fix extensions webview route on windows #5619

amiramw · 2019-07-01T21:41:53Z

Signed-off-by: Amiram Wingarten amiram.wingarten@sap.com

Removed what seems to be redundant check of having a leading slash on file path when serving /webview/ route.
This also made this flow not working on windows.

akosyakov · 2019-07-02T05:54:21Z

@amiramw How do you verify it?

amiramw · 2019-07-02T06:30:48Z

@akosyakov I tested with https://marketplace.visualstudio.com/items?itemName=mtxr.sqltools and saw that all requests came with full paths.
Can you suggest other webview extensions that work on theia. I can test with them.
@olexii4 @evidolob can you advise whether there was a real use case for this condition when you pushed 3d4501a?

akosyakov · 2019-07-05T08:48:11Z

@olexii4 @evidolob any feedback? if you think it was not covering any use cases before at least let us know

akosyakov · 2019-07-05T08:51:12Z

@amiramw Could you test on windows whether your change also help if theia deployed under the path with whitespaces?

amiramw · 2019-07-05T11:37:31Z

@akosyakov yes. when the path for theia contains space the webview seems to work.

packages/plugin-ext/src/main/node/plugin-service.ts

kittaakos · 2019-07-10T14:31:27Z

I am looking into this...

Just an upfront question; can we send URIs (as strings) instead of paths? So that we do not have to figure out why we had to add this special handling. For the completeness; both file download and upload works with URIs instead of FS paths.

kittaakos · 2019-07-11T08:53:23Z

I have verified master and amiramw:webview-win on both Windows and macOS:

master on Windows:
As the issue describes, it is broken:

onLoad @ webviews-main.ts:100
onLoad @ webview.ts:144
(anonymous) @ webview.ts:154
webview.ts:164 GET http://localhost:3030/webview/c%3A/Users/kittaakos/dev/vscode-extension-samples/webview-sample/media/main.js net::ERR_ABORTED 404 (Not Found)
push.../../packages/plugin-ext/lib/main/browser/webview/webview.js.WebviewWidget.setHTML @ webview.ts:164
push.../../packages/plugin-ext/lib/main/browser/webviews-main.js.WebviewsMainImpl.$setHtml @ webviews-main.ts:219
push.../../packages/plugin-ext/lib/api/rpc-protocol.js.RPCProtocolImpl.doInvokeHandler @ rpc-protocol.ts:249
push.../../packages/plugin-ext/lib/api/rpc-protocol.js.RPCProtocolImpl.invokeHandler @ rpc-protocol.ts:234
push.../../packages/plugin-ext/lib/api/rpc-protocol.js.RPCProtocolImpl.receiveRequest @ rpc-protocol.ts:188
push.../../packages/plugin-ext/lib/api/rpc-protocol.js.RPCProtocolImpl.receiveOneMessage @ rpc-protocol.ts:155
(anonymous) @ rpc-protocol.ts:83
(anonymous) @ rpc-protocol.ts:283
(anonymous) @ event.ts:119
../../packages/core/lib/common/event.js.CallbackList.invoke @ event.ts:127
../../packages/core/lib/common/event.js.Emitter.fire @ event.ts:220
postMessage @ hosted-plugin-watcher.ts:41
(anonymous) @ proxy-factory.ts:160
step @ proxy-factory.ts:15
(anonymous) @ proxy-factory.ts:15
(anonymous) @ proxy-factory.ts:15
../../packages/core/lib/common/messaging/proxy-factory.js.__awaiter @ proxy-factory.ts:15
../../packages/core/lib/common/messaging/proxy-factory.js.JsonRpcProxyFactory.onRequest @ proxy-factory.ts:158
(anonymous) @ proxy-factory.ts:136
handleRequest @ main.js:361
processMessageQueue @ main.js:252
(anonymous) @ main.js:242
run @ setImmediate.js:40
runIfPresent @ setImmediate.js:69
onGlobalMessage @ setImmediate.js:109
postMessage (async)
registerImmediate @ setImmediate.js:120
setImmediate @ setImmediate.js:27
triggerMessageQueue @ main.js:240
callback @ main.js:289
../../node_modules/vscode-ws-jsonrpc/lib/socket/reader.js.WebSocketMessageReader.readMessage @ reader.ts:57
(anonymous) @ reader.ts:18
../../packages/core/lib/common/messaging/web-socket-channel.js.WebSocketChannel.handleMessage @ web-socket-channel.ts:49
WebSocketConnectionProvider.socket.onmessage @ ws-connection-provider.ts:74
theme-rules-service.ts:50 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

master on macOS:
I can see the following error all the time. Probably it is unrelated to, so I opened a follow-up:

webviews-main.ts:100 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'none'". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

amiramw:webview-win on Windows:
The original issue is gone, so the proposed change resolves the problem, but I can still see this in the backend log. By the way, it is there on the master on Windows:

root ERROR Request runWatchCompilation failed with error: Watch script doesn't exist in /c%3A/Users/kittaakos/dev/vscode
-extension-samples/webview-sample\package.json Error: Watch script doesn't exist in /c%3A/Users/kittaakos/dev/vscode-ext
ension-samples/webview-sample\package.json
    at HostedPluginsManagerImpl.runWatchCompilation (C:\Users\kittaakos\dev\theia\packages\plugin-dev\lib\node\hosted-pl
ugins-manager.js:48:19)
    at HostedPluginServerImpl.runWatchCompilation (C:\Users\kittaakos\dev\theia\packages\plugin-dev\lib\node\hosted-plug
in-service.js:125:42)
    at JsonRpcProxyFactory.<anonymous> (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js
:217:73)
    at step (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:47:23)
    at Object.next (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:28:53)
    at C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:22:71
    at new Promise (<anonymous>)
    at __awaiter (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:18:12)
    at JsonRpcProxyFactory.onRequest (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:2
11:16)
    at C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:174:48
root INFO Stopped watching the git repository: file:///c%3A/Users/kittaakos/dev/vscode-extension-samples
root ERROR Uncaught Exception:  Error: Connection is disposed.
root ERROR Error: Connection is disposed.
    at new ConnectionError (C:\Users\kittaakos\dev\theia\node_modules\vscode-jsonrpc\lib\main.js:138:28)
    at throwIfClosedOrDisposed (C:\Users\kittaakos\dev\theia\node_modules\vscode-jsonrpc\lib\main.js:616:19)
    at Object.sendRequest (C:\Users\kittaakos\dev\theia\node_modules\vscode-jsonrpc\lib\main.js:715:13)
    at C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:310:72
    at new Promise (<anonymous>)
    at C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:303:24
    at process._tickCallback (internal/process/next_tick.js:68:7)

amiramw:webview-win on macOS:
Perhaps this was the error @olexii4 has mentioned:

webview.ts:164 GET http://localhost:3030/webview/Users/akos.kitta/Desktop/vscode-extension-samples/webview-sample/media/main.js net::ERR_ABORTED 500 (Internal Server Error)

olexii4 · 2019-07-11T09:17:19Z

amiramw:webview-win on Linux:

webview.ts:164 GET http://localhost:3030/webview/home/oleksii/workspace/Microsoft/vscode-extension-samples/webview-sample/media/main.js net::ERR_ABORTED 500 (Internal Server Error)

So, the webview-sample script doesn't work - counter is '0'

- Use FileUri.fsPath in order to get cross OS file path on /webview/ route. Fixes windows. - Remove leading slash of webview route that caused the browser to send wrong path (/webview/...) when theia is served behind path based proxy fixes eclipse-theia#5503 Signed-off-by: Amiram Wingarten <amiram.wingarten@sap.com>

kittaakos · 2019-07-22T08:03:05Z

I am checking it...

kittaakos · 2019-07-22T08:40:17Z

I have tried the more recent changes on both Windows and macOS; both seems to work. I can see the counter updating in the cat coding session. However, this error still present on Windows:

root ERROR [hosted-plugin: 8632] Unsupported activation events: onWebviewPanel:catCoding, please open an issue: https://
github.com/theia-ide/theia/issues/new
vscode-samples.cat-coding extension will be activated eagerly.
root INFO [hosted-plugin: 8632] PLUGIN_HOST(8632): initializing(cat-coding@0.0.1 with C:\Users\kittaakos\dev\theia\packa
ges\plugin-ext-vscode\lib\node/plugin-vscode-init.js)
PLUGIN_HOST(8632): PluginManagerExtImpl/loadPlugin(C:\Users\kittaakos\dev\theia\plugins\webview-sample\out\extension.js)
root INFO [nsfw-watcher: 6756] Started watching: c:\Users\kittaakos\dev\vscode-extension-samples\webview-sample\tsconfig
.json
root WARN Widget was activated, but did not accept focus: terminal-0
root INFO [nsfw-watcher: 6756] Started watching: c:\Users\kittaakos\dev\vscode-extension-samples\webview-sample\.vscode\
settings.json
root INFO [nsfw-watcher: 6756] Stopped watching: c:\Users\kittaakos\dev\vscode-extension-samples\webview-sample\.vscode\
settings.json
root INFO [nsfw-watcher: 6756] Stopped watching: c:\Users\kittaakos\dev\vscode-extension-samples\webview-sample\tsconfig
.json
root ERROR Request runWatchCompilation failed with error: Watch script doesn't exist in /c%3A/Users/kittaakos/dev/vscode
-extension-samples/webview-sample\package.json Error: Watch script doesn't exist in /c%3A/Users/kittaakos/dev/vscode-ext
ension-samples/webview-sample\package.json
    at HostedPluginsManagerImpl.runWatchCompilation (C:\Users\kittaakos\dev\theia\packages\plugin-dev\lib\node\hosted-pl
ugins-manager.js:48:19)
    at HostedPluginServerImpl.runWatchCompilation (C:\Users\kittaakos\dev\theia\packages\plugin-dev\lib\node\hosted-plug
in-service.js:125:42)
    at JsonRpcProxyFactory.<anonymous> (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js
:217:73)
    at step (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:47:23)
    at Object.next (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:28:53)
    at C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:22:71
    at new Promise (<anonymous>)
    at __awaiter (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:18:12)
    at JsonRpcProxyFactory.onRequest (C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:2
11:16)
    at C:\Users\kittaakos\dev\theia\packages\core\lib\common\messaging\proxy-factory.js:174:48

amiramw · 2019-07-22T20:39:29Z

I'm pretty sure that this error is not related to my change or to webviews.
I also noticed that hosted plugin watch flow doesn't work on windows due to path format. This is a different issue.

amiramw · 2019-07-24T18:15:39Z

@kittaakos is this PR good enough or more changes required?

kittaakos

I have verified the cat coding webview-example on both Windows and macOS; they worked. 👍

Any objections merging this @benoitf?

kittaakos · 2019-07-25T06:05:54Z

@olexii4, can you please check if you still see the net::ERR_ABORTED 500 (Internal Server Error) error on Linux with the most recent state?

partially reverting changes from #5619 which break "html base href" logic in webview for instance in the python extension for vscode.

partially reverting changes from #5619 which break "html base href" logic in webview for instance in the python extension for vscode. Signed-off-by: Alex Tugarev <alex.tugarev@typefox.io>

partially reverting changes from eclipse-theia#5619 which break "html base href" logic in webview for instance in the python extension for vscode. Signed-off-by: Alex Tugarev <alex.tugarev@typefox.io>

amiramw requested review from benoitf and evidolob as code owners July 1, 2019 21:41

amiramw force-pushed the webview-win branch 2 times, most recently from b29ce47 to 25f321f Compare July 3, 2019 18:16

akosyakov added vscode issues related to VSCode compatibility webviews issues related to webviews labels Jul 5, 2019

olexii4 reviewed Jul 8, 2019

View reviewed changes

packages/plugin-ext/src/main/node/plugin-service.ts Show resolved Hide resolved

kittaakos self-requested a review July 10, 2019 07:30

amiramw force-pushed the webview-win branch from 25f321f to 447dad2 Compare July 21, 2019 14:09

akosyakov mentioned this pull request Jul 21, 2019

[plugin-host] Path traversal + XSS fix #5746

Merged

kittaakos approved these changes Jul 24, 2019

View reviewed changes

kittaakos merged commit 0814a6c into eclipse-theia:master Jul 25, 2019

AlexTugarev added a commit that referenced this pull request Sep 27, 2019

revert "Remove leading slash of webview route ..."

7d9bd7e

partially reverting changes from #5619 which break "html base href" logic in webview for instance in the python extension for vscode.

AlexTugarev mentioned this pull request Sep 27, 2019

revert "Remove leading slash of webview route ..." #6279

Merged

1 task

AlexTugarev mentioned this pull request Sep 27, 2019

pass webview URIs as is #6282

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix extensions webview route on windows #5619

fix extensions webview route on windows #5619

amiramw commented Jul 1, 2019

akosyakov commented Jul 2, 2019

amiramw commented Jul 2, 2019

akosyakov commented Jul 5, 2019

akosyakov commented Jul 5, 2019

amiramw commented Jul 5, 2019

kittaakos commented Jul 10, 2019

kittaakos commented Jul 11, 2019 •

edited

Loading

olexii4 commented Jul 11, 2019 •

edited

Loading

kittaakos commented Jul 22, 2019

kittaakos commented Jul 22, 2019

amiramw commented Jul 22, 2019

amiramw commented Jul 24, 2019

kittaakos left a comment

kittaakos commented Jul 25, 2019

fix extensions webview route on windows #5619

fix extensions webview route on windows #5619

Conversation

amiramw commented Jul 1, 2019

akosyakov commented Jul 2, 2019

amiramw commented Jul 2, 2019

akosyakov commented Jul 5, 2019

akosyakov commented Jul 5, 2019

amiramw commented Jul 5, 2019

kittaakos commented Jul 10, 2019

kittaakos commented Jul 11, 2019 • edited Loading

olexii4 commented Jul 11, 2019 • edited Loading

kittaakos commented Jul 22, 2019

kittaakos commented Jul 22, 2019

amiramw commented Jul 22, 2019

amiramw commented Jul 24, 2019

kittaakos left a comment

Choose a reason for hiding this comment

kittaakos commented Jul 25, 2019

kittaakos commented Jul 11, 2019 •

edited

Loading

olexii4 commented Jul 11, 2019 •

edited

Loading