fix(browser): harden and restore webview navigation

Generated-By: PostHog Code
Task-Id: b23f944d-dd7f-465b-9fed-1a1d028f35e1

Author: MattPua

apps/code/src/main/services/browser-view/service.test.ts

@@ -0,0 +1,30 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("browserViewService", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it.each([
+    ["true", true],
+    ["false", false],
+  ])("defaults to %s in development mode", async (isDev, expected) => {
+    vi.stubEnv("POSTHOG_CODE_IS_DEV", isDev);
+    const { browserViewService } = await import("./service");
+
+    expect(browserViewService.isEnabled()).toBe(expected);
+  });
+
+  it("updates the attachment gate", async () => {
+    vi.stubEnv("POSTHOG_CODE_IS_DEV", "false");
+    const { browserViewService } = await import("./service");
+
+    browserViewService.setEnabled(true);
+
+    expect(browserViewService.isEnabled()).toBe(true);
+  });
+});

apps/code/src/main/services/browser-view/service.ts

@@ -0,0 +1,15 @@
+import { isDevBuild } from "../../utils/env";
+
+class BrowserViewService {
+  private enabled = isDevBuild();
+
+  isEnabled(): boolean {
+    return this.enabled;
+  }
+
+  setEnabled(enabled: boolean): void {
+    this.enabled = enabled;
+  }
+}
+
+export const browserViewService = new BrowserViewService();

apps/code/src/main/trpc/router.ts

@@ -50,6 +50,7 @@ import { uiRouter } from "@posthog/host-router/routers/ui.router";
 import { updatesRouter } from "@posthog/host-router/routers/updates.router";
 import { usageMonitorRouter } from "@posthog/host-router/routers/usage-monitor.router";
 import { workspaceRouter } from "@posthog/host-router/routers/workspace.router";
+import { browserViewRouter } from "./routers/browser-view";
 import { devRouter } from "./routers/dev";
 import { discordPresenceRouter } from "./routers/discord-presence";
 import { encryptionRouter } from "./routers/encryption";
@@ -64,6 +65,7 @@ export const trpcRouter = router({
   auth: authRouter,
   autoresearch: autoresearchRouter,
   browserTabs: browserTabsRouter,
+  browserView: browserViewRouter,
   canvasData: canvasDataRouter,
   canvasTemplates: canvasTemplatesRouter,
   channelTasks: channelTasksRouter,

apps/code/src/main/trpc/routers/browser-view.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import { browserViewService } from "../../services/browser-view/service";
+import { publicProcedure, router } from "../trpc";
+
+export const browserViewRouter = router({
+  setEnabled: publicProcedure
+    .input(z.object({ enabled: z.boolean() }))
+    .mutation(({ input }) => browserViewService.setEnabled(input.enabled)),
+});

apps/code/src/main/utils/webview-attach-policy.test.ts

@@ -1,4 +1,4 @@
-import { BROWSER_WEBVIEW_PARTITION } from "@posthog/shared/constants";
+import { BROWSER_WEBVIEW_PARTITION } from "@shared/browser-view";
 import { describe, expect, it } from "vitest";
 import {
   hardenWebviewPreferences,

apps/code/src/main/utils/webview-attach-policy.ts

@@ -1,4 +1,4 @@
-import { BROWSER_WEBVIEW_PARTITION } from "@posthog/shared/constants";
+import { BROWSER_WEBVIEW_PARTITION } from "@shared/browser-view";
 import { isAllowedWebviewNavigation } from "./webview-navigation-guard";
 
 interface WebviewSecurityPreferences {

apps/code/src/main/utils/webview-navigation-guard.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import {
   isAllowedWebviewNavigation,
+  isAllowedWebviewRequest,
   isBlockedWebviewHost,
 } from "./webview-navigation-guard";
 
@@ -25,6 +26,25 @@ describe("isBlockedWebviewHost", () => {
   });
 });
 
+describe("isAllowedWebviewRequest", () => {
+  it.each([
+    ["https://posthog.com", "mainFrame", true],
+    ["http://posthog.com", "mainFrame", false],
+    ["https://posthog.com/app.js", "script", true],
+    ["http://localhost:3000/app.js", "script", true],
+    ["http://posthog.com/app.js", "script", false],
+    ["data:image/png;base64,AA==", "image", true],
+    ["blob:https://posthog.com/id", "xhr", true],
+    ["about:blank", "subFrame", true],
+    ["about:srcdoc", "subFrame", false],
+    ["file:///etc/passwd", "xhr", false],
+    ["custom-scheme://host/path", "xhr", false],
+    ["http://169.254.169.254/latest/meta-data/", "xhr", false],
+  ])("url %j resource %j -> allowed %s", (url, resourceType, allowed) => {
+    expect(isAllowedWebviewRequest(url, resourceType)).toBe(allowed);
+  });
+});
+
 describe("isAllowedWebviewNavigation", () => {
   it.each([
     ["https://posthog.com", true],

apps/code/src/main/utils/webview-navigation-guard.ts

@@ -58,3 +58,25 @@ export function isAllowedWebviewNavigation(url: string): boolean {
   if (parsed.protocol === "https:") return true;
   return parsed.protocol === "http:" && isLoopbackHost(parsed.hostname);
 }
+
+export function isAllowedWebviewRequest(
+  url: string,
+  resourceType: string,
+): boolean {
+  if (resourceType === "mainFrame") {
+    return isAllowedWebviewNavigation(url);
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+
+  if (parsed.href === "about:blank") return true;
+  if (isBlockedWebviewHost(parsed.hostname)) return false;
+  if (parsed.protocol === "data:" || parsed.protocol === "blob:") return true;
+  if (parsed.protocol === "https:") return true;
+  return parsed.protocol === "http:" && isLoopbackHost(parsed.hostname);
+}

apps/code/src/main/window.ts

@@ -6,6 +6,7 @@ import { DARK_APP_BACKGROUND_COLOR } from "@posthog/shared/constants";
 import {
   app,
   BrowserWindow,
+  session as electronSession,
   Menu,
   type MenuItemConstructorOptions,
   screen,
@@ -17,6 +18,7 @@ import { buildApplicationMenu } from "./menu";
 import type { ElectronMainWindow } from "./platform-adapters/electron-main-window";
 import { posthogNodeAnalytics } from "./platform-adapters/posthog-analytics";
 import { POSTHOG_SESSION_ID_ARG } from "./posthog-session-arg";
+import { browserViewService } from "./services/browser-view/service";
 import {
   encodeDevFlagsForArg,
   readDevFlagsSync,
@@ -39,7 +41,7 @@ import {
 } from "./utils/webview-attach-policy";
 import {
   isAllowedWebviewNavigation,
-  safeProtocol,
+  isAllowedWebviewRequest,
 } from "./utils/webview-navigation-guard";
 import { isAllowedWebviewPermission } from "./utils/webview-permission-policy";
 import { setupWindowZoom } from "./zoom";
@@ -142,20 +144,34 @@ function hardenWebviewSession(session: Electron.Session): void {
   session.setPermissionCheckHandler((_wc, permission) =>
     isAllowedWebviewPermission(permission),
   );
+  session.webRequest.onBeforeRequest((details, callback) => {
+    const allowed = isAllowedWebviewRequest(details.url, details.resourceType);
+    if (!allowed) {
+      log.warn("Blocked disallowed webview request", {
+        resourceType: details.resourceType,
+        url: details.url,
+      });
+    }
+    callback({ cancel: !allowed });
+  });
 }
 
 function setupWebviewHandlers(window: BrowserWindow): void {
   window.webContents.on(
     "will-attach-webview",
     (event, webPreferences, params) => {
-      if (!isAllowedWebviewAttachment(params)) {
+      if (
+        !browserViewService.isEnabled() ||
+        !isAllowedWebviewAttachment(params)
+      ) {
         event.preventDefault();
         log.warn("Blocked disallowed webview attachment", {
           src: params.src,
           partition: params.partition,
         });
         return;
       }
+      hardenWebviewSession(electronSession.fromPartition(params.partition));
       hardenWebviewPreferences(webPreferences);
     },
   );
@@ -164,10 +180,10 @@ function setupWebviewHandlers(window: BrowserWindow): void {
     hardenWebviewSession(guest.session);
 
     guest.setWindowOpenHandler(({ url }) => {
-      if (/^https?:$/i.test(safeProtocol(url))) {
-        shell.openExternal(url);
+      if (isAllowedWebviewNavigation(url)) {
+        void shell.openExternal(url);
       } else {
-        log.warn("Blocked webview popup to non-http(s) target", { url });
+        log.warn("Blocked disallowed webview popup", { url });
       }
       return { action: "deny" };
     });
@@ -318,6 +334,7 @@ export function createWindow(): void {
     webPreferences: {
       nodeIntegration: false,
       contextIsolation: true,
+      webviewTag: true,
       preload: path.join(__dirname, "preload.js"),
       enableBlinkFeatures: "GetDisplayMedia",
       partition: "persist:main",

apps/code/src/renderer/contributions/browser-view.contribution.ts

@@ -0,0 +1,26 @@
+import type { Contribution } from "@posthog/di/contribution";
+import { BROWSER_TAB_FLAG } from "@posthog/shared/constants";
+import {
+  FEATURE_FLAGS,
+  type FeatureFlags,
+} from "@posthog/ui/features/feature-flags/identifiers";
+import { trpcClient } from "@renderer/trpc/client";
+import { inject, injectable } from "inversify";
+
+@injectable()
+export class BrowserViewContribution implements Contribution {
+  constructor(
+    @inject(FEATURE_FLAGS) private readonly featureFlags: FeatureFlags,
+  ) {}
+
+  start(): void {
+    const sync = (): void => {
+      const enabled =
+        import.meta.env.DEV || this.featureFlags.isEnabled(BROWSER_TAB_FLAG);
+      void trpcClient.browserView.setEnabled.mutate({ enabled });
+    };
+
+    sync();
+    this.featureFlags.onFlagsLoaded(sync);
+  }
+}