fix: allow webkit config api opaque origin

commit: d8236344e7e18e56d535616acd15ec584501a44b
author: brice · 4mo ago · 2026-06-24 04:29 UTC
parent: 13cc5a8
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +27 -1

M internal/infrastructure/webkit/scheme_handler.go +1 -1


@@ -265,7 +265,7 @@ func isTrustedSystemviewAPIRequest(req *SchemeRequest) bool {
265	265		return false
266	266		}
267	267		origin := strings.TrimSpace(req.Origin)
268		-	if origin != "" {
	268	+	if origin != "" && !strings.EqualFold(origin, "null") {
269	269		return isTrustedSystemviewURL(origin)
270	270		}
271	271		return isTrustedSystemviewURL(req.Referer)


@@ -265,7 +265,7 @@ func isTrustedSystemviewAPIRequest(req *SchemeRequest) bool {
265		return false	265		return false
266		}	266		}
267		origin := strings.TrimSpace(req.Origin)	267		origin := strings.TrimSpace(req.Origin)
268	-	if origin != "" {	268	+	if origin != "" && !strings.EqualFold(origin, "null") {
269		return isTrustedSystemviewURL(origin)	269		return isTrustedSystemviewURL(origin)
270		}	270		}
271		return isTrustedSystemviewURL(req.Referer)	271		return isTrustedSystemviewURL(req.Referer)

M internal/infrastructure/webkit/scheme_handler_test.go +26 -0


@@ -242,6 +242,32 @@ func TestConfigHandlersRejectUntrustedRequests(t *testing.T) {
242	242		}
243	243		}
244	244
	245	+	func TestConfigHandlersAllowOpaqueOriginWithTrustedReferer(t *testing.T) {
	246	+	h := NewDumbSchemeHandler(context.Background())
	247	+	h.SetConfigPayloadBuilders(
	248	+	func() ([]byte, error) { return []byte(`{"current":true}`), nil },
	249	+	func() ([]byte, error) { return []byte(`{"default":true}`), nil },
	250	+	)
	251	+
	252	+	h.mu.RLock()
	253	+	currentHandler := h.handlers["/api/config"]
	254	+	h.mu.RUnlock()
	255	+	require.NotNil(t, currentHandler)
	256	+
	257	+	resp := currentHandler.Handle(&SchemeRequest{
	258	+	URI: "dumb://config/api/config",
	259	+	Path: "/api/config",
	260	+	Method: http.MethodGet,
	261	+	Scheme: "dumb",
	262	+	Origin: "null",
	263	+	Referer: "dumb://config",
	264	+	})
	265	+
	266	+	require.NotNil(t, resp)
	267	+	assert.Equal(t, http.StatusOK, resp.StatusCode)
	268	+	assert.Equal(t, []byte(`{"current":true}`), resp.Data)
	269	+	}
	270	+
245	271		func TestShouldAddCORSHeaders(t *testing.T) {
246	272		t.Parallel()
247	273


@@ -242,6 +242,32 @@ func TestConfigHandlersRejectUntrustedRequests(t *testing.T) {
242	}	242		}
243	}	243		}
244		244
		245	+	func TestConfigHandlersAllowOpaqueOriginWithTrustedReferer(t *testing.T) {
		246	+	h := NewDumbSchemeHandler(context.Background())
		247	+	h.SetConfigPayloadBuilders(
		248	+	func() ([]byte, error) { return []byte(`{"current":true}`), nil },
		249	+	func() ([]byte, error) { return []byte(`{"default":true}`), nil },
		250	+	)
		251	+
		252	+	h.mu.RLock()
		253	+	currentHandler := h.handlers["/api/config"]
		254	+	h.mu.RUnlock()
		255	+	require.NotNil(t, currentHandler)
		256	+
		257	+	resp := currentHandler.Handle(&SchemeRequest{
		258	+	URI: "dumb://config/api/config",
		259	+	Path: "/api/config",
		260	+	Method: http.MethodGet,
		261	+	Scheme: "dumb",
		262	+	Origin: "null",
		263	+	Referer: "dumb://config",
		264	+	})
		265	+
		266	+	require.NotNil(t, resp)
		267	+	assert.Equal(t, http.StatusOK, resp.StatusCode)
		268	+	assert.Equal(t, []byte(`{"current":true}`), resp.Data)
		269	+	}
		270	+
245	func TestShouldAddCORSHeaders(t *testing.T) {	271		func TestShouldAddCORSHeaders(t *testing.T) {
246	t.Parallel()	272		t.Parallel()
247		273