react-native-windows 0.68.3 → 0.69.0-preview.1

package/Shared/Networking/OriginPolicyHttpFilter.h

@@ -0,0 +1,112 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#pragma once
+
+#include "OriginPolicy.h"
+
+// Windows API
+#include <winrt/Windows.Foundation.h>
+#include <winrt/Windows.Web.Http.Filters.h>
+#include <winrt/Windows.Web.Http.h>
+
+// Standard Library
+#include <set>
+
+namespace Microsoft::React::Networking {
+
+class OriginPolicyHttpFilter
+    : public winrt::implements<OriginPolicyHttpFilter, winrt::Windows::Web::Http::Filters::IHttpFilter> {
+ public:
+  struct ConstWcharComparer {
+    bool operator()(const wchar_t *, const wchar_t *) const;
+  };
+
+ private:
+  static std::set<const wchar_t *, ConstWcharComparer> s_forbiddenMethods;
+  static std::set<const wchar_t *, ConstWcharComparer> s_simpleCorsMethods;
+  static std::set<const wchar_t *, ConstWcharComparer> s_simpleCorsRequestHeaderNames;
+  static std::set<const wchar_t *, ConstWcharComparer> s_simpleCorsResponseHeaderNames;
+  static std::set<const wchar_t *, ConstWcharComparer> s_simpleCorsContentTypeValues;
+  static std::set<const wchar_t *, ConstWcharComparer> s_corsForbiddenRequestHeaderNames;
+  static std::set<const wchar_t *, ConstWcharComparer> s_corsForbiddenRequestHeaderNamePrefixes;
+  static std::set<const wchar_t *, ConstWcharComparer> s_cookieSettingResponseHeaders;
+
+  // NOTE: Assumes static origin through owning client/resource/module/(React) instance's lifetime.
+  static winrt::Windows::Foundation::Uri s_origin;
+
+  struct AccessControlValues {
+    winrt::hstring AllowedOrigin;
+    winrt::hstring AllowedCredentials;
+    std::set<std::wstring> AllowedHeaders;
+    std::set<std::wstring> AllowedMethods;
+    std::set<std::wstring> ExposedHeaders;
+    size_t MaxAge;
+  };
+
+  winrt::Windows::Web::Http::Filters::IHttpFilter m_innerFilter;
+
+ public:
+  static void SetStaticOrigin(std::string &&url);
+
+  static bool IsSameOrigin(
+      winrt::Windows::Foundation::Uri const &u1,
+      winrt::Windows::Foundation::Uri const &u2) noexcept;
+
+  static winrt::Windows::Foundation::Uri GetOrigin(winrt::Windows::Foundation::Uri const &uri) noexcept;
+
+  static bool IsSimpleCorsRequest(winrt::Windows::Web::Http::HttpRequestMessage const &request) noexcept;
+
+  static bool AreSafeRequestHeaders(
+      winrt::Windows::Web::Http::Headers::HttpRequestHeaderCollection const &headers) noexcept;
+
+  static std::set<const wchar_t *> CorsUnsafeNotForbiddenRequestHeaderNames(
+      winrt::Windows::Web::Http::Headers::HttpRequestHeaderCollection const &headers) noexcept;
+
+  static AccessControlValues ExtractAccessControlValues(
+      winrt::Windows::Foundation::Collections::IMap<winrt::hstring, winrt::hstring> const &headers);
+
+  static bool IsCorsSafelistedRequestHeader(winrt::hstring const &name, winrt::hstring const &value) noexcept;
+
+  static bool IsCorsUnsafeRequestHeaderByte(wchar_t c) noexcept;
+
+  // Filter out Http-Only cookies from response headers to prevent malicious code from being sent to a malicious server
+  static void RemoveHttpOnlyCookiesFromResponseHeaders(
+      winrt::Windows::Web::Http::HttpResponseMessage const &response,
+      bool removeAll);
+
+  OriginPolicyHttpFilter(winrt::Windows::Web::Http::Filters::IHttpFilter &&innerFilter);
+
+  OriginPolicyHttpFilter();
+
+  OriginPolicy ValidateRequest(winrt::Windows::Web::Http::HttpRequestMessage const &request);
+
+  void ValidatePreflightResponse(
+      winrt::Windows::Web::Http::HttpRequestMessage const &request,
+      winrt::Windows::Web::Http::HttpResponseMessage const &response) const;
+
+  void ValidateResponse(
+      winrt::Windows::Web::Http::HttpResponseMessage const &response,
+      const OriginPolicy effectivePolicy) const;
+
+  void ValidateAllowOrigin(
+      winrt::hstring const &allowedOrigin,
+      winrt::hstring const &allowCredentials,
+      winrt::Windows::Foundation::IInspectable const &iArgs) const;
+
+  winrt::Windows::Foundation::IAsyncOperationWithProgress<
+      winrt::Windows::Web::Http::HttpResponseMessage,
+      winrt::Windows::Web::Http::HttpProgress>
+  SendPreflightAsync(winrt::Windows::Web::Http::HttpRequestMessage const &request) const;
+
+#pragma region IHttpFilter
+
+  winrt::Windows::Foundation::IAsyncOperationWithProgress<
+      winrt::Windows::Web::Http::HttpResponseMessage,
+      winrt::Windows::Web::Http::HttpProgress>
+  SendRequestAsync(winrt::Windows::Web::Http::HttpRequestMessage const &request);
+
+#pragma endregion IHttpFilter
+};
+
+} // namespace Microsoft::React::Networking

package/Shared/{WinRTHttpResource.cpp → Networking/WinRTHttpResource.cpp}

@@ -3,9 +3,14 @@
 
 #include "WinRTHttpResource.h"
 
+#include <CppRuntimeOptions.h>
 #include <Utils/CppWinrtLessExceptions.h>
 #include <Utils/WinRTConversions.h>
 #include <utilities.h>
+#include "OriginPolicyHttpFilter.h"
+
+// Boost Libraries
+#include <boost/algorithm/string.hpp>
 
 // Windows API
 #include <winrt/Windows.Security.Cryptography.h>
@@ -21,6 +26,7 @@ using winrt::fire_and_forget;
 using winrt::hresult_error;
 using winrt::to_hstring;
 using winrt::to_string;
+using winrt::Windows::Foundation::IInspectable;
 using winrt::Windows::Foundation::Uri;
 using winrt::Windows::Security::Cryptography::CryptographicBuffer;
 using winrt::Windows::Storage::StorageFile;
@@ -35,7 +41,7 @@ using winrt::Windows::Web::Http::IHttpClient;
 using winrt::Windows::Web::Http::IHttpContent;
 using winrt::Windows::Web::Http::Headers::HttpMediaTypeHeaderValue;
 
-namespace Microsoft::React {
+namespace Microsoft::React::Networking {
 
 #pragma region WinRTHttpResource
 
@@ -71,72 +77,18 @@ void WinRTHttpResource::SendRequest(
     HttpMethod httpMethod{to_hstring(std::move(method))};
     Uri uri{to_hstring(std::move(url))};
     HttpRequestMessage request{httpMethod, uri};
-    HttpMediaTypeHeaderValue contentType{nullptr};
-    string contentEncoding;
-    string contentLength;
-
-    // Headers are generally case-insensitive
-    // https://www.ietf.org/rfc/rfc2616.txt section 4.2
-    for (auto &header : headers) {
-      if (_stricmp(header.first.c_str(), "content-type") == 0) {
-        bool success = HttpMediaTypeHeaderValue::TryParse(to_hstring(header.second), contentType);
-        if (!success && m_onError) {
-          return m_onError(requestId, "Failed to parse Content-Type");
-        }
-      } else if (_stricmp(header.first.c_str(), "content-encoding") == 0) {
-        contentEncoding = header.second;
-      } else if (_stricmp(header.first.c_str(), "content-length") == 0) {
-        contentLength = header.second;
-      } else if (_stricmp(header.first.c_str(), "authorization") == 0) {
-        bool success =
-            request.Headers().TryAppendWithoutValidation(to_hstring(header.first), to_hstring(header.second));
-        if (!success && m_onError) {
-          return m_onError(requestId, "Failed to append Authorization");
-        }
-      } else {
-        request.Headers().Append(to_hstring(header.first), to_hstring(header.second));
-      }
-    }
-
-    IHttpContent content{nullptr};
-    if (BodyData::Type::String == bodyData.Type) {
-      content = HttpStringContent{to_hstring(bodyData.Data)};
-    } else if (BodyData::Type::Base64 == bodyData.Type) {
-      auto buffer = CryptographicBuffer::DecodeFromBase64String(to_hstring(bodyData.Data));
-      content = HttpBufferContent{buffer};
-    } else if (BodyData::Type::Uri == bodyData.Type) {
-      auto file = StorageFile::GetFileFromApplicationUriAsync(Uri{to_hstring(bodyData.Data)}).get();
-      auto stream = file.OpenReadAsync().get();
-      content = HttpStreamContent{stream};
-    } else if (BodyData::Type::Form == bodyData.Type) {
-      // TODO: Add support
-    } else {
-      // BodyData::Type::Empty
-      // TODO: Error 'cause unsupported??
-    }
-
-    if (content != nullptr) {
-      // Attach content headers
-      if (contentType) {
-        content.Headers().ContentType(contentType);
-      }
-      if (!contentEncoding.empty()) {
-        if (!content.Headers().ContentEncoding().TryParseAdd(to_hstring(contentEncoding))) {
-          if (m_onError) {
-            m_onError(requestId, "Failed to parse Content-Encoding");
-          }
-          return;
-        }
-      }
-      if (!contentLength.empty()) {
-        const auto contentLengthHeader = _atoi64(contentLength.c_str()); // TODO: Alternatives to _atoi64?
-        content.Headers().ContentLength(contentLengthHeader);
-      }
-
-      request.Content(content);
-    }
 
-    PerformSendRequest(requestId, std::move(request), responseType == "text");
+    auto args = winrt::make<RequestArgs>();
+    auto concreteArgs = args.as<RequestArgs>();
+    concreteArgs->RequestId = requestId;
+    concreteArgs->Headers = std::move(headers);
+    concreteArgs->Body = std::move(bodyData);
+    concreteArgs->IncrementalUpdates = useIncrementalUpdates;
+    concreteArgs->WithCredentials = withCredentials;
+    concreteArgs->IsText = responseType == "text";
+    concreteArgs->Timeout = timeout;
+
+    PerformSendRequest(std::move(request), args);
   } catch (std::exception const &e) {
     if (m_onError) {
       m_onError(requestId, e.what());
@@ -151,7 +103,7 @@ void WinRTHttpResource::SendRequest(
 }
 
 void WinRTHttpResource::AbortRequest(int64_t requestId) noexcept /*override*/ {
-  ResponseType request{nullptr};
+  ResponseOperation request{nullptr};
 
   {
     scoped_lock lock{m_mutex};
@@ -183,7 +135,7 @@ void WinRTHttpResource::SetOnResponse(function<void(int64_t requestId, Response
   m_onResponse = std::move(handler);
 }
 
-void WinRTHttpResource::SetOnData(function<void(int64_t requestId, std::string &&responseData)> &&handler) noexcept
+void WinRTHttpResource::SetOnData(function<void(int64_t requestId, string &&responseData)> &&handler) noexcept
 /*override*/ {
   m_onData = std::move(handler);
 }
@@ -195,7 +147,7 @@ void WinRTHttpResource::SetOnError(function<void(int64_t requestId, string &&err
 
 #pragma endregion IHttpResource
 
-void WinRTHttpResource::TrackResponse(int64_t requestId, ResponseType response) noexcept {
+void WinRTHttpResource::TrackResponse(int64_t requestId, ResponseOperation response) noexcept {
   scoped_lock lock{m_mutex};
   m_responses[requestId] = response;
 }
@@ -205,70 +157,142 @@ void WinRTHttpResource::UntrackResponse(int64_t requestId) noexcept {
   m_responses.erase(requestId);
 }
 
-fire_and_forget
-WinRTHttpResource::PerformSendRequest(int64_t requestId, HttpRequestMessage &&request, bool textResponse) noexcept {
+fire_and_forget WinRTHttpResource::PerformSendRequest(HttpRequestMessage &&request, IInspectable const &args) noexcept {
   // Keep references after coroutine suspension.
   auto self = shared_from_this();
   auto coRequest = std::move(request);
+  auto coArgs = args;
+  auto coReqArgs = coArgs.as<RequestArgs>();
 
   // Ensure background thread
   co_await winrt::resume_background();
 
+  HttpMediaTypeHeaderValue contentType{nullptr};
+  string contentEncoding;
+  string contentLength;
+
+  // Headers are generally case-insensitive
+  // https://www.ietf.org/rfc/rfc2616.txt section 4.2
+  for (auto &header : coReqArgs->Headers) {
+    if (boost::iequals(header.first.c_str(), "Content-Type")) {
+      bool success = HttpMediaTypeHeaderValue::TryParse(to_hstring(header.second), contentType);
+      if (!success && m_onError) {
+        co_return m_onError(coReqArgs->RequestId, "Failed to parse Content-Type");
+      }
+    } else if (boost::iequals(header.first.c_str(), "Content-Encoding")) {
+      contentEncoding = header.second;
+    } else if (boost::iequals(header.first.c_str(), "Content-Length")) {
+      contentLength = header.second;
+    } else if (boost::iequals(header.first.c_str(), "Authorization")) {
+      bool success =
+          coRequest.Headers().TryAppendWithoutValidation(to_hstring(header.first), to_hstring(header.second));
+      if (!success && m_onError) {
+        co_return m_onError(coReqArgs->RequestId, "Failed to append Authorization");
+      }
+    } else {
+      try {
+        coRequest.Headers().Append(to_hstring(header.first), to_hstring(header.second));
+      } catch (hresult_error const &e) {
+        if (self->m_onError) {
+          co_return self->m_onError(coReqArgs->RequestId, Utilities::HResultToString(e));
+        }
+      }
+    }
+  }
+
+  IHttpContent content{nullptr};
+  if (BodyData::Type::String == coReqArgs->Body.Type) {
+    content = HttpStringContent{to_hstring(coReqArgs->Body.Data)};
+  } else if (BodyData::Type::Base64 == coReqArgs->Body.Type) {
+    auto buffer = CryptographicBuffer::DecodeFromBase64String(to_hstring(coReqArgs->Body.Data));
+    content = HttpBufferContent{buffer};
+  } else if (BodyData::Type::Uri == coReqArgs->Body.Type) {
+    auto file = co_await StorageFile::GetFileFromApplicationUriAsync(Uri{to_hstring(coReqArgs->Body.Data)});
+    auto stream = co_await file.OpenReadAsync();
+    content = HttpStreamContent{stream};
+  } else if (BodyData::Type::Form == coReqArgs->Body.Type) {
+    // #9535 - HTTP form data support
+  } else {
+    // BodyData::Type::Empty
+    // TODO: Error => unsupported??
+  }
+
+  if (content != nullptr) {
+    // Attach content headers
+    if (contentType) {
+      content.Headers().ContentType(contentType);
+    }
+    if (!contentEncoding.empty()) {
+      if (!content.Headers().ContentEncoding().TryParseAdd(to_hstring(contentEncoding))) {
+        if (m_onError) {
+          m_onError(coReqArgs->RequestId, "Failed to parse Content-Encoding");
+        }
+        co_return;
+      }
+    }
+    if (!contentLength.empty()) {
+      const auto contentLengthHeader = _atoi64(contentLength.c_str());
+      content.Headers().ContentLength(contentLengthHeader);
+    }
+
+    coRequest.Content(content);
+  }
+
   try {
+    coRequest.Properties().Insert(L"RequestArgs", coArgs);
     auto sendRequestOp = self->m_client.SendRequestAsync(coRequest);
+    self->TrackResponse(coReqArgs->RequestId, sendRequestOp);
 
-    self->TrackResponse(requestId, sendRequestOp);
-
-    co_await lessthrow_await_adapter<ResponseType>{sendRequestOp};
+    co_await lessthrow_await_adapter<ResponseOperation>{sendRequestOp};
     auto result = sendRequestOp.ErrorCode();
     if (result < 0) {
       if (self->m_onError) {
-        self->m_onError(requestId, Utilities::HResultToString(std::move(result)));
+        self->m_onError(coReqArgs->RequestId, Utilities::HResultToString(std::move(result)));
       }
-      self->UntrackResponse(requestId);
-      co_return;
+      co_return self->UntrackResponse(coReqArgs->RequestId);
     }
 
     auto response = sendRequestOp.GetResults();
     if (response) {
       if (self->m_onResponse) {
-        Headers headers;
+        string url = to_string(response.RequestMessage().RequestUri().AbsoluteUri());
 
         // Gather headers for both the response content and the response itself
         // See Invoke-WebRequest PowerShell cmdlet or Chromium response handling
+        Headers responseHeaders;
         for (auto header : response.Headers()) {
-          headers.emplace(to_string(header.Key()), to_string(header.Value()));
+          responseHeaders.emplace(to_string(header.Key()), to_string(header.Value()));
         }
         for (auto header : response.Content().Headers()) {
-          headers.emplace(to_string(header.Key()), to_string(header.Value()));
+          responseHeaders.emplace(to_string(header.Key()), to_string(header.Value()));
         }
-        string url = to_string(response.RequestMessage().RequestUri().AbsoluteUri());
+
         self->m_onResponse(
-            requestId, {static_cast<int32_t>(response.StatusCode()), std::move(headers), std::move(url)});
+            coReqArgs->RequestId,
+            {static_cast<int32_t>(response.StatusCode()), std::move(url), std::move(responseHeaders)});
       }
     }
 
-    // TODO: Incremental updates?
+    // #9534 - Support HTTP incremental updates
     if (response && response.Content()) {
       auto inputStream = co_await response.Content().ReadAsInputStreamAsync();
       auto reader = DataReader{inputStream};
 
-      if (textResponse) {
+      if (coReqArgs->IsText) {
         reader.UnicodeEncoding(UnicodeEncoding::Utf8);
       }
 
-      // Only support response sizes up to 10MB.
-      // TODO: WHY????
+      // #9510 - 10mb limit on fetch
       co_await reader.LoadAsync(10 * 1024 * 1024);
       auto length = reader.UnconsumedBufferLength();
 
-      if (textResponse) {
+      if (coReqArgs->IsText) {
         std::vector<uint8_t> data(length);
         reader.ReadBytes(data);
         string responseData = string(Common::Utilities::CheckedReinterpretCast<char *>(data.data()), data.size());
 
         if (self->m_onData) {
-          self->m_onData(requestId, std::move(responseData));
+          self->m_onData(coReqArgs->RequestId, std::move(responseData));
         }
       } else {
         auto buffer = reader.ReadBuffer(length);
@@ -276,32 +300,29 @@ WinRTHttpResource::PerformSendRequest(int64_t requestId, HttpRequestMessage &&re
         auto responseData = to_string(std::wstring_view(data));
 
         if (self->m_onData) {
-          self->m_onData(requestId, std::move(responseData));
+          self->m_onData(coReqArgs->RequestId, std::move(responseData));
         }
       }
     } else {
       if (self->m_onError) {
-        self->m_onError(requestId, response == nullptr ? "request failed" : "No response content");
+        self->m_onError(coReqArgs->RequestId, response == nullptr ? "request failed" : "No response content");
       }
     }
   } catch (std::exception const &e) {
     if (self->m_onError) {
-      self->m_onError(requestId, e.what());
+      self->m_onError(coReqArgs->RequestId, e.what());
     }
   } catch (hresult_error const &e) {
     if (self->m_onError) {
-      self->m_onError(requestId, Utilities::HResultToString(e));
+      self->m_onError(coReqArgs->RequestId, Utilities::HResultToString(e));
     }
   } catch (...) {
     if (self->m_onError) {
-      self->m_onError(requestId, "Unhandled exception during request");
+      self->m_onError(coReqArgs->RequestId, "Unhandled exception during request");
     }
   }
 
-  self->UntrackResponse(requestId);
-
-  // TODO: keep? See https://devblogs.microsoft.com/oldnewthing/?p=106160
-  co_return;
+  self->UntrackResponse(coReqArgs->RequestId);
 }
 
 #pragma endregion WinRTHttpResource
@@ -309,9 +330,18 @@ WinRTHttpResource::PerformSendRequest(int64_t requestId, HttpRequestMessage &&re
 #pragma region IHttpResource
 
 /*static*/ shared_ptr<IHttpResource> IHttpResource::Make() noexcept {
-  return std::make_shared<WinRTHttpResource>();
+  if (static_cast<OriginPolicy>(GetRuntimeOptionInt("Http.OriginPolicy")) == OriginPolicy::None) {
+    return std::make_shared<WinRTHttpResource>();
+  } else {
+    auto globalOrigin = GetRuntimeOptionString("Http.GlobalOrigin");
+    OriginPolicyHttpFilter::SetStaticOrigin(std::move(globalOrigin));
+    auto opFilter = winrt::make<OriginPolicyHttpFilter>();
+    auto client = winrt::Windows::Web::Http::HttpClient{opFilter};
+
+    return std::make_shared<WinRTHttpResource>(std::move(client));
+  }
 }
 
 #pragma endregion IHttpResource
 
-} // namespace Microsoft::React
+} // namespace Microsoft::React::Networking

package/Shared/{WinRTHttpResource.h → Networking/WinRTHttpResource.h}

@@ -3,7 +3,9 @@
 
 #pragma once
 
-#include <IHttpResource.h>
+#include "IHttpResource.h"
+
+#include "WinRTTypes.h"
 
 // Windows API
 #include <winrt/Windows.Web.Http.h>
@@ -11,33 +13,27 @@
 // Standard Library
 #include <mutex>
 
-namespace Microsoft::React {
+namespace Microsoft::React::Networking {
 
 class WinRTHttpResource : public IHttpResource, public std::enable_shared_from_this<WinRTHttpResource> {
-  typedef winrt::Windows::Foundation::IAsyncOperationWithProgress<
-      winrt::Windows::Web::Http::HttpResponseMessage,
-      winrt::Windows::Web::Http::HttpProgress>
-      ResponseType;
-
   static int64_t s_lastRequestId;
 
   winrt::Windows::Web::Http::IHttpClient m_client;
   std::mutex m_mutex;
-  std::unordered_map<int64_t, ResponseType> m_responses;
+  std::unordered_map<int64_t, ResponseOperation> m_responses;
 
   std::function<void(int64_t requestId)> m_onRequest;
   std::function<void(int64_t requestId, Response &&response)> m_onResponse;
   std::function<void(int64_t requestId, std::string &&responseData)> m_onData;
   std::function<void(int64_t requestId, std::string &&errorMessage /*, bool isTimeout*/)> m_onError;
 
-  void TrackResponse(int64_t requestId, ResponseType response) noexcept;
+  void TrackResponse(int64_t requestId, ResponseOperation response) noexcept;
 
   void UntrackResponse(int64_t requestId) noexcept;
 
   winrt::fire_and_forget PerformSendRequest(
-      int64_t requestId,
       winrt::Windows::Web::Http::HttpRequestMessage &&request,
-      bool textResponse) noexcept;
+      winrt::Windows::Foundation::IInspectable const &args) noexcept;
 
  public:
   WinRTHttpResource() noexcept;
@@ -68,4 +64,4 @@ class WinRTHttpResource : public IHttpResource, public std::enable_shared_from_t
                       &&handler) noexcept override;
 };
 
-} // namespace Microsoft::React
+} // namespace Microsoft::React::Networking

package/Shared/Networking/WinRTTypes.h

@@ -0,0 +1,30 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+#pragma once
+
+#include "IHttpResource.h"
+
+// Windows API
+#include <winrt/Windows.Web.Http.h>
+
+// Standard Library
+#include <mutex>
+
+namespace Microsoft::React::Networking {
+
+struct RequestArgs : public winrt::implements<RequestArgs, winrt::Windows::Foundation::IInspectable> {
+  int64_t RequestId;
+  IHttpResource::Headers Headers;
+  IHttpResource::BodyData Body;
+  bool IncrementalUpdates;
+  bool WithCredentials;
+  bool IsText;
+  int64_t Timeout;
+};
+
+typedef winrt::Windows::Foundation::
+    IAsyncOperationWithProgress<winrt::Windows::Web::Http::HttpResponseMessage, winrt::Windows::Web::Http::HttpProgress>
+        ResponseOperation;
+
+} // namespace Microsoft::React::Networking

package/Shared/{WinRTWebSocketResource.cpp → Networking/WinRTWebSocketResource.cpp}

@@ -79,7 +79,7 @@ auto resume_in_queue(const Mso::DispatchQueue &queue) noexcept {
 
 } // namespace
 
-namespace Microsoft::React {
+namespace Microsoft::React::Networking {
 
 // private
 WinRTWebSocketResource::WinRTWebSocketResource(
@@ -423,4 +423,4 @@ void WinRTWebSocketResource::SetOnError(function<void(Error &&)> &&handler) noex
 
 #pragma endregion IWebSocketResource
 
-} // namespace Microsoft::React
+} // namespace Microsoft::React::Networking

package/Shared/{WinRTWebSocketResource.h → Networking/WinRTWebSocketResource.h}

@@ -3,18 +3,18 @@
 
 #pragma once
 
-#include <IWebSocketResource.h>
 #include <dispatchQueue/dispatchQueue.h>
 #include <eventWaitHandle/eventWaitHandle.h>
 #include <winrt/Windows.Networking.Sockets.h>
 #include <winrt/Windows.Storage.Streams.h>
+#include "IWebSocketResource.h"
 
 // Standard Library
 #include <future>
 #include <mutex>
 #include <queue>
 
-namespace Microsoft::React {
+namespace Microsoft::React::Networking {
 
 class WinRTWebSocketResource : public IWebSocketResource, public std::enable_shared_from_this<WinRTWebSocketResource> {
   winrt::Windows::Networking::Sockets::IMessageWebSocket m_socket;
@@ -126,4 +126,4 @@ class WinRTWebSocketResource : public IWebSocketResource, public std::enable_sha
 #pragma endregion IWebSocketResource
 };
 
-} // namespace Microsoft::React
+} // namespace Microsoft::React::Networking

package/Shared/OInstance.cpp

@@ -37,11 +37,11 @@
 #endif
 
 #include <BatchingMessageQueueThread.h>
+#include <CppRuntimeOptions.h>
 #include <CreateModules.h>
 #include <DevSettings.h>
 #include <DevSupportManager.h>
 #include <IReactRootView.h>
-#include <RuntimeOptions.h>
 #include <Shlwapi.h>
 #include <WebSocketJSExecutorFactory.h>
 #include <safeint.h>
@@ -254,7 +254,7 @@ InstanceImpl::InstanceImpl(
 #endif
 
   if (shouldStartHermesInspector(*m_devSettings)) {
-    m_devManager->StartInspector(m_devSettings->sourceBundleHost, m_devSettings->sourceBundlePort);
+    m_devManager->EnsureHermesInspector(m_devSettings->sourceBundleHost, m_devSettings->sourceBundlePort);
   }
 
   // Default (common) NativeModules
@@ -405,7 +405,7 @@ bool isHBCBundle(const std::string &bundle) {
   // can be potentially huge.
   // https://herbsutter.com/2008/04/07/cringe-not-vectors-are-guaranteed-to-be-contiguous/#comment-483
   auto header = reinterpret_cast<const BundleHeader *>(&bundle[0]);
-  if (HBCBundleMagicNumber == folly::Endian::little(header->magic)) {
+  if (HBCBundleMagicNumber == header->magic32.value) {
     return true;
   } else {
     return false;
@@ -532,8 +532,8 @@ void InstanceImpl::loadBundleInternal(std::string &&jsBundleRelativePath, bool s
 }
 
 InstanceImpl::~InstanceImpl() {
-  if (m_devSettings->jsiEngineOverride == JSIEngineOverride::Hermes) {
-    m_devManager->StopInspector();
+  if (shouldStartHermesInspector(*m_devSettings) && m_devSettings->jsiRuntimeHolder) {
+    m_devSettings->jsiRuntimeHolder->teardown();
   }
   m_nativeQueue->quitSynchronous();
 }