@theia/core 1.74.0-next.5 → 1.74.0-next.51

package/src/node/hosting/browser-connection-token.spec.ts

@@ -16,6 +16,7 @@
 
 import { expect } from 'chai';
 import * as http from 'http';
+import { environment } from '../../common';
 import {
     BrowserConnectionToken,
     BrowserConnectionTokenBackendContribution,
@@ -164,4 +165,95 @@ describe('BrowserConnectionTokenBackendContribution', () => {
             expect(result.cookieCalls[0].value).to.equal(token.value);
         });
     });
+
+    describe('validateRequest (HTTP token enforcement)', () => {
+
+        interface ValidationResult {
+            nextCalled: boolean;
+            sentStatus?: number;
+        }
+
+        function callValidate(cookieValue?: string): ValidationResult {
+            const contribution = createContribution();
+            const result: ValidationResult = { nextCalled: false };
+
+            const req = { headers: {} as Record<string, string | undefined> };
+            if (cookieValue !== undefined) {
+                req.headers.cookie = `${BROWSER_TOKEN_COOKIE_NAME}=${cookieValue}`;
+            }
+
+            const res = {
+                sendStatus: (status: number) => { result.sentStatus = status; }
+            };
+
+            const next = (): void => { result.nextCalled = true; };
+
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).validateRequest(req, res, next);
+            return result;
+        }
+
+        it('should allow request with valid token cookie', () => {
+            const result = callValidate(token.value);
+            expect(result.nextCalled).to.be.true;
+            expect(result.sentStatus).to.be.undefined;
+        });
+
+        it('should reject request with no cookie', () => {
+            const result = callValidate();
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with invalid token', () => {
+            const result = callValidate('wrong-token');
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with stale token from previous server', () => {
+            const staleToken = createBrowserConnectionToken().value;
+            const result = callValidate(staleToken);
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+
+        it('should reject request with empty token', () => {
+            const result = callValidate('');
+            expect(result.nextCalled).to.be.false;
+            expect(result.sentStatus).to.equal(403);
+        });
+    });
+
+    describe('Electron deployment (no-op)', () => {
+
+        let originalIsElectron: () => boolean;
+
+        beforeEach(() => {
+            originalIsElectron = environment.electron.is;
+            environment.electron.is = () => true;
+        });
+
+        afterEach(() => {
+            environment.electron.is = originalIsElectron;
+        });
+
+        it('validateRequest should call next() without a cookie', () => {
+            const contribution = createContribution();
+            let nextCalled = false;
+            let sentStatus: number | undefined;
+            const req = { headers: {} as Record<string, string | undefined> };
+            const res = { sendStatus: (status: number) => { sentStatus = status; } };
+            const next = (): void => { nextCalled = true; };
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            (contribution as any).validateRequest(req, res, next);
+            expect(nextCalled).to.be.true;
+            expect(sentStatus).to.be.undefined;
+        });
+
+        it('allowWsUpgrade should return true without a cookie', () => {
+            const contribution = createContribution();
+            expect(contribution.allowWsUpgrade(createRequest())).to.be.true;
+        });
+    });
 });

package/src/node/hosting/browser-connection-token.ts

@@ -33,6 +33,26 @@ export interface BrowserConnectionToken {
     value: string;
 }
 
+export const HttpConnectionValidator = Symbol('HttpConnectionValidator');
+
+/**
+ * Express middleware provider that rejects HTTP requests lacking a valid connection token.
+ *
+ * The connection-token cookie is only *bootstrapped* globally (see
+ * {@link BrowserConnectionTokenBackendContribution}); enforcement is opt-in per route.
+ * Security-sensitive HTTP endpoints (e.g. the filesystem upload/download routes) should
+ * inject this and apply {@link validateRequest} as route middleware. Non-sensitive routes
+ * (the initial HTML page, static assets) must not use it, as they legitimately have no
+ * cookie yet on the very first page load.
+ */
+export interface HttpConnectionValidator {
+    /**
+     * Express middleware that calls `next()` when the request carries a valid connection-token
+     * cookie (or when running in Electron) and responds with `403` otherwise.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void;
+}
+
 /**
  * Validates WebSocket and HTTP requests using a cookie-based connection token.
  *
@@ -40,13 +60,18 @@ export interface BrowserConnectionToken {
  * as a `SameSite=Strict; HttpOnly` cookie on the first page load. Cross-origin pages
  * cannot obtain or send this cookie, so their requests are rejected.
  *
+ * The cookie is *bootstrapped* for every HTTP request (via {@link expressMiddleware}) so that
+ * browsers always receive it, but HTTP requests are only *rejected* on routes that opt in to
+ * enforcement via {@link validateRequest} (see {@link HttpConnectionValidator}). WebSocket
+ * upgrades are always validated (see {@link allowWsUpgrade}).
+ *
  * This complements the origin validator: non-browser callers that omit the Origin
  * header (e.g. Node.js scripts) still cannot reach the backend without the cookie.
  *
  * Skipped in Electron deployments (which use their own `ElectronSecurityToken`).
  */
 @injectable()
-export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution {
+export class BrowserConnectionTokenBackendContribution implements BackendApplicationContribution, WsRequestValidatorContribution, HttpConnectionValidator {
 
     @inject(BrowserConnectionToken)
     protected readonly browserConnectionToken: BrowserConnectionToken;
@@ -84,6 +109,25 @@ export class BrowserConnectionTokenBackendContribution implements BackendApplica
         return false;
     }
 
+    /**
+     * Reject the request with `403` unless it carries a valid connection-token cookie.
+     * Always allows the request in Electron deployments, consistent with {@link allowWsUpgrade}.
+     */
+    validateRequest(req: express.Request, res: express.Response, next: express.NextFunction): void {
+        if (environment.electron.is()) {
+            next();
+            return;
+        }
+        const token = this.getTokenFromCookie(req);
+        if (token && this.isTokenValid(token)) {
+            next();
+            return;
+        }
+        // No cookie or stale/invalid token: reject. Legitimate browsers always have the cookie
+        // because it is set on the initial page load, and same-origin requests send it automatically.
+        res.sendStatus(403);
+    }
+
     protected expressMiddleware(req: express.Request, res: express.Response, next: express.NextFunction): void {
         const existing = this.getTokenFromCookie(req);
         if (!existing || !this.isTokenValid(existing)) {

package/src/node/index.ts

@@ -23,3 +23,4 @@ export * from './cli';
 export * from './setting-service';
 export { FileSystemLocking } from './filesystem-locking';
 export { BackendRequestAllowedContribution } from './request/backend-request-facade';
+export { HttpConnectionValidator } from './hosting/browser-connection-token';