers.route(pathname, socket)) {
-            console.error('Cannot find a ws handler for the path: ' + pathname);
+            this.logger.error('Cannot find a ws handler for the path: ' + pathname);
         }
     }
 }

package/src/node/process-utils.spec.ts

@@ -15,8 +15,11 @@
 // *****************************************************************************
 
 import { expect } from 'chai';
+import * as sinon from 'sinon';
 import { Container } from 'inversify';
 import { ProcessUtils } from './process-utils';
+import { ILogger } from '../common';
+import { MockLogger } from '../common/test/mock-logger';
 
 /** PPID, PID */
 const mockPsOutput = `\
@@ -36,6 +39,8 @@ describe('ProcessUtils', () => {
     beforeEach(() => {
         const container = new Container();
         container.bind(ProcessUtils).toSelf().inSingletonScope();
+        container.bind(ILogger).to(MockLogger).inSingletonScope();
+
         coreProcessManager = container.get(ProcessUtils);
     });
 
@@ -48,8 +53,7 @@ describe('ProcessUtils', () => {
 
     describe('#unixTerminateProcessTree', () => {
         let originalKill: typeof process.kill;
-        let originalConsoleError: typeof console.error;
-        let loggedErrors: unknown[];
+        let errorStub: sinon.SinonStub;
 
         function throwingKill(code: string): typeof process.kill {
             return (() => {
@@ -61,9 +65,8 @@ describe('ProcessUtils', () => {
 
         beforeEach(() => {
             originalKill = process.kill;
-            originalConsoleError = console.error;
-            loggedErrors = [];
-            console.error = (...args: unknown[]) => { loggedErrors.push(args); };
+            const mockLogger = (coreProcessManager as unknown as { logger: ILogger }).logger;
+            errorStub = sinon.stub(mockLogger, 'error');
             // One child plus the parent; report the parent as its own group leader so the `kill(-ppid)` branch runs too.
             coreProcessManager['unixGetChildrenRecursive'] = () => new Set([424242]);
             coreProcessManager['unixGetPGID'] = (pid: number) => pid;
@@ -71,26 +74,26 @@ describe('ProcessUtils', () => {
 
         afterEach(() => {
             process.kill = originalKill;
-            console.error = originalConsoleError;
+            sinon.restore();
         });
 
         it('does not throw or log when processes in the tree are already gone (ESRCH)', () => {
             process.kill = throwingKill('ESRCH');
             expect(() => coreProcessManager['unixTerminateProcessTree'](424243)).to.not.throw();
-            expect(loggedErrors).to.be.empty;
+            expect(errorStub.called).to.be.false;
         });
 
         it('logs unexpected kill errors (e.g. EPERM) without throwing', () => {
             process.kill = throwingKill('EPERM');
             expect(() => coreProcessManager['unixTerminateProcessTree'](424243)).to.not.throw();
-            expect(loggedErrors).to.not.be.empty;
+            expect(errorStub.called).to.be.true;
         });
 
         it('does not throw when a kill rejects with a value that has no code (e.g. undefined)', () => {
             const thrown: unknown = undefined;
             process.kill = (() => { throw thrown; }) as typeof process.kill;
             expect(() => coreProcessManager['unixTerminateProcessTree'](424243)).to.not.throw();
-            expect(loggedErrors).to.not.be.empty;
+            expect(errorStub.called).to.be.true;
         });
     });
 });

package/src/node/process-utils.ts

@@ -15,7 +15,8 @@
 // *****************************************************************************
 
 import * as cp from 'child_process';
-import { injectable } from 'inversify';
+import { injectable, inject, named } from 'inversify';
+import { ILogger } from '../common/logger';
 
 /**
  * `@theia/core` service with some process-related utilities.
@@ -23,6 +24,9 @@ import { injectable } from 'inversify';
 @injectable()
 export class ProcessUtils {
 
+    @inject(ILogger) @named('core:ProcessUtils')
+    protected readonly logger: ILogger;
+
     terminateProcessTree(ppid: number): void {
         if (process.platform === 'win32') {
             this.winTerminateProcessTree(ppid);
@@ -39,7 +43,7 @@ export class ProcessUtils {
         // taskkill may exit with a non-zero code when some child processes have already exited.
         // This is expected during shutdown — log but don't throw.
         if (result.status !== 0) {
-            console.warn(`taskkill.exe exited with ${result.status} for PID ${ppid}. Output:\n${JSON.stringify(result.output)}`);
+            this.logger.warn(`taskkill.exe exited with ${result.status} for PID ${ppid}. Output:\n${JSON.stringify(result.output)}`);
         }
     }
 
@@ -66,7 +70,7 @@ export class ProcessUtils {
             // ESRCH means the process is already gone, which is the goal here. Log
             // anything else but keep going so the rest of the tree is still killed.
             if ((error as NodeJS.ErrnoException | undefined)?.code !== 'ESRCH') {
-                console.error(`[${pid}] failed to kill`, error);
+                this.logger.error(`[${pid}] failed to kill`, error);
             }
         }
     }

package/src/node/request/backend-request-facade.spec.ts

@@ -0,0 +1,203 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as sinon from 'sinon';
+import { BackendRequestFacade, isUrlAllowed } from './backend-request-facade';
+import { BackendApplicationConfigProvider } from '../backend-application-config-provider';
+
+describe('isUrlAllowed', () => {
+
+    it('should allow a URL that matches an exact origin pattern', () => {
+        const patterns = ['https://open-vsx.org'];
+        expect(isUrlAllowed('https://open-vsx.org/api/extensions', patterns)).to.be.true;
+    });
+
+    it('should allow a URL with a path when pattern has no path', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com/some/deep/path?query=1', patterns)).to.be.true;
+    });
+
+    it('should allow a URL that exactly matches the origin', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com', patterns)).to.be.true;
+        expect(isUrlAllowed('https://example.com/', patterns)).to.be.true;
+    });
+
+    it('should reject a URL with a different scheme', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('http://example.com/path', patterns)).to.be.false;
+    });
+
+    it('should reject a URL with a different host', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://evil.com/path', patterns)).to.be.false;
+    });
+
+    it('should reject a URL with a different port', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com:8443/path', patterns)).to.be.false;
+    });
+
+    it('should allow a URL when port matches explicitly', () => {
+        const patterns = ['https://example.com:8443'];
+        expect(isUrlAllowed('https://example.com:8443/path', patterns)).to.be.true;
+    });
+
+    it('should treat default ports as equivalent', () => {
+        const patterns = ['https://example.com:443'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.true;
+
+        const httpPatterns = ['http://example.com:80'];
+        expect(isUrlAllowed('http://example.com/path', httpPatterns)).to.be.true;
+
+        const implicitPatterns = ['http://example.com'];
+        expect(isUrlAllowed('http://example.com:80/path', implicitPatterns)).to.be.true;
+    });
+
+    it('should match wildcard subdomains', () => {
+        const patterns = ['https://*.example.com'];
+        expect(isUrlAllowed('https://foo.example.com/path', patterns)).to.be.true;
+        expect(isUrlAllowed('https://bar.baz.example.com/path', patterns)).to.be.true;
+    });
+
+    it('should not match the bare domain with a wildcard subdomain pattern', () => {
+        const patterns = ['https://*.example.com'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.false;
+    });
+
+    it('should reject non-http(s) schemes', () => {
+        const patterns = ['file:///etc/passwd'];
+        expect(isUrlAllowed('file:///etc/passwd', patterns)).to.be.false;
+    });
+
+    it('should reject ftp scheme', () => {
+        const patterns = ['ftp://files.example.com'];
+        expect(isUrlAllowed('ftp://files.example.com/data', patterns)).to.be.false;
+    });
+
+    it('should reject a URL when target uses non-http(s) scheme even if patterns exist', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('file:///etc/passwd', patterns)).to.be.false;
+        expect(isUrlAllowed('ftp://example.com/data', patterns)).to.be.false;
+    });
+
+    it('should reject all URLs when allowlist is empty', () => {
+        expect(isUrlAllowed('https://example.com', [])).to.be.false;
+        expect(isUrlAllowed('http://localhost:3000', [])).to.be.false;
+    });
+
+    it('should reject invalid URLs', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('not a url', patterns)).to.be.false;
+        expect(isUrlAllowed('', patterns)).to.be.false;
+    });
+
+    it('should allow private IPs only when explicitly in the allowlist', () => {
+        expect(isUrlAllowed('http://127.0.0.1:8080/secret', [])).to.be.false;
+        expect(isUrlAllowed('http://127.0.0.1:8080/secret', ['https://example.com'])).to.be.false;
+
+        const patternsWithLoopback = ['http://127.0.0.1:8080'];
+        expect(isUrlAllowed('http://127.0.0.1:8080/secret', patternsWithLoopback)).to.be.true;
+    });
+
+    it('should reject cloud metadata endpoint by default', () => {
+        expect(isUrlAllowed('http://169.254.169.254/latest/meta-data/', [])).to.be.false;
+        expect(isUrlAllowed('http://169.254.169.254/latest/meta-data/', ['https://example.com'])).to.be.false;
+    });
+
+    it('should merge multiple patterns correctly', () => {
+        const patterns = [
+            'https://open-vsx.org',
+            'https://marketplace.example.com',
+            'https://*.cdn.example.com'
+        ];
+        expect(isUrlAllowed('https://open-vsx.org/api/v2/extensions', patterns)).to.be.true;
+        expect(isUrlAllowed('https://marketplace.example.com/download', patterns)).to.be.true;
+        expect(isUrlAllowed('https://files.cdn.example.com/ext.vsix', patterns)).to.be.true;
+        expect(isUrlAllowed('https://evil.com/malware', patterns)).to.be.false;
+    });
+
+    it('should handle patterns with trailing slashes', () => {
+        const patterns = ['https://example.com/'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.true;
+    });
+
+    it('should handle invalid patterns gracefully', () => {
+        const patterns = ['not a valid pattern', 'https://example.com'];
+        expect(isUrlAllowed('https://example.com/path', patterns)).to.be.true;
+        expect(isUrlAllowed('https://other.com/path', patterns)).to.be.false;
+    });
+
+    it('should prevent host spoofing via subdomain prefix', () => {
+        const patterns = ['https://example.com'];
+        expect(isUrlAllowed('https://example.com.evil.com/path', patterns)).to.be.false;
+    });
+});
+
+describe('BackendRequestFacade', () => {
+
+    describe('configure', () => {
+
+        let configProviderStub: sinon.SinonStub;
+
+        beforeEach(() => {
+            configProviderStub = sinon.stub(BackendApplicationConfigProvider, 'get');
+        });
+
+        afterEach(() => {
+            configProviderStub.restore();
+        });
+
+        it('should be a no-op when configureProxyFromPreferences is false', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: false
+            });
+
+            const facade = new BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (facade as any).requestService = {
+                configure: configureStub
+            };
+            await facade.configure({ proxyUrl: 'http://evil.com', strictSSL: false });
+            expect(configureStub.called).to.be.false;
+        });
+
+        it('should pass through to the underlying request service when configureProxyFromPreferences is true', async () => {
+            configProviderStub.returns({
+                singleInstance: true,
+                frontendConnectionTimeout: 0,
+                configurationFolder: '.theia',
+                configureProxyFromPreferences: true
+            });
+
+            const facade = new BackendRequestFacade();
+            const configureStub = sinon.stub().resolves();
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (facade as any).requestService = {
+                configure: configureStub
+            };
+            const config = { proxyUrl: 'http://my-proxy.com:8080', strictSSL: true, proxyAuthorization: 'Bearer token' };
+            await facade.configure(config);
+            expect(configureStub.calledOnce).to.be.true;
+            expect(configureStub.firstCall.args[0]).to.deep.equal(config);
+        });
+    });
+});

package/src/node/request/backend-request-facade.ts

@@ -14,8 +14,87 @@
  * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
  ********************************************************************************/
 
-import { inject, injectable } from 'inversify';
+import { inject, injectable, named, optional } from 'inversify';
 import { RequestConfiguration, RequestContext, RequestOptions, RequestService } from '@theia/request';
+import { ContributionProvider, MaybePromise } from '../../common';
+import { BackendApplicationConfigProvider } from '../backend-application-config-provider';
+
+export const BackendRequestAllowedContribution = Symbol('BackendRequestAllowedContribution');
+export interface BackendRequestAllowedContribution {
+    /**
+     * Returns URL patterns that should be allowed through the backend request facade.
+     * Patterns are matched against request URLs.
+     *
+     * Supports:
+     * - Exact base URLs: `https://open-vsx.org` (allows any path under this origin)
+     * - Wildcard subdomains: `https://*.github.com` (allows any subdomain)
+     *
+     * Only `http:` and `https:` schemes are permitted.
+     */
+    getAllowedUrlPatterns(): MaybePromise<string[]>;
+}
+
+const ALLOWED_SCHEMES = new Set(['http:', 'https:']);
+
+export function isUrlAllowed(url: string, allowedPatterns: string[]): boolean {
+    let parsed: URL;
+    try {
+        parsed = new URL(url);
+    } catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+        return false;
+    }
+    for (const pattern of allowedPatterns) {
+        if (matchesPattern(parsed, pattern)) {
+            return true;
+        }
+    }
+    return false;
+}
+
+function matchesPattern(target: URL, pattern: string): boolean {
+    let patternUrl: URL;
+    try {
+        patternUrl = new URL(pattern);
+    } catch {
+        return false;
+    }
+    if (!ALLOWED_SCHEMES.has(patternUrl.protocol)) {
+        return false;
+    }
+    if (target.protocol !== patternUrl.protocol) {
+        return false;
+    }
+    const targetPort = getEffectivePort(target);
+    const patternPort = getEffectivePort(patternUrl);
+    if (targetPort !== patternPort) {
+        return false;
+    }
+    return matchesHost(target.hostname, patternUrl.hostname);
+}
+
+function getEffectivePort(url: URL): string {
+    if (url.port) {
+        return url.port;
+    }
+    if (url.protocol === 'https:') {
+        return '443';
+    }
+    if (url.protocol === 'http:') {
+        return '80';
+    }
+    return '';
+}
+
+function matchesHost(targetHost: string, patternHost: string): boolean {
+    if (patternHost.startsWith('*.')) {
+        const suffix = patternHost.substring(1); // e.g. ".example.com"
+        return targetHost.endsWith(suffix) && targetHost.length > suffix.length;
+    }
+    return targetHost === patternHost;
+}
 
 @injectable()
 export class BackendRequestFacade implements RequestService {
@@ -23,11 +102,23 @@ export class BackendRequestFacade implements RequestService {
     @inject(RequestService)
     protected readonly requestService: RequestService;
 
-    configure(config: RequestConfiguration): Promise<void> {
-        return this.requestService.configure(config);
+    @inject(ContributionProvider) @named(BackendRequestAllowedContribution) @optional()
+    protected readonly allowedContributions?: ContributionProvider<BackendRequestAllowedContribution>;
+
+    protected cachedAllowedPatterns: string[] | undefined;
+
+    async configure(config: RequestConfiguration): Promise<void> {
+        if (BackendApplicationConfigProvider.get().configureProxyFromPreferences) {
+            return this.requestService.configure(config);
+        }
     }
 
     async request(options: RequestOptions): Promise<RequestContext> {
+        const patterns = await this.getAllowedPatterns();
+        const url = options.url;
+        if (!url || !isUrlAllowed(url, patterns)) {
+            throw new Error(`Request to URL '${url}' is not allowed. The URL does not match any allowed pattern.`);
+        }
         const context = await this.requestService.request(options);
         return RequestContext.compress(context);
     }
@@ -36,4 +127,18 @@ export class BackendRequestFacade implements RequestService {
         return this.requestService.resolveProxy(url);
     }
 
+    protected async getAllowedPatterns(): Promise<string[]> {
+        if (this.cachedAllowedPatterns) {
+            return this.cachedAllowedPatterns;
+        }
+        const patterns: string[] = [];
+        if (this.allowedContributions) {
+            for (const contribution of this.allowedContributions.getContributions()) {
+                const contributed = await contribution.getAllowedUrlPatterns();
+                patterns.push(...contributed);
+            }
+        }
+        this.cachedAllowedPatterns = patterns;
+        return patterns;
+    }
 }