playwright-core 1.58.0-alpha-2025-12-30 → 1.58.0-alpha-2026-01-01

package/lib/client/browserContext.js

@@ -76,6 +76,7 @@ class BrowserContext extends import_channelOwner.ChannelOwner {
     this.tracing = import_tracing.Tracing.from(initializer.tracing);
     this.request = import_fetch.APIRequestContext.from(initializer.requestContext);
     this.request._timeoutSettings = this._timeoutSettings;
+    this.request._checkUrlAllowed = (url) => this._checkUrlAllowed(url);
     this.clock = new import_clock.Clock(this);
     this._channel.on("bindingCall", ({ binding }) => this._onBinding(import_page.BindingCall.from(binding)));
     this._channel.on("close", () => this._onClose());
@@ -474,6 +475,37 @@ class BrowserContext extends import_channelOwner.ChannelOwner {
     this._onRecorderEventSink = void 0;
     await this._channel.disableRecorder();
   }
+  _setAllowedProtocols(protocols) {
+    this._allowedProtocols = protocols;
+  }
+  _checkUrlAllowed(url) {
+    if (!this._allowedProtocols)
+      return;
+    let parsedURL;
+    try {
+      parsedURL = new URL(url);
+    } catch (e) {
+      throw new Error(`Access to ${url} is blocked. Invalid URL: ${e.message}`);
+    }
+    if (!this._allowedProtocols.includes(parsedURL.protocol))
+      throw new Error(`Access to "${parsedURL.protocol}" URL is blocked. Allowed protocols: ${this._allowedProtocols.join(", ")}. Attempted URL: ${url}`);
+  }
+  _setAllowedDirectories(rootDirectories) {
+    this._allowedDirectories = rootDirectories;
+  }
+  _checkFileAccess(filePath) {
+    if (!this._allowedDirectories)
+      return;
+    const path = this._platform.path().resolve(filePath);
+    const isInsideDir = (container, child) => {
+      const path2 = this._platform.path();
+      const rel = path2.relative(container, child);
+      return !!rel && !rel.startsWith("..") && !path2.isAbsolute(rel);
+    };
+    if (this._allowedDirectories.some((root) => isInsideDir(root, path)))
+      return;
+    throw new Error(`File access denied: ${filePath} is outside allowed roots. Allowed roots: ${this._allowedDirectories.length ? this._allowedDirectories.join(", ") : "none"}`);
+  }
 }
 async function prepareStorageState(platform, storageState) {
   if (typeof storageState !== "string")

package/lib/client/elementHandle.js

@@ -230,6 +230,9 @@ async function convertInputFiles(platform, files, context) {
     if (!items.every((item) => typeof item === "string"))
       throw new Error("File paths cannot be mixed with buffers");
     const [localPaths, localDirectory] = await resolvePathsAndDirectoryForInputFiles(platform, items);
+    localPaths?.forEach((path) => context._checkFileAccess(path));
+    if (localDirectory)
+      context._checkFileAccess(localDirectory);
     if (context._connection.isRemote()) {
       const files2 = localDirectory ? (await platform.fs().promises.readdir(localDirectory, { withFileTypes: true, recursive: true })).filter((f) => f.isFile()).map((f) => platform.path().join(f.path, f.name)) : localPaths;
       const { writableStreams, rootDir } = await context._wrapApiCall(async () => context._channel.createTempFiles({

package/lib/client/fetch.js

@@ -133,6 +133,7 @@ class APIRequestContext extends import_channelOwner.ChannelOwner {
       (0, import_assert.assert)(options.maxRedirects === void 0 || options.maxRedirects >= 0, `'maxRedirects' must be greater than or equal to '0'`);
       (0, import_assert.assert)(options.maxRetries === void 0 || options.maxRetries >= 0, `'maxRetries' must be greater than or equal to '0'`);
       const url = options.url !== void 0 ? options.url : options.request.url();
+      this._checkUrlAllowed?.(url);
       const method = options.method || options.request?.method();
       let encodedParams = void 0;
       if (typeof options.params === "string")

package/lib/client/frame.js

@@ -101,6 +101,7 @@ class Frame extends import_channelOwner.ChannelOwner {
   }
   async goto(url, options = {}) {
     const waitUntil = verifyLoadState("waitUntil", options.waitUntil === void 0 ? "load" : options.waitUntil);
+    this.page().context()._checkUrlAllowed(url);
     return network.Response.fromNullable((await this._channel.goto({ url, ...options, waitUntil, timeout: this._navigationTimeout(options) })).response);
   }
   _setupNavigationWaiter(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playwright-core",
-  "version": "1.58.0-alpha-2025-12-30",
+  "version": "1.58.0-alpha-2026-01-01",
   "description": "A high-level API to automate web browsers",
   "repository": {
     "type": "git",