Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: set up sandbox for script execution [INS-3378] #6991

Closed
wants to merge 35 commits into from
Closed

feat: set up sandbox for script execution [INS-3378] #6991

wants to merge 35 commits into from

Conversation

ihexxa
Copy link
Contributor

@ihexxa ihexxa commented Jan 17, 2024

Changes:
This change basically sets up a sandbox which is an isolated environment for executing scripts, it contains following changes:

  • modified building config for building index.js for the sandbox
    • packages/insomnia/esbuild.main.ts
    • packages/insomnia/vite.config.ts
  • introduced sandbox renderer
    • packages/insomnia/src/preload.ts
    • packages/insomnia/src/renderers/hidden-browser-window/index.ts
    • packages/insomnia/src/renderers/hidden-browser-window/inso-object.ts
    • packages/insomnia/src/renderers/hidden-browser-window/index.html
  • sandbox creating (in the main.js)
    • packages/insomnia/src/main/window-utils.ts
    • packages/insomnia/src/main/ipc/hidden-browser-window.ts
  • sandbox controlling (starting, closing)
    • packages/insomnia/src/ui/window-message-handlers.ts
    • packages/insomnia/src/global.d.ts
    • packages/insomnia/src/ui/index.tsx
  • misc (tests, debugging)
    • packages/insomnia-smoke-test/tests/smoke/pre-request-script.test.ts.
    • packages/insomnia-smoke-test/tests/smoke/oauth-gitlab.test.ts
    • packages/insomnia-smoke-test/tests/smoke/git-sync.test.ts

@ihexxa ihexxa changed the title feat: set up sandbox for script execution feat: set up sandbox for script execution [INS-3378] Jan 17, 2024
@jackkav
Copy link
Contributor

jackkav commented Jan 17, 2024

We should document the intended lifetime of the hidden browser window, eg. app start->app close or per function call, or whatever.

@ihexxa
Copy link
Contributor Author

ihexxa commented Jan 18, 2024

@jackkav It sounds reasonable, I've updated its design and workflow in the doc, please have a look.

@ihexxa
Copy link
Contributor Author

ihexxa commented Jan 25, 2024

Will create a naive version for this.

@ihexxa ihexxa closed this Jan 25, 2024
@jackkav jackkav reopened this Feb 5, 2024
github-advanced-security[bot]
github-advanced-security bot found potential problems Feb 5, 2024
View reviewed changes
packages/insomnia/src/main/window-utils.ts
hiddenBrowserWindow.loadURL(hiddenBrowserWindowUrl);

console.log(
`[main][init hidden win step 1/6]: starting hidden browser window(id=${hiddenBrowserWindow.id}): `,

Check notice

Code scanning / Semgrep OSS

Semgrep Finding: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring Note

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
@ihexxa @jackkav
feat: enable islated utility process [INS-3378]
c4db28a
@ihexxa @jackkav
fix: disable flaky test and extend timeout
2c57eda
@ihexxa @jackkav
test: add some logs
6e010d0
@ihexxa @jackkav
chore: add some logs
f9badb3
@ihexxa @jackkav
feat: add cookie related objects
8261c04
@ihexxa @jackkav
fix: add script path env for utility process
08dadd7
@ihexxa @jackkav
fix: lint issue
47a3fbe
@ihexxa @jackkav
fix: lint error
1538d04
@ihexxa @jackkav
fix: make vite supporting multiple entries
5ee7ffc
@ihexxa @jackkav
fix: remove utility process building task and use vite instead
dea3165
@ihexxa @jackkav
fix: always outputs utility process bundle to src folder instead of b…
438ecaa 
…uild
@ihexxa @jackkav
chore: some small fixes
5438d38
@ihexxa @jackkav
fix: make utility process can be triggerred
475ab01
@ihexxa @jackkav
fix: add missing file
b8fb33b
@ihexxa @jackkav
fix: enable smoke tests
9ed1595
@ihexxa @jackkav
fix: revert commented tests
04178a7
@ihexxa @jackkav
fix: utility process is a improper name for the browser window
bb2b293
@ihexxa @jackkav
feat: support global object aliases and timeout
daad944
@ihexxa @jackkav
chore: keep develop version for other tests
42f46ed
@ihexxa @jackkav
fix: improve tests a bit and hide the browser window
e907790
@ihexxa @jackkav
test: add tests for unhappy paths
7a5076b
@ihexxa @jackkav
fix: get the main renderer instead of the first one in testing as the…
dbe2697 
…re are multiple windows now
@ihexxa @jackkav
chore: try keep test timeout untouched
485fe7c
This was referenced Feb 5, 2024
Merged
Merged
@jackkav
Copy link
Contributor

jackkav commented Feb 13, 2024

closing as a spike, merged in #7063 #7065

@jackkav jackkav closed this Feb 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ihexxa @jackkav