plugin-ext: attach security cookie to webviews

When on Electron, we use a cookie to tell if an http client can use the
backend services. Cookies are bound to domains to which requests will be
made, and also subdomains in certain situations. Because we are using
`localhost` the cookie cannot be shared across subdomains. This commit
works around this limitation by passing the security token from
electron-main process to the renderer-process via a global variable,
and the token is then set inside a cookie for each new webview endpoint
created by the plugin system in the frontend.

Signed-off-by: Paul Maréchal <paul.marechal@ericsson.com>

dev-packages/application-manager/src/generator/frontend-generator.ts

@@ -155,6 +155,9 @@ const electronSecurityToken = {
     value: v4(),
 };
 
+// Make it easy for renderer process to fetch the ElectronSecurityToken:
+global[ElectronSecurityToken] = electronSecurityToken;
+
 app.on('ready', () => {
 
     // Explicitly set the app name to have better menu items on macOS. ("About", "Hide", and "Quit")
@@ -322,19 +325,26 @@ app.on('ready', () => {
         })
     }
 
-    const loadMainWindow = (port) => {
-        if (!mainWindow.isDestroyed()) {
-            mainWindow.webContents.session.cookies.set({
+    const setElectronSecurityToken = port => {
+        return new Promise((resolve, reject) => {
+            electron.session.defaultSession.cookies.set({
                 url: \`http://localhost:\${port}/\`,
                 name: ElectronSecurityToken,
                 value: JSON.stringify(electronSecurityToken),
+                httpOnly: true,
             }, error => {
                 if (error) {
-                    console.error(error);
+                    reject(error);
                 } else {
-                    mainWindow.loadURL('file://' + join(__dirname, '../../lib/index.html') + '?port=' + port);
+                    resolve();
                 }
             });
+        })
+    }
+
+    const loadMainWindow = port => {
+        if (!mainWindow.isDestroyed()) {
+            mainWindow.loadURL('file://' + join(__dirname, '../../lib/index.html') + '?port=' + port);
         }
     };
 
@@ -354,7 +364,8 @@ app.on('ready', () => {
     // But when in debugging we want to run everything in the same process to make things easier.
     if (noBackendFork) {
         process.env[ElectronSecurityToken] = JSON.stringify(electronSecurityToken);
-        require(mainPath).then(address => {
+        require(mainPath).then(async (address) => {
+            await setElectronSecurityToken(address.port);
             loadMainWindow(address.port);
         }).catch((error) => {
             console.error(error);
@@ -367,7 +378,8 @@ app.on('ready', () => {
         const cp = fork(mainPath, process.argv.slice(devMode ? 2 : 1), { env: Object.assign({
             [ElectronSecurityToken]: JSON.stringify(electronSecurityToken),
         }, process.env) });
-        cp.on('message', (address) => {
+        cp.on('message', async (address) => {
+            await setElectronSecurityToken(address.port);
             loadMainWindow(address.port);
         });
         cp.on('error', (error) => {

packages/core/package.json

@@ -66,6 +66,7 @@
       "backendElectron": "lib/electron-node/keyboard/electron-backend-keyboard-module"
     },
     {
+      "frontendElectron": "lib/electron-browser/token/electron-token-frontend-module",
       "backendElectron": "lib/electron-node/token/electron-token-backend-module"
     }
   ],

packages/core/src/electron-browser/token/electron-token-frontend-module.ts

@@ -0,0 +1,23 @@
+/********************************************************************************
+ * Copyright (C) 2020 Ericsson and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import * as electron from 'electron';
+import { ContainerModule } from 'inversify';
+import { ElectronSecurityToken } from '../../electron-common/electron-token';
+
+export default new ContainerModule(bind => {
+    bind(ElectronSecurityToken).toConstantValue(electron.remote.getGlobal(ElectronSecurityToken));
+});

packages/plugin-ext/package.json

@@ -51,6 +51,9 @@
       "backend": "lib/plugin-ext-backend-module",
       "backendElectron": "lib/plugin-ext-backend-electron-module",
       "frontend": "lib/plugin-ext-frontend-module"
+    },
+    {
+      "frontendElectron": "lib/plugin-ext-frontend-electron-module"
     }
   ],
   "keywords": [
@@ -87,4 +90,4 @@
   "nyc": {
     "extends": "../../configs/nyc.json"
   }
-}
+}

packages/plugin-ext/src/main/browser/plugin-ext-frontend-module.ts

@@ -62,14 +62,15 @@ import { LanguagesMainFactory, OutputChannelRegistryFactory } from '../../common
 import { LanguagesMainImpl } from './languages-main';
 import { OutputChannelRegistryMainImpl } from './output-channel-registry-main';
 import { InPluginFileSystemWatcherManager } from './in-plugin-filesystem-watcher-manager';
-import { WebviewWidget, WebviewWidgetIdentifier, WebviewWidgetExternalEndpoint } from './webview/webview';
+import { WebviewWidget } from './webview/webview';
 import { WebviewEnvironment } from './webview/webview-environment';
 import { WebviewThemeDataProvider } from './webview/webview-theme-data-provider';
 import { bindWebviewPreferences } from './webview/webview-preferences';
 import { WebviewResourceLoader, WebviewResourceLoaderPath } from '../common/webview-protocol';
 import { WebviewResourceCache } from './webview/webview-resource-cache';
 import { PluginIconThemeService, PluginIconThemeFactory, PluginIconThemeDefinition, PluginIconTheme } from './plugin-icon-theme-service';
 import { PluginTreeViewNodeLabelProvider } from './view/plugin-tree-view-node-label-provider';
+import { WebviewWidgetFactory } from './webview/webview-widget-factory';
 
 export default new ContainerModule((bind, unbind, isBound, rebind) => {
 
@@ -162,21 +163,8 @@ export default new ContainerModule((bind, unbind, isBound, rebind) => {
     ).inSingletonScope();
     bind(WebviewResourceCache).toSelf().inSingletonScope();
     bind(WebviewWidget).toSelf();
-    bind(WidgetFactory).toDynamicValue(({ container }) => ({
-        id: WebviewWidget.FACTORY_ID,
-        createWidget: async (identifier: WebviewWidgetIdentifier) => {
-            const externalEndpoint = await container.get(WebviewEnvironment).externalEndpoint();
-            let endpoint = externalEndpoint.replace('{{uuid}}', identifier.id);
-            if (endpoint[endpoint.length - 1] === '/') {
-                endpoint = endpoint.slice(0, endpoint.length - 1);
-            }
-
-            const child = container.createChild();
-            child.bind(WebviewWidgetIdentifier).toConstantValue(identifier);
-            child.bind(WebviewWidgetExternalEndpoint).toConstantValue(endpoint);
-            return child.get(WebviewWidget);
-        }
-    })).inSingletonScope();
+    bind(WebviewWidgetFactory).toDynamicValue(ctx => new WebviewWidgetFactory(ctx.container)).inSingletonScope();
+    bind(WidgetFactory).toService(WebviewWidgetFactory);
 
     bind(PluginViewWidget).toSelf();
     bind(WidgetFactory).toDynamicValue(({ container }) => ({

packages/plugin-ext/src/main/browser/webview/webview-widget-factory.ts

@@ -0,0 +1,43 @@
+/********************************************************************************
+ * Copyright (C) 2020 Ericsson and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import { interfaces } from 'inversify';
+import { WebviewWidget, WebviewWidgetIdentifier, WebviewWidgetExternalEndpoint } from './webview';
+import { WebviewEnvironment } from './webview-environment';
+
+export class WebviewWidgetFactory {
+
+    readonly id = WebviewWidget.FACTORY_ID;
+
+    protected readonly container: interfaces.Container;
+
+    constructor(container: interfaces.Container) {
+        this.container = container;
+    }
+
+    async createWidget(identifier: WebviewWidgetIdentifier): Promise<WebviewWidget> {
+        const externalEndpoint = await this.container.get(WebviewEnvironment).externalEndpoint();
+        let endpoint = externalEndpoint.replace('{{uuid}}', identifier.id);
+        if (endpoint[endpoint.length - 1] === '/') {
+            endpoint = endpoint.slice(0, endpoint.length - 1);
+        }
+        const child = this.container.createChild();
+        child.bind(WebviewWidgetIdentifier).toConstantValue(identifier);
+        child.bind(WebviewWidgetExternalEndpoint).toConstantValue(endpoint);
+        return child.get(WebviewWidget);
+    }
+
+}

packages/plugin-ext/src/main/electron-browser/plugin-ext-frontend-electron-module.ts

@@ -0,0 +1,23 @@
+/********************************************************************************
+ * Copyright (C) 2020 Ericsson and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import { ContainerModule } from 'inversify';
+import { WebviewWidgetFactory } from '../browser/webview/webview-widget-factory';
+import { ElectronWebviewWidgetFactory } from './webview/electron-webview-widget-factory';
+
+export default new ContainerModule((bind, unbind, isBound, rebind) => {
+    rebind(WebviewWidgetFactory).toDynamicValue(ctx => new ElectronWebviewWidgetFactory(ctx.container)).inSingletonScope();
+});

packages/plugin-ext/src/main/electron-browser/webview/electron-webview-widget-factory.ts

@@ -0,0 +1,52 @@
+/********************************************************************************
+ * Copyright (C) 2020 Ericsson and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import { remote } from 'electron';
+import { ElectronSecurityToken } from '@theia/core/lib/electron-common/electron-token';
+import { WebviewWidgetFactory } from '../../browser/webview/webview-widget-factory';
+import { WebviewWidgetIdentifier, WebviewWidget } from '../../browser/webview/webview';
+
+export class ElectronWebviewWidgetFactory extends WebviewWidgetFactory {
+
+    async createWidget(identifier: WebviewWidgetIdentifier): Promise<WebviewWidget> {
+        const widget = await super.createWidget(identifier);
+        this.attachElectronSecurityCookie(widget.externalEndpoint);
+        return widget;
+    }
+
+    /**
+     * Attach the ElectronSecurityToken to a cookie that will be sent with each webview request.
+     *
+     * @param endpoint cookie's target url
+     */
+    protected attachElectronSecurityCookie(endpoint: string): Promise<void> {
+        return new Promise((resolve, reject) => {
+            remote.session.defaultSession!.cookies.set({
+                url: endpoint,
+                name: ElectronSecurityToken,
+                value: JSON.stringify(this.container.get(ElectronSecurityToken)),
+                httpOnly: true,
+            }, error => {
+                if (error) {
+                    reject(error);
+                } else {
+                    resolve();
+                }
+            });
+        });
+    }
+
+}

packages/plugin-ext/src/plugin-ext-frontend-electron-module.ts

@@ -0,0 +1,19 @@
+/********************************************************************************
+ * Copyright (C) 2020 Ericsson and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0 which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the Eclipse
+ * Public License v. 2.0 are satisfied: GNU General Public License, version 2
+ * with the GNU Classpath Exception which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ ********************************************************************************/
+
+import mainModule from './main/electron-browser/plugin-ext-frontend-electron-module';
+
+export default mainModule;