@theia/mini-browser 1.74.0-next.6 → 1.74.0-next.60

package/lib/node/mini-browser-ws-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mini-browser-ws-validator.d.ts","sourceRoot":"","sources":["../../src/node/mini-browser-ws-validator.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAK7B;;GAEG;AACH,qBACa,6BAA8B,YAAW,8BAA8B;IAEhF,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEpC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAS;IAG3C,SAAS,CAAC,IAAI,IAAI,IAAI;IAYhB,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;CAUxE"}
+{"version":3,"file":"mini-browser-ws-validator.d.ts","sourceRoot":"","sources":["../../src/node/mini-browser-ws-validator.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAI7B;;GAEG;AACH,qBACa,6BAA8B,YAAW,8BAA8B;IAEhF,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEpC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAS;IAG3C,SAAS,CAAC,IAAI,IAAI,IAAI;IAYhB,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;CAexE"}

package/lib/node/mini-browser-ws-validator.js

@@ -18,7 +18,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MiniBrowserWsRequestValidator = void 0;
 const tslib_1 = require("tslib");
 const inversify_1 = require("@theia/core/shared/inversify");
-const url = require("url");
 const mini_browser_endpoint_1 = require("../common/mini-browser-endpoint");
 /**
  * Prevents explicit WebSocket connections from the mini-browser virtual host.
@@ -40,8 +39,14 @@ let MiniBrowserWsRequestValidator = class MiniBrowserWsRequestValidator {
     }
     async allowWsUpgrade(request) {
         if (request.headers.origin && !this.serveSameOrigin) {
-            const origin = url.parse(request.headers.origin);
-            if (origin.host && this.miniBrowserHostRe.test(origin.host)) {
+            let host;
+            try {
+                host = new URL(request.headers.origin).host;
+            }
+            catch {
+                host = undefined;
+            }
+            if (host && this.miniBrowserHostRe.test(host)) {
                 // If the origin comes from the WebViews, refuse:
                 return false;
             }

package/lib/node/mini-browser-ws-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"mini-browser-ws-validator.js","sourceRoot":"","sources":["../../src/node/mini-browser-ws-validator.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAIhF,4DAAyE;AACzE,2BAA2B;AAC3B,2EAAsE;AAEtE;;GAEG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAAnC;QAIO,oBAAe,GAAY,KAAK,CAAC;IAyB/C,CAAC;IAtBa,IAAI;QACV,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2CAAmB,CAAC,gBAAgB,CAAC,IAAI,2CAAmB,CAAC,oBAAoB,CAAC;QAC9G,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,MAAM,OAAO,GAAG,OAAO;aAClB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;aACzB,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAA6B;QAC9C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjD,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,iDAAiD;gBACjD,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AA7BY,sEAA6B;AAO5B;IADT,IAAA,yBAAa,GAAE;;;;yDAWf;wCAjBQ,6BAA6B;IADzC,IAAA,sBAAU,GAAE;GACA,6BAA6B,CA6BzC"}
+{"version":3,"file":"mini-browser-ws-validator.js","sourceRoot":"","sources":["../../src/node/mini-browser-ws-validator.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;;;AAIhF,4DAAyE;AACzE,2EAAsE;AAEtE;;GAEG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IAAnC;QAIO,oBAAe,GAAY,KAAK,CAAC;IA8B/C,CAAC;IA3Ba,IAAI;QACV,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2CAAmB,CAAC,gBAAgB,CAAC,IAAI,2CAAmB,CAAC,oBAAoB,CAAC;QAC9G,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAChC,CAAC;QACD,MAAM,OAAO,GAAG,OAAO;aAClB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;aACrB,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC;aACzB,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,iBAAiB,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAA6B;QAC9C,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,IAAI,IAAwB,CAAC;YAC7B,IAAI,CAAC;gBACD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACL,IAAI,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5C,iDAAiD;gBACjD,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ,CAAA;AAlCY,sEAA6B;AAO5B;IADT,IAAA,yBAAa,GAAE;;;;yDAWf;wCAjBQ,6BAA6B;IADzC,IAAA,sBAAU,GAAE;GACA,6BAA6B,CAkCzC"}

package/lib/node/mini-browser-ws-validator.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mini-browser-ws-validator.spec.d.ts.map

package/lib/node/mini-browser-ws-validator.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mini-browser-ws-validator.spec.d.ts","sourceRoot":"","sources":["../../src/node/mini-browser-ws-validator.spec.ts"],"names":[],"mappings":""}

package/lib/node/mini-browser-ws-validator.spec.js

@@ -0,0 +1,54 @@
+"use strict";
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const mini_browser_ws_validator_1 = require("./mini-browser-ws-validator");
+describe('MiniBrowserWsRequestValidator', () => {
+    function createValidator() {
+        const validator = new mini_browser_ws_validator_1.MiniBrowserWsRequestValidator();
+        // Uses the default host pattern '{{uuid}}.mini-browser.{{hostname}}'.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        validator['init']();
+        return validator;
+    }
+    function createRequest(origin) {
+        const request = {
+            headers: {}
+        };
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        return request;
+    }
+    it('should refuse WebSocket upgrades from the mini-browser virtual host', async () => {
+        const validator = createValidator();
+        (0, chai_1.expect)(await validator.allowWsUpgrade(createRequest('http://abc.mini-browser.localhost:3000'))).to.be.false;
+    });
+    it('should allow WebSocket upgrades from other origins', async () => {
+        const validator = createValidator();
+        (0, chai_1.expect)(await validator.allowWsUpgrade(createRequest('http://localhost:3000'))).to.be.true;
+    });
+    it('should allow requests with no Origin header', async () => {
+        const validator = createValidator();
+        (0, chai_1.expect)(await validator.allowWsUpgrade(createRequest())).to.be.true;
+    });
+    it('should not throw and should allow when the Origin header is malformed', async () => {
+        const validator = createValidator();
+        (0, chai_1.expect)(await validator.allowWsUpgrade(createRequest('not-a-valid-url'))).to.be.true;
+    });
+});
+//# sourceMappingURL=mini-browser-ws-validator.spec.js.map

package/lib/node/mini-browser-ws-validator.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mini-browser-ws-validator.spec.js","sourceRoot":"","sources":["../../src/node/mini-browser-ws-validator.spec.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,+CAA+C;AAC/C,EAAE;AACF,2EAA2E;AAC3E,mEAAmE;AACnE,wCAAwC;AACxC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,yDAAyD;AACzD,uDAAuD;AACvD,EAAE;AACF,gFAAgF;AAChF,gFAAgF;;AAEhF,+BAA8B;AAE9B,2EAA4E;AAE5E,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAE3C,SAAS,eAAe;QACpB,MAAM,SAAS,GAAG,IAAI,yDAA6B,EAAE,CAAC;QACtD,sEAAsE;QACtE,8DAA8D;QAC7D,SAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,SAAS,aAAa,CAAC,MAAe;QAClC,MAAM,OAAO,GAAG;YACZ,OAAO,EAAE,EAA8B;SAClB,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACpC,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,IAAA,aAAM,EAAC,MAAM,SAAS,CAAC,cAAc,CACjC,aAAa,CAAC,wCAAwC,CAAC,CAC1D,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,IAAA,aAAM,EAAC,MAAM,SAAS,CAAC,cAAc,CACjC,aAAa,CAAC,uBAAuB,CAAC,CACzC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,IAAA,aAAM,EAAC,MAAM,SAAS,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;QACpC,IAAA,aAAM,EAAC,MAAM,SAAS,CAAC,cAAc,CACjC,aAAa,CAAC,iBAAiB,CAAC,CACnC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@theia/mini-browser",
-  "version": "1.74.0-next.6+04cb275b0",
+  "version": "1.74.0-next.60+46ce275d4",
   "description": "Theia - Mini-Browser Extension",
   "dependencies": {
-    "@theia/core": "1.74.0-next.6+04cb275b0",
-    "@theia/filesystem": "1.74.0-next.6+04cb275b0",
+    "@theia/core": "1.74.0-next.60+46ce275d4",
+    "@theia/filesystem": "1.74.0-next.60+46ce275d4",
     "@types/mime-types": "^2.1.4",
     "mime-types": "^2.1.35",
     "pdfobject": "^2.3.1",
@@ -54,5 +54,5 @@
   "nyc": {
     "extends": "../../configs/nyc.json"
   },
-  "gitHead": "04cb275b0eb41688cdf025c43555938fea5bc1ef"
+  "gitHead": "46ce275d49f80aaaf9eb453a0852bda9da783c76"
 }

package/src/node/mini-browser-ws-validator.spec.ts

@@ -0,0 +1,66 @@
+// *****************************************************************************
+// Copyright (C) 2026 EclipseSource and others.
+//
+// This program and the accompanying materials are made available under the
+// terms of the Eclipse Public License v. 2.0 which is available at
+// http://www.eclipse.org/legal/epl-2.0.
+//
+// This Source Code may also be made available under the following Secondary
+// Licenses when the conditions for such availability set forth in the Eclipse
+// Public License v. 2.0 are satisfied: GNU General Public License, version 2
+// with the GNU Classpath Exception which is available at
+// https://www.gnu.org/software/classpath/license.html.
+//
+// SPDX-License-Identifier: EPL-2.0 OR GPL-2.0-only WITH Classpath-exception-2.0
+// *****************************************************************************
+
+import { expect } from 'chai';
+import * as http from 'http';
+import { MiniBrowserWsRequestValidator } from './mini-browser-ws-validator';
+
+describe('MiniBrowserWsRequestValidator', () => {
+
+    function createValidator(): MiniBrowserWsRequestValidator {
+        const validator = new MiniBrowserWsRequestValidator();
+        // Uses the default host pattern '{{uuid}}.mini-browser.{{hostname}}'.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (validator as any)['init']();
+        return validator;
+    }
+
+    function createRequest(origin?: string): http.IncomingMessage {
+        const request = {
+            headers: {} as http.IncomingHttpHeaders
+        } as http.IncomingMessage;
+        if (origin !== undefined) {
+            request.headers.origin = origin;
+        }
+        return request;
+    }
+
+    it('should refuse WebSocket upgrades from the mini-browser virtual host', async () => {
+        const validator = createValidator();
+        expect(await validator.allowWsUpgrade(
+            createRequest('http://abc.mini-browser.localhost:3000')
+        )).to.be.false;
+    });
+
+    it('should allow WebSocket upgrades from other origins', async () => {
+        const validator = createValidator();
+        expect(await validator.allowWsUpgrade(
+            createRequest('http://localhost:3000')
+        )).to.be.true;
+    });
+
+    it('should allow requests with no Origin header', async () => {
+        const validator = createValidator();
+        expect(await validator.allowWsUpgrade(createRequest())).to.be.true;
+    });
+
+    it('should not throw and should allow when the Origin header is malformed', async () => {
+        const validator = createValidator();
+        expect(await validator.allowWsUpgrade(
+            createRequest('not-a-valid-url')
+        )).to.be.true;
+    });
+});

package/src/node/mini-browser-ws-validator.ts

@@ -17,7 +17,6 @@
 import { WsRequestValidatorContribution } from '@theia/core/lib/node/ws-request-validators';
 import * as http from 'http';
 import { injectable, postConstruct } from '@theia/core/shared/inversify';
-import * as url from 'url';
 import { MiniBrowserEndpoint } from '../common/mini-browser-endpoint';
 
 /**
@@ -45,8 +44,13 @@ export class MiniBrowserWsRequestValidator implements WsRequestValidatorContribu
 
     async allowWsUpgrade(request: http.IncomingMessage): Promise<boolean> {
         if (request.headers.origin && !this.serveSameOrigin) {
-            const origin = url.parse(request.headers.origin);
-            if (origin.host && this.miniBrowserHostRe.test(origin.host)) {
+            let host: string | undefined;
+            try {
+                host = new URL(request.headers.origin).host;
+            } catch {
+                host = undefined;
+            }
+            if (host && this.miniBrowserHostRe.test(host)) {
                 // If the origin comes from the WebViews, refuse:
                 return false;
             }