fix: validate websocket request #7317

hi-ogawa · 2025-01-21T02:40:03Z

Description

backports
- fix: backport #7317 to v2 #7318
- fix: backport #7317 to v1 #7319

summary

Adds ?token=xxx requirement for websocket upgrade request on __vitest__api__ and __vitest_browser_api__. Token is randomly generated on the server and it's injected in ui, tester, and orchestrator html, which are not accessible from cross origin.

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
Ideally, include a test that fails without this PR but passes with it.
Please, don't make changes to pnpm-lock.yaml unless you introduce a new test example.

Tests

Run the tests with pnpm test:ci.

Documentation

If you introduce new functionality, document it. You can run documentation with pnpm run docs command.

Changesets

Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with feat:, fix:, perf:, docs:, or chore:.

fix: shouldHandle cannot be async wip: copy isHostAllowed chore: move code chore: comment wip: allow only same origin chore: cleanup wip: isApiRequestAllowed chore: cleanup wip: switch to token check chore: unused fix: inject VITEST_API_TOKEN in orchestrator ui docs: add api.allowedHosts fix: require token for __vitest_browser_api__ request chore: cleanup refactor: combine to isWebsocketRequestAllowed

netlify · 2025-01-21T02:42:18Z

✅ Deploy Preview for vitest-dev ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`9e76ab8`
🔍 Latest deploy log	https://app.netlify.com/sites/vitest-dev/deploys/679f29277bb1e30008d255f5
😎 Deploy Preview	https://deploy-preview-7317--vitest-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

AriPerkkio

The token protection looks good to me.

The allowedHosts part is something I don't really understand. The WS endpoints will still be responding to any client that has the token. We are not passing allowedHosts anywhere else, so users still won't be able to open Vitest UI or browser from these. I don't understand why allowedHosts is needed here.

docs/config/index.md

Co-authored-by: Ari Perkkiö <[email protected]>

This reverts commit 7f91828.

Co-authored-by: Ari Perkkiö <[email protected]>

@DevJoaoLopes

##### [v3.0.5](https://github.com/vitest-dev/vitest/releases/tag/v3.0.5) ##### 🚀 Features - **ui**: Insert message "no tests found" in ui - by [@DevJoaoLopes](https://github.com/DevJoaoLopes) in vitest-dev/vitest#7366 [<samp>(92da4)</samp>](vitest-dev/vitest@92da490bd) ##### 🐞 Bug Fixes - Validate websocket request - by [@hi-ogawa](https://github.com/hi-ogawa) and [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7317 [<samp>(191ef)</samp>](vitest-dev/vitest@191ef9e34) - Don't toggle cli cursor on non-TTY - by [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7336 [<samp>(3c805)</samp>](vitest-dev/vitest@3c8050e69) - **vite-node**: Differentiate file url with hash and query - by [@hi-ogawa](https://github.com/hi-ogawa) in vitest-dev/vitest#7365 [<samp>(926ca)</samp>](vitest-dev/vitest@926ca9546) ##### [View changes on GitHub](vitest-dev/vitest@v3.0.4...v3.0.5)

@DevJoaoLopes

##### [v3.0.5](https://github.com/vitest-dev/vitest/releases/tag/v3.0.5) This release includes security patches for: - [Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964](GHSA-9crc-q9x8-hgqq) ##### 🚀 Features - **ui**: Insert message "no tests found" in ui - by [@DevJoaoLopes](https://github.com/DevJoaoLopes) in vitest-dev/vitest#7366 [<samp>(92da4)</samp>](vitest-dev/vitest@92da490bd) ##### 🐞 Bug Fixes - Validate websocket request - by [@hi-ogawa](https://github.com/hi-ogawa) and [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7317 [<samp>(191ef)</samp>](vitest-dev/vitest@191ef9e34) - Don't toggle cli cursor on non-TTY - by [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7336 [<samp>(3c805)</samp>](vitest-dev/vitest@3c8050e69) - **vite-node**: Differentiate file url with hash and query - by [@hi-ogawa](https://github.com/hi-ogawa) in vitest-dev/vitest#7365 [<samp>(926ca)</samp>](vitest-dev/vitest@926ca9546) ##### [View changes on GitHub](vitest-dev/vitest@v3.0.4...v3.0.5)

@DevJoaoLopes

##### [v3.0.5](https://github.com/vitest-dev/vitest/releases/tag/v3.0.5) This release includes security patches for: - [Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964](GHSA-9crc-q9x8-hgqq) ##### 🚀 Features - **ui**: Insert message "no tests found" in ui - by [@DevJoaoLopes](https://github.com/DevJoaoLopes) in vitest-dev/vitest#7366 [<samp>(92da4)</samp>](vitest-dev/vitest@92da490bd) ##### 🐞 Bug Fixes - Validate websocket request - by [@hi-ogawa](https://github.com/hi-ogawa) and [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7317 [<samp>(191ef)</samp>](vitest-dev/vitest@191ef9e34) - Don't toggle cli cursor on non-TTY - by [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7336 [<samp>(3c805)</samp>](vitest-dev/vitest@3c8050e69) - **vite-node**: Differentiate file url with hash and query - by [@hi-ogawa](https://github.com/hi-ogawa) in vitest-dev/vitest#7365 [<samp>(926ca)</samp>](vitest-dev/vitest@926ca9546) ##### [View changes on GitHub](vitest-dev/vitest@v3.0.4...v3.0.5)

@DevJoaoLopes

##### [v3.0.5](https://github.com/vitest-dev/vitest/releases/tag/v3.0.5) This release includes security patches for: - [Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964](GHSA-9crc-q9x8-hgqq) ##### 🚀 Features - **ui**: Insert message "no tests found" in ui - by [@DevJoaoLopes](https://github.com/DevJoaoLopes) in vitest-dev/vitest#7366 [<samp>(92da4)</samp>](vitest-dev/vitest@92da490bd) ##### 🐞 Bug Fixes - Validate websocket request - by [@hi-ogawa](https://github.com/hi-ogawa) and [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7317 [<samp>(191ef)</samp>](vitest-dev/vitest@191ef9e34) - Don't toggle cli cursor on non-TTY - by [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7336 [<samp>(3c805)</samp>](vitest-dev/vitest@3c8050e69) - **vite-node**: Differentiate file url with hash and query - by [@hi-ogawa](https://github.com/hi-ogawa) in vitest-dev/vitest#7365 [<samp>(926ca)</samp>](vitest-dev/vitest@926ca9546) ##### [View changes on GitHub](vitest-dev/vitest@v3.0.4...v3.0.5)

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/main/packages/coverage-v8#readme) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8)) | devDependencies | patch | [`3.0.4` -> `3.0.5`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/3.0.4/3.0.5) | | [vitest](https://github.com/vitest-dev/vitest) ([source](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | devDependencies | patch | [`3.0.4` -> `3.0.5`](https://renovatebot.com/diffs/npm/vitest/3.0.4/3.0.5) | --- ### Release Notes <details> <summary>vitest-dev/vitest (@vitest/coverage-v8)</summary> ### [`v3.0.5`](https://github.com/vitest-dev/vitest/releases/tag/v3.0.5) [Compare Source](vitest-dev/vitest@v3.0.4...v3.0.5) This release includes security patches for: - [Remote Code Execution when accessing a malicious website while Vitest API server is listening | CVE-2025-24964](GHSA-9crc-q9x8-hgqq) ##### 🚀 Features - **ui**: Insert message "no tests found" in ui - by [@DevJoaoLopes](https://github.com/DevJoaoLopes) in vitest-dev/vitest#7366 [<samp>(92da4)</samp>](vitest-dev/vitest@92da490bd) ##### 🐞 Bug Fixes - Validate websocket request - by [@hi-ogawa](https://github.com/hi-ogawa) and [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7317 [<samp>(191ef)</samp>](vitest-dev/vitest@191ef9e34) - Don't toggle cli cursor on non-TTY - by [@AriPerkkio](https://github.com/AriPerkkio) in vitest-dev/vitest#7336 [<samp>(3c805)</samp>](vitest-dev/vitest@3c8050e69) - **vite-node**: Differentiate file url with hash and query - by [@hi-ogawa](https://github.com/hi-ogawa) in vitest-dev/vitest#7365 [<samp>(926ca)</samp>](vitest-dev/vitest@926ca9546) ##### [View changes on GitHub](vitest-dev/vitest@v3.0.4...v3.0.5) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.justinelmore.dev/jelmore1674/build-changelog/pulls/85 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

hi-ogawa added 2 commits January 20, 2025 15:12

docs: fix

7c812cb

hi-ogawa added 4 commits January 21, 2025 11:44

chore: comment

9f5988d

Merge branch 'main' into fix-vitest-ui-rpc-cors

f6d07bb

test: fix token

66f34b8

fix: timing safe equal + handle invalid server.origin

af2e96c

This was referenced Jan 21, 2025

fix: backport #7317 to v2 #7318

Merged

fix: backport #7317 to v1 #7319

Merged

hi-ogawa marked this pull request as ready for review January 21, 2025 03:40

sapphi-red approved these changes Jan 21, 2025

View reviewed changes

fix: add cache-control no cache

44d2b5c

AriPerkkio previously approved these changes Jan 21, 2025

View reviewed changes

docs/config/index.md Outdated Show resolved Hide resolved

docs: Update docs/config/index.md

ed50f3d

Co-authored-by: Ari Perkkiö <[email protected]>

hi-ogawa dismissed AriPerkkio’s stale review via ed50f3d January 21, 2025 08:38

hi-ogawa added 7 commits January 22, 2025 11:46

Merge branch 'main' into fix-vitest-ui-rpc-cors

620d6dc

wip: remove host check

835e055

refactor: rename

9fb5f80

test: add ui test

983b462

chore: name middleware

3604f2e

fix: add vitestUiHtmlMiddleware after viteHostCheckMiddleware

7f91828

Revert "fix: add vitestUiHtmlMiddleware after viteHostCheckMiddleware"

4e5a50c

This reverts commit 7f91828.

hi-ogawa mentioned this pull request Jan 22, 2025

test: #7317 with Vite 5.4.14 #7332

Closed

6 tasks

AriPerkkio approved these changes Jan 22, 2025

View reviewed changes

sapphi-red approved these changes Jan 22, 2025

View reviewed changes

Merge branch 'main' into fix-vitest-ui-rpc-cors

209bf3d

hi-ogawa requested a review from sheremet-va January 29, 2025 06:37

Merge branch 'main' into fix-vitest-ui-rpc-cors

9e76ab8

AriPerkkio pushed a commit that referenced this pull request Feb 2, 2025

fix: backport #7317 to v2 (#7318)

e0fe1d8

AriPerkkio added a commit that referenced this pull request Feb 2, 2025

fix: backport #7317 to v1 (#7319)

7ce9fbb

Co-authored-by: Ari Perkkiö <[email protected]>

AriPerkkio merged commit 191ef9e into vitest-dev:main Feb 2, 2025
13 checks passed

sourcery-ai bot mentioned this pull request Feb 3, 2025

chore(deps): update dependency vitest to v1.6.1 - autoclosed zce/mwa#186

Closed

1 task

renovate bot mentioned this pull request Feb 3, 2025

Update minor and patch dependencies - autoclosed superneko160/htmlparser-frontend#38

Closed

1 task

This was referenced Feb 4, 2025

chore(deps-dev): bump vitest from 1.6.0 to 1.6.1 lukasjhan/Verifiable-Digital-Credentials#2

Merged

chore(deps-dev): bump vitest from 1.6.0 to 1.6.1 lukasjhan/monorepo-template#1

Open

renovate bot mentioned this pull request Feb 9, 2025

chore(deps): update devdependencies (non-major) p-toy-factory/eslint-config-pcp#6

Open

1 task

renovate bot mentioned this pull request Feb 14, 2025

chore(deps): update all non-major dependencies react-bootstrap/react-bootstrap#6845

Merged

1 task

sourcery-ai bot mentioned this pull request Mar 10, 2025

build(deps): bump the npm_and_yarn group with 5 updates Dargon789/js#53

Closed

This was referenced Mar 13, 2025

chore(deps): update dependency @vitest/coverage-istanbul to v3 willswire/estado#14

Closed

Update dependency @vitest/coverage-v8 to v4 tjenkinson/sql-cursor-pagination#140

Open

renovate-bot mentioned this pull request Mar 13, 2025

fix(deps)!: Update dependency @vitest/coverage-v8 to v4 GoogleCloudPlatform/terraform-ml-image-annotation-gcf#200

Open

1 task

sourcery-ai bot mentioned this pull request Mar 24, 2025

Bump vitest from 1.6.0 to 1.6.1 sarvex/athleticxr.ai#285

Merged

renovate bot mentioned this pull request May 5, 2025

fix(deps): update all non-major dependencies vrn-deco/cli#96

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: validate websocket request #7317

fix: validate websocket request #7317

Uh oh!

hi-ogawa commented Jan 21, 2025 •

edited

Loading

Uh oh!

netlify bot commented Jan 21, 2025 •

edited

Loading

Uh oh!

AriPerkkio left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

fix: validate websocket request #7317

fix: validate websocket request #7317

Uh oh!

Conversation

hi-ogawa commented Jan 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

Tests

Documentation

Changesets

Uh oh!

netlify bot commented Jan 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for vitest-dev ready!

Uh oh!

AriPerkkio left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hi-ogawa commented Jan 21, 2025 •

edited

Loading

netlify bot commented Jan 21, 2025 •

edited

Loading

AriPerkkio left a comment •

edited

Loading