From a565133f73b94850ac892b1948bd211d4de02c98 Mon Sep 17 00:00:00 2001 From: David Justice Date: Fri, 21 Jan 2022 17:28:43 -0500 Subject: [PATCH] fix: add companion ids to allow origins - fixes #8689 - Adds the chrome-extension ids for ipfs-companion and ipfs-companion-beta to the allowed origins list, this allows us to accesss ipfs api from a manifest v3 extension. - added tests in t0401-api-browser-security.sh --- core/corehttp/commands.go | 2 ++ test/sharness/t0401-api-browser-security.sh | 15 +++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/core/corehttp/commands.go b/core/corehttp/commands.go index c5443f6eb3f3..4381288efd21 100644 --- a/core/corehttp/commands.go +++ b/core/corehttp/commands.go @@ -44,6 +44,8 @@ var defaultLocalhostOrigins = []string{ "https://[::1]:", "http://localhost:", "https://localhost:", + "chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch", // ipfs-companion + "chrome-extension://hjoieblefckbooibpepigmacodalfndh" // ipfs-companion-beta } func addCORSFromEnv(c *cmdsHttp.ServerConfig) { diff --git a/test/sharness/t0401-api-browser-security.sh b/test/sharness/t0401-api-browser-security.sh index 1e36bcead325..d7bd3a67d3fb 100755 --- a/test/sharness/t0401-api-browser-security.sh +++ b/test/sharness/t0401-api-browser-security.sh @@ -39,6 +39,21 @@ test_expect_success "browser is able to access API if Origin is the API port on grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output ' +test_expect_success "Companion extension is unable to access API with invalid Origin" ' + curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://invalidextensionid" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && + grep "HTTP/1.1 403 Forbidden" curl_output +' + +test_expect_success "Companion extension is able to access API if Origin is the API port on localhost (ipv4)" ' + curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && + grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output +' + +test_expect_success "Companion beta extension is able to access API if Origin is the API port on localhost (ipv4)" ' + curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://hjoieblefckbooibpepigmacodalfndh" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && + grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output +' + test_kill_ipfs_daemon test_expect_success "setting CORS in API.HTTPHeaders works via CLI" "