npm - @theia/filesystem - Versions diffs - 1.74.0-next.8 → 1.74.0 - Mend

@theia/filesystem 1.74.0-next.8 → 1.74.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/lib/node/disk-file-system-provider.spec.js CHANGED Viewed

@@ -24,6 +24,7 @@ const ipc_connection_provider_1 = require("@theia/core/lib/node/messaging/ipc-co
 const inversify_1 = require("@theia/core/shared/inversify");
 const assert_1 = require("assert");
 const fs_1 = require("fs");
+const os = require("os");
 const path_1 = require("path");
 const temp = require("temp");
 const uuid_1 = require("@theia/core/lib/common/uuid");
@@ -96,7 +97,10 @@ describe('disk-file-system-provider', () => {
         });
         it('delete is able to delete file', async function () {
             this.timeout(10000);
-            const tempDirPath = tracked.mkdirSync();
+            // Place the temp dir under $HOME so the XDG trash dir (~/.local/share/Trash) is on the same
+            // filesystem. Otherwise the trash spec falls back to creating `.Trash-$UID` at the mount's
+            // topdir, which fails when /tmp is on a filesystem whose root is not user-writable.
+            const tempDirPath = tracked.mkdirSync({ dir: os.homedir(), prefix: 'theia-fs-test-' });
             const testFile = (0, path_1.join)(tempDirPath, 'test.file');
             const testFileUri = file_uri_1.FileUri.create(testFile);
             for (const recursive of [true, false]) {

package/lib/node/disk-file-system-provider.spec.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"disk-file-system-provider.spec.js","sourceRoot":"","sources":["../../src/node/disk-file-system-provider.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,4CAA4C;AAC5C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,kEAAqF;AACrF,8EAA0E;AAC1E,0DAAwD;AACxD,yEAAqE;AACrE,8DAA0D;AAC1D,oGAA+F;AAC/F,4DAA0E;AAC1E,mCAAqC;AACrC,2BAAoC;AACpC,+BAA4B;AAC5B,6BAA6B;AAC7B,sDAA2D;AAC3D,2CAAuI;AACvI,2EAAqE;AACrE,2EAA0E;AAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;AAE7B,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACvC,IAAI,cAAoC,CAAC;IACzC,IAAI,UAAkC,CAAC;IAEvC,MAAM,CAAC,GAAG,EAAE;QACR,UAAU,GAAG,eAAe,EAAE,CAAC,GAAG,CAC9B,kDAAsB,CACzB,CAAC;QACF,cAAc,GAAG,IAAI,iCAAoB,CACrC,UAAU,EACV,uBAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CACjD,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACP,cAAc,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE;QAClB,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;YACvG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,GAAG,IAAA,mBAAY,GAAE,MAAM,CAAC,CAAC;YAChE,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAEvE,IAAI,OAAO,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAA,cAAK,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAE/B,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAExE,OAAO,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,IAAA,cAAK,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAEhC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,kBAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,IAAA,cAAK,EAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;YACvG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,GAAG,IAAA,mBAAY,GAAE,MAAM,CAAC,CAAC;YAChE,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,kBAAkB,EAAE;gBACjD,QAAQ,EAAE,MAAM;aACnB,CAAC,CAAC;YAEH,MAAM,aAAE,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;YAEvE,IAAI,CAAC;gBACD,MAAM,UAAU,CAAC,SAAS,CAAC,kBAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/G,IAAA,aAAI,EAAC,yDAAyD,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAA,cAAK,EAAC,GAAG,YAAY,+BAAuB,EAAE,IAAI,CAAC,CAAC;gBACpD,IAAA,cAAK,EAA2B,GAAI,CAAC,IAAI,EAAE,mCAA2B,CAAC,aAAa,CAAC,CAAC;YAC1F,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,IAAA,cAAK,EAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAEnC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,kBAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,IAAA,cAAK,EAAC,IAAI,CAAC,WAAW,EAAE,sBAAc,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACpB,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,kBAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,KAAK,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,YAAY,uDAAwC,CAAC,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACtF,SAAS;gBACb,CAAC;gBACD,MAAM,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,SAAS,EAAE,CAAC;oBACZ,MAAM,UAAU,CAAC,SAAS,CAAC,kBAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnI,MAAM,UAAU,CAAC,KAAK,CAAC,kBAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK;YACrC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;~~YACxC~~,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,kBAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,KAAK,MAAM,QAAQ,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnC,MAAM,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjG,MAAM,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,SAAS,eAAe;QACpB,MAAM,SAAS,GAAG,IAAI,qBAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,2BAAe,CAAC,IAAI,CAAC,EAAE;YACtC,IAAI,CAAC,kDAAsB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YACzD,IAAI,CAAC,kCAAe,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YAClD,IAAA,uDAA2B,EAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,wBAAU,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,CAAC,gBAAO,CAAC,CAAC,SAAS,CAAC,wBAAU,CAAC,CAAC;YACpC,IAAI,CAAC,+CAAqB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC"}
1	+ {"version":3,"file":"disk-file-system-provider.spec.js","sourceRoot":"","sources":["../../src/node/disk-file-system-provider.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,4CAA4C;AAC5C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,kEAAqF;AACrF,8EAA0E;AAC1E,0DAAwD;AACxD,yEAAqE;AACrE,8DAA0D;AAC1D,oGAA+F;AAC/F,4DAA0E;AAC1E,mCAAqC;AACrC,2BAAoC;AACpC,yBAAyB;AACzB,+BAA4B;AAC5B,6BAA6B;AAC7B,sDAA2D;AAC3D,2CAAuI;AACvI,2EAAqE;AACrE,2EAA0E;AAE1E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;AAE7B,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACvC,IAAI,cAAoC,CAAC;IACzC,IAAI,UAAkC,CAAC;IAEvC,MAAM,CAAC,GAAG,EAAE;QACR,UAAU,GAAG,eAAe,EAAE,CAAC,GAAG,CAC9B,kDAAsB,CACzB,CAAC;QACF,cAAc,GAAG,IAAI,iCAAoB,CACrC,UAAU,EACV,uBAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CACjD,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,EAAE;QACP,cAAc,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE;QAClB,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;YACvG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,GAAG,IAAA,mBAAY,GAAE,MAAM,CAAC,CAAC;YAChE,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAEvE,IAAI,OAAO,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,IAAA,cAAK,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAE/B,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAExE,OAAO,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAChE,IAAA,cAAK,EAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAEhC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,kBAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,IAAA,cAAK,EAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;YACvG,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,GAAG,IAAA,mBAAY,GAAE,MAAM,CAAC,CAAC;YAChE,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,kBAAkB,EAAE;gBACjD,QAAQ,EAAE,MAAM;aACnB,CAAC,CAAC;YAEH,MAAM,aAAE,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;YAEvE,IAAI,CAAC;gBACD,MAAM,UAAU,CAAC,SAAS,CAAC,kBAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/G,IAAA,aAAI,EAAC,yDAAyD,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAA,cAAK,EAAC,GAAG,YAAY,+BAAuB,EAAE,IAAI,CAAC,CAAC;gBACpD,IAAA,cAAK,EAA2B,GAAI,CAAC,IAAI,EAAE,mCAA2B,CAAC,aAAa,CAAC,CAAC;YAC1F,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACtE,IAAA,cAAK,EAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAEnC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,kBAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACjE,IAAA,cAAK,EAAC,IAAI,CAAC,WAAW,EAAE,sBAAc,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACpB,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,kBAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC7C,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,uCAAuC;gBACvC,MAAM,QAAQ,GAAG,KAAK,CAAC;gBACvB,IAAI,CAAC,UAAU,CAAC,YAAY,uDAAwC,CAAC,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;oBACtF,SAAS;gBACb,CAAC;gBACD,MAAM,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAClC,IAAI,SAAS,EAAE,CAAC;oBACZ,MAAM,UAAU,CAAC,SAAS,CAAC,kBAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnI,MAAM,UAAU,CAAC,KAAK,CAAC,kBAAO,CAAC,MAAM,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChE,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK;YACrC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpB,4FAA4F;YAC5F,2FAA2F;YAC3F,oFAAoF;YACpF,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,kBAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,KAAK,MAAM,QAAQ,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnC,MAAM,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACjG,MAAM,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,SAAS,eAAe;QACpB,MAAM,SAAS,GAAG,IAAI,qBAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,2BAAe,CAAC,IAAI,CAAC,EAAE;YACtC,IAAI,CAAC,kDAAsB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YACzD,IAAI,CAAC,kCAAe,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YAClD,IAAA,uDAA2B,EAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,wBAAU,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,CAAC,gBAAO,CAAC,CAAC,SAAS,CAAC,wBAAU,CAAC,CAAC;YACpC,IAAI,CAAC,+CAAqB,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC,CAAC"}

package/lib/node/download/file-download-endpoint.d.ts CHANGED Viewed

@@ -1,11 +1,13 @@
 import { Application } from '@theia/core/shared/express';
 import { BackendApplicationContribution } from '@theia/core/lib/node/backend-application';
+import { HttpConnectionValidator } from '@theia/core/lib/node';
 import { FileDownloadHandler } from './file-download-handler';
 export declare class FileDownloadEndpoint implements BackendApplicationContribution {
     protected static PATH: string;
     protected readonly singleFileDownloadHandler: FileDownloadHandler;
     protected readonly multiFileDownloadHandler: FileDownloadHandler;
     protected readonly downloadLinkHandler: FileDownloadHandler;
+    protected readonly connectionValidator: HttpConnectionValidator;
     configure(app: Application): void;
 }
 //# sourceMappingURL=file-download-endpoint.d.ts.map

package/lib/node/download/file-download-endpoint.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"file-download-endpoint.d.ts","sourceRoot":"","sources":["../../../src/node/download/file-download-endpoint.ts"],"names":[],"mappings":"~~AAqBA~~,OAAO,EAAE,WAAW,~~EAAU~~,MAAM,4BAA4B,CAAC;~~AACjE~~,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;~~AAE1F~~,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,qBACa,oBAAqB,YAAW,8BAA8B;IAEvE,SAAS,CAAC,MAAM,CAAC,IAAI,SAAY;IAIjC,SAAS,CAAC,QAAQ,CAAC,yBAAyB,EAAE,mBAAmB,CAAC;IAIlE,SAAS,CAAC,QAAQ,CAAC,wBAAwB,EAAE,mBAAmB,CAAC;IAIjE,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;~~IAE5D~~,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI;~~CAmBpC~~"}
1	+ {"version":3,"file":"file-download-endpoint.d.ts","sourceRoot":"","sources":["../../../src/node/download/file-download-endpoint.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,WAAW,EAA0B,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,qBACa,oBAAqB,YAAW,8BAA8B;IAEvE,SAAS,CAAC,MAAM,CAAC,IAAI,SAAY;IAIjC,SAAS,CAAC,QAAQ,CAAC,yBAAyB,EAAE,mBAAmB,CAAC;IAIlE,SAAS,CAAC,QAAQ,CAAC,wBAAwB,EAAE,mBAAmB,CAAC;IAIjE,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAG5D,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;IAEhE,SAAS,CAAC,GAAG,EAAE,WAAW,GAAG,IAAI;CAqBpC"}

package/lib/node/download/file-download-endpoint.js CHANGED Viewed

@@ -19,25 +19,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FileDownloadEndpoint = void 0;
 const tslib_1 = require("tslib");
 /* eslint-disable @typescript-eslint/no-explicit-any */
-const url = require("url");
 const inversify_1 = require("@theia/core/shared/inversify");
 const body_parser_1 = require("body-parser");
 const express_1 = require("@theia/core/shared/express");
+const node_1 = require("@theia/core/lib/node");
 const file_uri_1 = require("@theia/core/lib/common/file-uri");
 const file_download_handler_1 = require("./file-download-handler");
 let FileDownloadEndpoint = class FileDownloadEndpoint {
     static { FileDownloadEndpoint_1 = this; }
     static { this.PATH = '/files'; }
     configure(app) {
+        // Reject unauthenticated/cross-origin requests to the file read endpoints.
+        const guard = (request, response, next) => this.connectionValidator.validateRequest(request, response, next);
         const router = (0, express_1.Router)();
         router.get('/download', (request, response) => this.downloadLinkHandler.handle(request, response));
         router.get('/', (request, response) => this.singleFileDownloadHandler.handle(request, response));
         router.put('/', (request, response) => this.multiFileDownloadHandler.handle(request, response));
         // Content-Type: application/json
         app.use((0, body_parser_1.json)());
-        app.use(FileDownloadEndpoint_1.PATH, router);
-        app.get('/file', (request, response) => {
-            const uri = url.parse(request.url).query;
+        app.use(FileDownloadEndpoint_1.PATH, guard, router);
+        app.get('/file', guard, (request, response) => {
+            const uri = new URL(request.url, 'http://localhost').search.slice(1);
             if (!uri) {
                 response.status(400).send('invalid uri');
                 return;
@@ -63,6 +65,10 @@ tslib_1.__decorate([
     (0, inversify_1.named)(file_download_handler_1.FileDownloadHandler.DOWNLOAD_LINK),
     tslib_1.__metadata("design:type", file_download_handler_1.FileDownloadHandler)
 ], FileDownloadEndpoint.prototype, "downloadLinkHandler", void 0);
+tslib_1.__decorate([
+    (0, inversify_1.inject)(node_1.HttpConnectionValidator),
+    tslib_1.__metadata("design:type", Object)
+], FileDownloadEndpoint.prototype, "connectionValidator", void 0);
 exports.FileDownloadEndpoint = FileDownloadEndpoint = FileDownloadEndpoint_1 = tslib_1.__decorate([
     (0, inversify_1.injectable)()
 ], FileDownloadEndpoint);

package/lib/node/download/file-download-endpoint.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"file-download-endpoint.js","sourceRoot":"","sources":["../../../src/node/download/file-download-endpoint.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;;AAEhF,uDAAuD;AAEvD,~~2BAA2B;AAC3B,~~4DAAyE;AACzE,6CAAmC;AACnC,~~wDAAiE~~;~~AAEjE~~,8DAA0D;AAC1D,mEAA8D;AAGvD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;;aAEZ,SAAI,GAAG,QAAQ,AAAX,CAAY;~~IAcjC~~,SAAS,CAAC,GAAgB;QACtB,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,iCAAiC;QACjC,GAAG,CAAC,GAAG,CAAC,IAAA,kBAAI,GAAE,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,sBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;~~QAC3C~~,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;~~YACnC~~,MAAM,GAAG,GAAG,GAAG,CAAC,~~KAAK,CAAC,~~OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;~~YACzC~~,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACzC,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,kBAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;;~~AAjCQ~~,oDAAoB;AAMV;IAFlB,IAAA,kBAAM,EAAC,2CAAmB,CAAC;IAC3B,IAAA,iBAAK,EAAC,2CAAmB,CAAC,MAAM,CAAC;sCACY,2CAAmB;uEAAC;AAI/C;IAFlB,IAAA,kBAAM,EAAC,2CAAmB,CAAC;IAC3B,IAAA,iBAAK,EAAC,2CAAmB,CAAC,KAAK,CAAC;sCACY,2CAAmB;sEAAC;AAI9C;IAFlB,IAAA,kBAAM,EAAC,2CAAmB,CAAC;IAC3B,IAAA,iBAAK,EAAC,2CAAmB,CAAC,aAAa,CAAC;sCACD,2CAAmB;iEAAC;+~~BAdnD~~,oBAAoB;IADhC,IAAA,sBAAU,GAAE;GACA,oBAAoB,~~CAmChC~~"}
1	+ {"version":3,"file":"file-download-endpoint.js","sourceRoot":"","sources":["../../../src/node/download/file-download-endpoint.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;;AAEhF,uDAAuD;AAEvD,4DAAyE;AACzE,6CAAmC;AACnC,wDAAiF;AAEjF,+CAA+D;AAC/D,8DAA0D;AAC1D,mEAA8D;AAGvD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;;aAEZ,SAAI,GAAG,QAAQ,AAAX,CAAY;IAiBjC,SAAS,CAAC,GAAgB;QACtB,2EAA2E;QAC3E,MAAM,KAAK,GAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7H,MAAM,MAAM,GAAG,IAAA,gBAAM,GAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChG,iCAAiC;QACjC,GAAG,CAAC,GAAG,CAAC,IAAA,kBAAI,GAAE,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,sBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACzC,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,kBAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;IACP,CAAC;;AAtCQ,oDAAoB;AAMV;IAFlB,IAAA,kBAAM,EAAC,2CAAmB,CAAC;IAC3B,IAAA,iBAAK,EAAC,2CAAmB,CAAC,MAAM,CAAC;sCACY,2CAAmB;uEAAC;AAI/C;IAFlB,IAAA,kBAAM,EAAC,2CAAmB,CAAC;IAC3B,IAAA,iBAAK,EAAC,2CAAmB,CAAC,KAAK,CAAC;sCACY,2CAAmB;sEAAC;AAI9C;IAFlB,IAAA,kBAAM,EAAC,2CAAmB,CAAC;IAC3B,IAAA,iBAAK,EAAC,2CAAmB,CAAC,aAAa,CAAC;sCACD,2CAAmB;iEAAC;AAGzC;IADlB,IAAA,kBAAM,EAAC,8BAAuB,CAAC;;iEACgC;+BAjBvD,oBAAoB;IADhC,IAAA,sBAAU,GAAE;GACA,oBAAoB,CAwChC"}

package/lib/node/upload/node-file-upload-service.d.ts CHANGED Viewed

@@ -1,8 +1,9 @@
 import express = require('@theia/core/shared/express');
-import { BackendApplicationContribution } from '@theia/core/lib/node';
+import { BackendApplicationContribution, HttpConnectionValidator } from '@theia/core/lib/node';
 import { ILogger } from '@theia/core';
 export declare class NodeFileUploadService implements BackendApplicationContribution {
     protected readonly logger: ILogger;
+    protected readonly connectionValidator: HttpConnectionValidator;
     private static readonly UPLOAD_DIR;
     configure(app: express.Application): Promise<void>;
     /**

package/lib/node/upload/node-file-upload-service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"node-file-upload-service.d.ts","sourceRoot":"","sources":["../../../src/node/upload/node-file-upload-service.ts"],"names":[],"mappings":"AAmBA,OAAO,OAAO,GAAG,QAAQ,4BAA4B,CAAC,CAAC;AAEvD,OAAO,EAAE,8BAA8B,EAAW,MAAM,sBAAsB,CAAC;~~AAG/E~~,OAAO,EAAE,OAAO,~~EAAE~~,MAAM,aAAa,CAAC;~~AAEtC~~,qBACa,qBAAsB,YAAW,8BAA8B;IAGxE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;~~IAEnC~~,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAE9C,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;~~IAexD~~;;OAEG;cACa,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxD;;OAEG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;cAIzC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CA2BxG"}
1	+ {"version":3,"file":"node-file-upload-service.d.ts","sourceRoot":"","sources":["../../../src/node/upload/node-file-upload-service.ts"],"names":[],"mappings":"AAmBA,OAAO,OAAO,GAAG,QAAQ,4BAA4B,CAAC,CAAC;AAEvD,OAAO,EAAE,8BAA8B,EAAW,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAGxG,OAAO,EAAE,OAAO,EAAO,MAAM,aAAa,CAAC;AAE3C,qBACa,qBAAsB,YAAW,8BAA8B;IAGxE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAGnC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;IAEhE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAE9C,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxD;;OAEG;cACa,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxD;;OAEG;cACa,sBAAsB,IAAI,OAAO,CAAC,MAAM,CAAC;cAIzC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CA2BxG"}

package/lib/node/upload/node-file-upload-service.js CHANGED Viewed

@@ -36,7 +36,9 @@ let NodeFileUploadService = class NodeFileUploadService {
         ]);
         this.logger.debug(`HTTP file upload URL path: ${http_path}`);
         this.logger.debug(`Backend file upload cache path: ${dest}`);
-        app.post(http_path,
+        // Reject unauthenticated/cross-origin requests before `multer` writes any temp file.
+        const guard = (request, response, next) => this.connectionValidator.validateRequest(request, response, next);
+        app.post(http_path, guard,
         // `multer` handles `multipart/form-data` containing our file to upload.
         multer({ dest }).single('file'), (request, response, next) => this.handleFileUpload(request, response));
     }
@@ -54,7 +56,7 @@ let NodeFileUploadService = class NodeFileUploadService {
     }
     async handleFileUpload(request, response) {
         const fields = request.body;
-        if (!request.file || typeof fields !== 'object' || typeof fields.uri !== 'string') {
+        if (!request.file || typeof fields !== 'object' || typeof fields.uri !== 'string' || new core_1.URI(fields.uri).scheme !== 'file') {
             response.sendStatus(400); // bad request
             return;
         }
@@ -88,6 +90,10 @@ tslib_1.__decorate([
     (0, inversify_1.named)('filesystem:NodeFileUploadService'),
     tslib_1.__metadata("design:type", Object)
 ], NodeFileUploadService.prototype, "logger", void 0);
+tslib_1.__decorate([
+    (0, inversify_1.inject)(node_1.HttpConnectionValidator),
+    tslib_1.__metadata("design:type", Object)
+], NodeFileUploadService.prototype, "connectionValidator", void 0);
 exports.NodeFileUploadService = NodeFileUploadService = NodeFileUploadService_1 = tslib_1.__decorate([
     (0, inversify_1.injectable)()
 ], NodeFileUploadService);

package/lib/node/upload/node-file-upload-service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"node-file-upload-service.js","sourceRoot":"","sources":["../../../src/node/upload/node-file-upload-service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;;AAEhF,iCAAkC;AAClC,6BAA8B;AAC9B,yBAA0B;AAE1B,kDAAmD;AACnD,+~~CAA+E~~;~~AAC/E~~,4DAAyE;AACzE,0DAAiE;AACjE,~~sCAAsC~~;~~AAG/B~~,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;;~~aAKN~~,eAAU,GAAG,cAAc,AAAjB,CAAkB;IAEpD,KAAK,CAAC,SAAS,CAAC,GAAwB;QACpC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,IAAI,CAAC,sBAAsB,EAAE;YAC7B,IAAI,CAAC,qBAAqB,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,IAAI,CACJ,SAAS;~~QACT~~,wEAAwE;QACxE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CACxE,CAAC;IACN,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,qBAAqB;QACjC,OAAO,mCAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,sBAAsB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAqB,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,OAAwB,EAAE,QAA0B;QACjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;~~YAChF~~,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc;YACxC,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,cAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACJ,kEAAkE;gBAClE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,uDAAuD;gBACvD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACJ,gCAAgC;gBAChC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;IACL,CAAC;;~~AA7DQ~~,sDAAqB;AAGX;IADlB,IAAA,kBAAM,EAAC,cAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,kCAAkC,CAAC;;qDACxB;~~gCAH1B~~,qBAAqB;IADjC,IAAA,sBAAU,GAAE;GACA,qBAAqB,~~CA+DjC~~"}
1	+ {"version":3,"file":"node-file-upload-service.js","sourceRoot":"","sources":["../../../src/node/upload/node-file-upload-service.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;;AAEhF,iCAAkC;AAClC,6BAA8B;AAC9B,yBAA0B;AAE1B,kDAAmD;AACnD,+CAAwG;AACxG,4DAAyE;AACzE,0DAAiE;AACjE,sCAA2C;AAGpC,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;;aAQN,eAAU,GAAG,cAAc,AAAjB,CAAkB;IAEpD,KAAK,CAAC,SAAS,CAAC,GAAwB;QACpC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxC,IAAI,CAAC,sBAAsB,EAAE;YAC7B,IAAI,CAAC,qBAAqB,EAAE;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,qFAAqF;QACrF,MAAM,KAAK,GAA2B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrI,GAAG,CAAC,IAAI,CACJ,SAAS,EACT,KAAK;QACL,wEAAwE;QACxE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CACxE,CAAC;IACN,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,qBAAqB;QACjC,OAAO,mCAAqB,CAAC;IACjC,CAAC;IAED;;OAEG;IACO,KAAK,CAAC,sBAAsB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAqB,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,OAAwB,EAAE,QAA0B;QACjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,UAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACzH,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc;YACxC,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,cAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACJ,kEAAkE;gBAClE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,uDAAuD;gBACvD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACJ,gCAAgC;gBAChC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACL,CAAC;IACL,CAAC;;AAnEQ,sDAAqB;AAGX;IADlB,IAAA,kBAAM,EAAC,cAAO,CAAC;IAAE,IAAA,iBAAK,EAAC,kCAAkC,CAAC;;qDACxB;AAGhB;IADlB,IAAA,kBAAM,EAAC,8BAAuB,CAAC;;kEACgC;gCANvD,qBAAqB;IADjC,IAAA,sBAAU,GAAE;GACA,qBAAqB,CAqEjC"}

package/lib/node/upload/node-file-upload-service.spec.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ export {};
2	+ //# sourceMappingURL=node-file-upload-service.spec.d.ts.map

package/lib/node/upload/node-file-upload-service.spec.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"node-file-upload-service.spec.d.ts","sourceRoot":"","sources":["../../../src/node/upload/node-file-upload-service.spec.ts"],"names":[],"mappings":""}

package/lib/node/upload/node-file-upload-service.spec.js ADDED Viewed

@@ -0,0 +1,107 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const os = require("os");
+const path = require("path");
+const fs = require("@theia/core/shared/fs-extra");
+const file_uri_1 = require("@theia/core/lib/common/file-uri");
+const node_file_upload_service_1 = require("./node-file-upload-service");
+describe('NodeFileUploadService', () => {
+    let tempDir;
+    function createService() {
+        const service = new node_file_upload_service_1.NodeFileUploadService();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        service['logger'] = { error: () => { } };
+        return service;
+    }
+    function createResponse() {
+        const captured = {};
+        const res = {
+            status(code) {
+                captured.statusCode = code;
+                return res;
+            },
+            send(body) {
+                captured.body = body;
+            },
+            sendStatus(code) {
+                captured.sentStatus = code;
+            }
+        };
+        return { res, captured };
+    }
+    async function handleUpload(filePath, body) {
+        const service = createService();
+        const { res, captured } = createResponse();
+        const request = { file: filePath === undefined ? undefined : { path: filePath }, body };
+        // handleFileUpload is protected; invoke it directly to exercise the input validation.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        await service.handleFileUpload(request, res);
+        return captured;
+    }
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'theia-upload-spec-'));
+    });
+    afterEach(async () => {
+        await fs.remove(tempDir);
+    });
+    it('should reject a non-file: URI with 400', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const captured = await handleUpload(source, { uri: 'http://evil.example/usr/bin/bash' });
+        (0, chai_1.expect)(captured.sentStatus).to.equal(400);
+        // The scoped-write guard must reject before any file operation runs.
+        (0, chai_1.expect)(await fs.pathExists(source)).to.be.true;
+    });
+    it('should reject a remote-scheme URI with 400', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const captured = await handleUpload(source, { uri: 'vscode-remote://host/usr/bin/bash' });
+        (0, chai_1.expect)(captured.sentStatus).to.equal(400);
+        (0, chai_1.expect)(await fs.pathExists(source)).to.be.true;
+    });
+    it('should reject a missing uri field with 400', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const captured = await handleUpload(source, {});
+        (0, chai_1.expect)(captured.sentStatus).to.equal(400);
+    });
+    it('should reject a missing file with 400', async () => {
+        const target = file_uri_1.FileUri.create(path.join(tempDir, 'target.txt')).toString();
+        const captured = await handleUpload(undefined, { uri: target });
+        (0, chai_1.expect)(captured.sentStatus).to.equal(400);
+    });
+    it('should accept a file: URI and move the upload to the target', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const targetPath = path.join(tempDir, 'target.txt');
+        const target = file_uri_1.FileUri.create(targetPath).toString();
+        const captured = await handleUpload(source, { uri: target });
+        (0, chai_1.expect)(captured.sentStatus).to.be.undefined;
+        (0, chai_1.expect)(captured.statusCode).to.equal(200);
+        // Compare against the canonical fs-path of the URI: on Windows the create/fsPath round-trip
+        // normalizes the drive letter to lower-case (e.g. `C:` -> `c:`), which would otherwise fail
+        // an exact string match against `targetPath` derived from `os.tmpdir()`.
+        (0, chai_1.expect)(captured.body).to.equal(file_uri_1.FileUri.fsPath(target));
+        (0, chai_1.expect)(await fs.pathExists(targetPath)).to.be.true;
+        (0, chai_1.expect)(await fs.readFile(targetPath, 'utf8')).to.equal('payload');
+        // The temp source file was moved, not copied.
+        (0, chai_1.expect)(await fs.pathExists(source)).to.be.false;
+    });
+});
+//# sourceMappingURL=node-file-upload-service.spec.js.map

package/lib/node/upload/node-file-upload-service.spec.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"node-file-upload-service.spec.js","sourceRoot":"","sources":["../../../src/node/upload/node-file-upload-service.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAC9B,yBAAyB;AACzB,6BAA6B;AAC7B,kDAAkD;AAClD,8DAA0D;AAC1D,yEAAmE;AASnE,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IAEnC,IAAI,OAAe,CAAC;IAEpB,SAAS,aAAa;QAClB,MAAM,OAAO,GAAG,IAAI,gDAAqB,EAAE,CAAC;QAC5C,8DAA8D;QAC7D,OAAe,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,SAAS,cAAc;QACnB,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG;YACR,MAAM,CAAC,IAAY;gBACf,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3B,OAAO,GAAG,CAAC;YACf,CAAC;YACD,IAAI,CAAC,IAAa;gBACd,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,UAAU,CAAC,IAAY;gBACnB,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;YAC/B,CAAC;SACJ,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,QAA4B,EAAE,IAAa;QACnE,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACxF,sFAAsF;QACtF,8DAA8D;QAC9D,MAAO,OAAe,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,UAAU,CAAC,KAAK,IAAI,EAAE;QAClB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,kCAAkC,EAAE,CAAC,CAAC;QACzF,IAAA,aAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,qEAAqE;QACrE,IAAA,aAAM,EAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAAC;QAC1F,IAAA,aAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAA,aAAM,EAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAA,aAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,GAAG,kBAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,IAAA,aAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,kBAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAErD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,IAAA,aAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;QAC5C,IAAA,aAAM,EAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,4FAA4F;QAC5F,4FAA4F;QAC5F,yEAAyE;QACzE,IAAA,aAAM,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,kBAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,IAAA,aAAM,EAAC,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;QACnD,IAAA,aAAM,EAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAClE,8CAA8C;QAC9C,IAAA,aAAM,EAAC,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACpD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/package.json CHANGED Viewed

@@ -1,9 +1,9 @@
 {
   "name": "@theia/filesystem",
-  "version": "1.74.0-next.8+2cd198687",
+  "version": "1.74.0",
   "description": "Theia - FileSystem Extension",
   "dependencies": {
-    "@theia/core": "1.74.0-next.8+2cd198687",
+    "@theia/core": "1.74.0",
     "@types/body-parser": "^1.19.6",
     "@types/multer": "^1.4.13",
     "@types/tar-fs": "^1.16.3",
@@ -13,11 +13,11 @@
     "http-status-codes": "^1.4.0",
     "ignore": "^6.0.2",
     "minimatch": "^10.2.5",
-    "multer": "^2.1.1",
+    "multer": "^2.2.0",
     "opfs-worker": "1.3.1",
     "rimraf": "^5.0.10",
     "stat-mode": "^1.0.0",
-    "tar-fs": "^3.1.2",
+    "tar-fs": "^3.1.3",
     "tar-stream": "^3.2.0",
     "trash": "^7.2.0",
     "tslib": "^2.8.1",
@@ -77,10 +77,10 @@
     "watch": "theiaext watch"
   },
   "devDependencies": {
-    "@theia/ext-scripts": "1.73.0"
+    "@theia/ext-scripts": "1.74.0"
   },
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "2cd1986875513fd02f645a2b8e69a68832a3a990"
+  "gitHead": "7b7376225f0825b4f13d296d686cc13db95fdb69"
 }

package/src/node/disk-file-system-provider.spec.ts CHANGED Viewed

@@ -23,6 +23,7 @@ import { IPCConnectionProvider } from '@theia/core/lib/node/messaging/ipc-connec
 import { Container, ContainerModule } from '@theia/core/shared/inversify';
 import { equal, fail } from 'assert';
 import { promises as fs } from 'fs';
+import * as os from 'os';
 import { join } from 'path';
 import * as temp from 'temp';
 import { generateUuid } from '@theia/core/lib/common/uuid';
@@ -115,7 +116,10 @@ describe('disk-file-system-provider', () => {
         it('delete is able to delete file', async function (): Promise<void> {
             this.timeout(10000);
-            const tempDirPath = tracked.mkdirSync();
+            // Place the temp dir under $HOME so the XDG trash dir (~/.local/share/Trash) is on the same
+            // filesystem. Otherwise the trash spec falls back to creating `.Trash-$UID` at the mount's
+            // topdir, which fails when /tmp is on a filesystem whose root is not user-writable.
+            const tempDirPath = tracked.mkdirSync({ dir: os.homedir(), prefix: 'theia-fs-test-' });
             const testFile = join(tempDirPath, 'test.file');
             const testFileUri = FileUri.create(testFile);
             for (const recursive of [true, false]) {

package/src/node/download/file-download-endpoint.ts CHANGED Viewed

@@ -16,11 +16,11 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import * as url from 'url';
 import { injectable, inject, named } from '@theia/core/shared/inversify';
 import { json } from 'body-parser';
-import { Application, Router } from '@theia/core/shared/express';
+import { Application, Router, RequestHandler } from '@theia/core/shared/express';
 import { BackendApplicationContribution } from '@theia/core/lib/node/backend-application';
+import { HttpConnectionValidator } from '@theia/core/lib/node';
 import { FileUri } from '@theia/core/lib/common/file-uri';
 import { FileDownloadHandler } from './file-download-handler';
@@ -41,16 +41,21 @@ export class FileDownloadEndpoint implements BackendApplicationContribution {
     @named(FileDownloadHandler.DOWNLOAD_LINK)
     protected readonly downloadLinkHandler: FileDownloadHandler;
+    @inject(HttpConnectionValidator)
+    protected readonly connectionValidator: HttpConnectionValidator;
     configure(app: Application): void {
+        // Reject unauthenticated/cross-origin requests to the file read endpoints.
+        const guard: RequestHandler = (request, response, next) => this.connectionValidator.validateRequest(request, response, next);
         const router = Router();
         router.get('/download', (request, response) => this.downloadLinkHandler.handle(request, response));
         router.get('/', (request, response) => this.singleFileDownloadHandler.handle(request, response));
         router.put('/', (request, response) => this.multiFileDownloadHandler.handle(request, response));
         // Content-Type: application/json
         app.use(json());
-        app.use(FileDownloadEndpoint.PATH, router);
-        app.get('/file', (request, response) => {
-            const uri = url.parse(request.url).query;
+        app.use(FileDownloadEndpoint.PATH, guard, router);
+        app.get('/file', guard, (request, response) => {
+            const uri = new URL(request.url, 'http://localhost').search.slice(1);
             if (!uri) {
                 response.status(400).send('invalid uri');
                 return;

package/src/node/upload/node-file-upload-service.spec.ts ADDED Viewed

@@ -0,0 +1,126 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource GmbH and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+import { expect } from 'chai';
+import * as os from 'os';
+import * as path from 'path';
+import * as fs from '@theia/core/shared/fs-extra';
+import { FileUri } from '@theia/core/lib/common/file-uri';
+import { NodeFileUploadService } from './node-file-upload-service';
+/** Captures what the upload handler wrote to the Express response. */
+interface CapturedResponse {
+    statusCode?: number;
+    sentStatus?: number;
+    body?: unknown;
+}
+describe('NodeFileUploadService', () => {
+    let tempDir: string;
+    function createService(): NodeFileUploadService {
+        const service = new NodeFileUploadService();
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (service as any)['logger'] = { error: () => { } };
+        return service;
+    }
+    function createResponse(): { res: unknown, captured: CapturedResponse } {
+        const captured: CapturedResponse = {};
+        const res = {
+            status(code: number): unknown {
+                captured.statusCode = code;
+                return res;
+            },
+            send(body: unknown): void {
+                captured.body = body;
+            },
+            sendStatus(code: number): void {
+                captured.sentStatus = code;
+            }
+        };
+        return { res, captured };
+    }
+    async function handleUpload(filePath: string | undefined, body: unknown): Promise<CapturedResponse> {
+        const service = createService();
+        const { res, captured } = createResponse();
+        const request = { file: filePath === undefined ? undefined : { path: filePath }, body };
+        // handleFileUpload is protected; invoke it directly to exercise the input validation.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        await (service as any).handleFileUpload(request, res);
+        return captured;
+    }
+    beforeEach(async () => {
+        tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'theia-upload-spec-'));
+    });
+    afterEach(async () => {
+        await fs.remove(tempDir);
+    });
+    it('should reject a non-file: URI with 400', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const captured = await handleUpload(source, { uri: 'http://evil.example/usr/bin/bash' });
+        expect(captured.sentStatus).to.equal(400);
+        // The scoped-write guard must reject before any file operation runs.
+        expect(await fs.pathExists(source)).to.be.true;
+    });
+    it('should reject a remote-scheme URI with 400', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const captured = await handleUpload(source, { uri: 'vscode-remote://host/usr/bin/bash' });
+        expect(captured.sentStatus).to.equal(400);
+        expect(await fs.pathExists(source)).to.be.true;
+    });
+    it('should reject a missing uri field with 400', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const captured = await handleUpload(source, {});
+        expect(captured.sentStatus).to.equal(400);
+    });
+    it('should reject a missing file with 400', async () => {
+        const target = FileUri.create(path.join(tempDir, 'target.txt')).toString();
+        const captured = await handleUpload(undefined, { uri: target });
+        expect(captured.sentStatus).to.equal(400);
+    });
+    it('should accept a file: URI and move the upload to the target', async () => {
+        const source = path.join(tempDir, 'source.txt');
+        await fs.writeFile(source, 'payload');
+        const targetPath = path.join(tempDir, 'target.txt');
+        const target = FileUri.create(targetPath).toString();
+        const captured = await handleUpload(source, { uri: target });
+        expect(captured.sentStatus).to.be.undefined;
+        expect(captured.statusCode).to.equal(200);
+        // Compare against the canonical fs-path of the URI: on Windows the create/fsPath round-trip
+        // normalizes the drive letter to lower-case (e.g. `C:` -> `c:`), which would otherwise fail
+        // an exact string match against `targetPath` derived from `os.tmpdir()`.
+        expect(captured.body).to.equal(FileUri.fsPath(target));
+        expect(await fs.pathExists(targetPath)).to.be.true;
+        expect(await fs.readFile(targetPath, 'utf8')).to.equal('payload');
+        // The temp source file was moved, not copied.
+        expect(await fs.pathExists(source)).to.be.false;
+    });
+});

package/src/node/upload/node-file-upload-service.ts CHANGED Viewed

@@ -19,10 +19,10 @@ import path = require('path');
 import os = require('os');
 import express = require('@theia/core/shared/express');
 import fs = require('@theia/core/shared/fs-extra');
-import { BackendApplicationContribution, FileUri } from '@theia/core/lib/node';
+import { BackendApplicationContribution, FileUri, HttpConnectionValidator } from '@theia/core/lib/node';
 import { injectable, inject, named } from '@theia/core/shared/inversify';
 import { HTTP_FILE_UPLOAD_PATH } from '../../common/file-upload';
-import { ILogger } from '@theia/core';
+import { ILogger, URI } from '@theia/core';
 @injectable()
 export class NodeFileUploadService implements BackendApplicationContribution {
@@ -30,6 +30,9 @@ export class NodeFileUploadService implements BackendApplicationContribution {
     @inject(ILogger) @named('filesystem:NodeFileUploadService')
     protected readonly logger: ILogger;
+    @inject(HttpConnectionValidator)
+    protected readonly connectionValidator: HttpConnectionValidator;
     private static readonly UPLOAD_DIR = 'theia_upload';
     async configure(app: express.Application): Promise<void> {
@@ -39,8 +42,11 @@ export class NodeFileUploadService implements BackendApplicationContribution {
         ]);
         this.logger.debug(`HTTP file upload URL path: ${http_path}`);
         this.logger.debug(`Backend file upload cache path: ${dest}`);
+        // Reject unauthenticated/cross-origin requests before `multer` writes any temp file.
+        const guard: express.RequestHandler = (request, response, next) => this.connectionValidator.validateRequest(request, response, next);
         app.post(
             http_path,
+            guard,
             // `multer` handles `multipart/form-data` containing our file to upload.
             multer({ dest }).single('file'),
             (request, response, next) => this.handleFileUpload(request, response)
@@ -63,7 +69,7 @@ export class NodeFileUploadService implements BackendApplicationContribution {
     protected async handleFileUpload(request: express.Request, response: express.Response): Promise<void> {
         const fields = request.body;
-        if (!request.file || typeof fields !== 'object' || typeof fields.uri !== 'string') {
+        if (!request.file || typeof fields !== 'object' || typeof fields.uri !== 'string' || new URI(fields.uri).scheme !== 'file') {
             response.sendStatus(400); // bad request
             return;
         }