gologin 3.0.7 → 3.0.8

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Combined changelog for GoLogin node.js SDK
 
+## [3.0.8] 2026-11-12
+
+### Features
+
+* Added `isCloudBrowser` option for GoLogin cloud browser. When enabled, profile `launchArguments` that run other programs (`*-cmd-prefix`, `*-launcher`, `--browser-subprocess-path`), open remote debugging, override the proxy or DNS, or point at paths (`--user-data-dir`, `--load-extension`, ...) are dropped and logged with proxy values redacted. Off by default; local launches are unchanged
+
 ## [3.0.7] 2026-10-15
 
 ### Fixes

package/index.d.ts

@@ -8,6 +8,7 @@ export type GoLoginOptions = {
   tmpdir?: string;
   waitWebsocket?: boolean;
   isCloudHeadless?: boolean;
+  isCloudBrowser?: boolean;
   skipOrbitaHashChecking?: boolean;
   uploadCookiesToServer?: boolean;
   writeCookiesFromServer?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gologin",
-  "version": "3.0.7",
+  "version": "3.0.8",
   "description": "A high-level API to control Orbita browser over GoLogin API",
   "types": "./index.d.ts",
   "main": "./src/index.js",
@@ -59,7 +59,7 @@
   },
   "scripts": {
     "test": "npm run test:unit && npm run test:e2e",
-    "test:unit": "echo \"No unit tests specified\" && exit 0",
+    "test:unit": "node --test 'test/unit/*.test.js'",
     "test:e2e": "node test/e2e/run-tests.js",
     "test:e2e:local": "HEADLESS=false npm run test:e2e",
     "format": "npx prettier --single-quote src/* --write",

package/src/gologin.js

@@ -15,6 +15,7 @@ import { checkAutoLang, getIntlProfileConfig, securedOrbitaOpts } from './utils/
 import { API_URL, ensureDirectoryExists, FALLBACK_API_URL, getOsAdvanced } from './utils/common.js';
 import { STORAGE_GATEWAY_BASE_URL } from './utils/constants.js';
 import { checkSocksProxy, makeRequest } from './utils/http.js';
+import { describeBlockedArgument, filterCloudLaunchArguments } from './utils/launch-arguments.js';
 import {
   // ensureSentryInitialized,
   loadBrowserChecker,
@@ -69,6 +70,7 @@ export class GoLogin {
     this.isFirstSession = false;
     this.keepIndexedDb = false;
     this.isCloudHeadless = options.isCloudHeadless ?? true;
+    this.isCloudBrowser = options.isCloudBrowser ?? false;
     this.storageGatewayUrl = `${STORAGE_GATEWAY_BASE_URL}/upload`;
 
     this.tmpdir = tmpdir();
@@ -494,6 +496,17 @@ export class GoLogin {
 
     this.keepIndexedDb = profile.storage?.indexedDb === true;
     this.profileLaunchArguments = (profile.launchArguments || '').split(' ').filter(Boolean);
+    if (this.isCloudBrowser && this.profileLaunchArguments.length) {
+      const { allowed, blocked } = filterCloudLaunchArguments(this.profileLaunchArguments);
+      if (blocked.length) {
+        console.warn('[launch-arguments] cloud browser: dropped profile launch arguments', {
+          profileId: this.profile_id,
+          blocked: blocked.map(describeBlockedArgument),
+        });
+      }
+
+      this.profileLaunchArguments = allowed;
+    }
 
     const { navigator = {}, fonts, os: profileOs } = profile;
     this.fontsMasking = fonts?.enableMasking;
@@ -629,6 +642,7 @@ export class GoLogin {
     } else {
       this.browserLang = checkAutoLangResult;
     }
+
     const prefsToWrite = Object.assign(preferences, { gologin });
     if (this.customChromeFrame === false) {
       prefsToWrite.browser = {

package/src/utils/launch-arguments.js

@@ -0,0 +1,83 @@
+// Profile launch arguments (profile.launchArguments) are free text set by the user and
+// appended to Orbita's command line. In GoLogin's cloud browser that command line runs
+// on our servers, so some switches must not come from the user:
+//  - switches that make Chrome run another program in place of its own processes
+//    (with --no-sandbox that is arbitrary command execution inside the pod),
+//  - remote debugging / DevTools access, which the cloud sets up itself,
+//  - proxy and DNS overrides, which would bypass the profile's proxy,
+//  - filesystem paths (profile dir, cache, logs, extensions loaded from a path).
+// Chrome uses the last value of a repeated switch, so a user switch would also override
+// the SDK's own. Only applied when the SDK runs with isCloudBrowser: true.
+
+const BLOCKED_SWITCHES = new Set([
+  'browser-subprocess-path',
+  'type',
+  'remote-debugging-port',
+  'remote-debugging-pipe',
+  'remote-debugging-address',
+  'remote-debugging-io-pipes',
+  'remote-debugging-targets',
+  'remote-allow-origins',
+  'proxy-server',
+  'proxy-pac-url',
+  'no-proxy-server',
+  'proxy-bypass-list',
+  'proxy-auto-detect',
+  'host-resolver-rules',
+  'host-rules',
+  'user-data-dir',
+  'disk-cache-dir',
+  'crash-dumps-dir',
+  'log-file',
+  'load-extension',
+]);
+
+// Any switch that wraps or replaces a child process launch:
+// --renderer-cmd-prefix, --utility-cmd-prefix, --gpu-launcher, --ppapi-plugin-launcher, ...
+const BLOCKED_SWITCH_PATTERNS = [/-cmd-prefix$/, /-launcher$/, /^nacl-gdb/];
+
+// Chrome on Linux accepts both "--name" and "-name"; switch names are case-sensitive
+// there, but lowercase them so no spelling slips through.
+export const launchSwitchName = (arg) => {
+  const match = /^--?([^=]+)/.exec(arg);
+
+  return match ? match[1].trim().toLowerCase() : null;
+};
+
+const isBlockedSwitch = (name) =>
+  BLOCKED_SWITCHES.has(name) || BLOCKED_SWITCH_PATTERNS.some((pattern) => pattern.test(name));
+
+// Returns the arguments that may be passed to Chrome and the ones that were removed.
+// A bare "--" is removed too: Chrome would treat every argument after it, including the
+// SDK's own switches, as a URL.
+export const filterCloudLaunchArguments = (args) => {
+  const allowed = [];
+  const blocked = [];
+  for (const arg of args) {
+    if (arg === '--') {
+      blocked.push(arg);
+      continue;
+    }
+
+    const name = launchSwitchName(arg);
+    if (name !== null && isBlockedSwitch(name)) {
+      blocked.push(arg);
+      continue;
+    }
+
+    allowed.push(arg);
+  }
+
+  return { allowed, blocked };
+};
+
+// For logs: keep what was tried (e.g. which program a *-cmd-prefix pointed at), but not
+// proxy credentials.
+export const describeBlockedArgument = (arg) => {
+  const name = launchSwitchName(arg);
+  if (name && /proxy|host-rules|host-resolver-rules/.test(name) && arg.includes('=')) {
+    return `${arg.slice(0, arg.indexOf('='))}=<redacted>`;
+  }
+
+  return arg;
+};

package/test/unit/launch-arguments.test.js

@@ -0,0 +1,96 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+
+import {
+  describeBlockedArgument,
+  filterCloudLaunchArguments,
+  launchSwitchName,
+} from '../../src/utils/launch-arguments.js';
+
+// The arguments seen on profile 6aebd85725714ca1d36e3531 (2026-11-12).
+const SEEN_IN_CLOUD = [
+  '--load-extension=/home/neko/.gologin/extensions/user-extensions/glpextkeepalive000000000001',
+  '--utility-cmd-prefix=/usr/bin/python3',
+];
+
+test('drops the arguments seen in the cloud', () => {
+  const { allowed, blocked } = filterCloudLaunchArguments(SEEN_IN_CLOUD);
+  assert.deepEqual(allowed, []);
+  assert.deepEqual(blocked, SEEN_IN_CLOUD);
+});
+
+test('drops every switch that runs another program', () => {
+  const args = [
+    '--renderer-cmd-prefix=/bin/sh -c id',
+    '--utility-cmd-prefix=/usr/bin/python3',
+    '--gpu-cmd-prefix=x',
+    '--zygote-cmd-prefix=x',
+    '--gpu-launcher=/bin/sh',
+    '--plugin-launcher=x',
+    '--ppapi-plugin-launcher=x',
+    '--browser-subprocess-path=/tmp/x',
+    '--nacl-gdb=/tmp/x',
+    '--nacl-gdb-script=/tmp/x',
+    '--type=renderer',
+  ];
+  assert.deepEqual(filterCloudLaunchArguments(args).allowed, []);
+});
+
+test('drops remote debugging, proxy, DNS and path overrides', () => {
+  const args = [
+    '--remote-debugging-port=9222',
+    '--remote-debugging-address=0.0.0.0',
+    '--remote-debugging-pipe',
+    '--remote-allow-origins=*',
+    '--proxy-server=http://user:pass@1.2.3.4:8080',
+    '--proxy-pac-url=http://x/pac',
+    '--no-proxy-server',
+    '--proxy-bypass-list=*',
+    '--host-resolver-rules=MAP * 1.2.3.4',
+    '--host-rules=MAP * 1.2.3.4',
+    '--user-data-dir=/tmp/other',
+    '--disk-cache-dir=/tmp/c',
+    '--crash-dumps-dir=/tmp/d',
+    '--log-file=/etc/passwd',
+    '--load-extension=/tmp/ext',
+  ];
+  assert.deepEqual(filterCloudLaunchArguments(args).allowed, []);
+});
+
+test('single dash and upper case spellings are caught too', () => {
+  const args = ['-utility-cmd-prefix=/usr/bin/python3', '--Renderer-Cmd-Prefix=/bin/sh', '-PROXY-SERVER=x'];
+  assert.deepEqual(filterCloudLaunchArguments(args).allowed, []);
+});
+
+test('a bare -- is dropped: it would turn the SDK switches after it into URLs', () => {
+  assert.deepEqual(filterCloudLaunchArguments(['--', '--restore-last-session']), {
+    allowed: ['--restore-last-session'],
+    blocked: ['--'],
+  });
+});
+
+test('ordinary launch arguments pass through unchanged and in order', () => {
+  const args = [
+    '--lang=de-DE',
+    '--start-maximized',
+    '--window-size=1280,800',
+    '--disable-features=Translate',
+    '--enable-features=WebGPU',
+    '--force-device-scale-factor=1.25',
+    '--user-agent=Mozilla/5.0 test',
+    '--disable-web-security',
+    'https://example.com/start',
+  ];
+  assert.deepEqual(filterCloudLaunchArguments(args), { allowed: args, blocked: [] });
+});
+
+test('switch names are read without the value', () => {
+  assert.equal(launchSwitchName('--utility-cmd-prefix=/usr/bin/python3'), 'utility-cmd-prefix');
+  assert.equal(launchSwitchName('-No-Proxy-Server'), 'no-proxy-server');
+  assert.equal(launchSwitchName('https://example.com'), null);
+});
+
+test('log description hides proxy credentials but keeps what was run', () => {
+  assert.equal(describeBlockedArgument('--proxy-server=http://user:pass@1.2.3.4:8080'), '--proxy-server=<redacted>');
+  assert.equal(describeBlockedArgument('--utility-cmd-prefix=/usr/bin/python3'), '--utility-cmd-prefix=/usr/bin/python3');
+});