Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: validate browser extensions by scheme instead of hostname

Browse Source 
Browser extension IDs (e.g., chrome-extension://abcdefg) change every
time an unpacked extension is reloaded during development, breaking
origin validation. This moves extension schemes from hostname-based
validation to scheme-only validation, consistent with how mobile/native
platforms are handled. Extension schemes are now automatically included
when a web platform is registered.
This commit is contained in:
Chirag Aggarwal
2026-03-24 22:46:21 +05:30
parent 7fcc640652
commit 3caedbafe3
3 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Appwrite/Network/Platform.php
+4
View File
@@ -124,6 +124,10 @@ class Platform
case self::TYPE_FLUTTER_WEB:
$schemes[] = self::SCHEME_HTTP;
$schemes[] = self::SCHEME_HTTPS;
$schemes[] = self::SCHEME_CHROME_EXTENSION;
$schemes[] = self::SCHEME_FIREFOX_EXTENSION;
$schemes[] = self::SCHEME_SAFARI_EXTENSION;
$schemes[] = self::SCHEME_EDGE_EXTENSION;
break;
case self::TYPE_FLUTTER_IOS:
case self::TYPE_APPLE_IOS:
src/Appwrite/Network/Validator/Origin.php
-4
View File
@@ -65,10 +65,6 @@ class Origin extends Validator
$webPlatforms = [
Platform::SCHEME_HTTP,
Platform::SCHEME_HTTPS,
Platform::SCHEME_CHROME_EXTENSION,
Platform::SCHEME_FIREFOX_EXTENSION,
Platform::SCHEME_SAFARI_EXTENSION,
Platform::SCHEME_EDGE_EXTENSION,
Platform::SCHEME_TAURI,
];
if (in_array($this->scheme, $webPlatforms, true)) {
tests/unit/Network/Validators/OriginTest.php
+12 -7
View File
@@ -61,17 +61,22 @@ class OriginTest extends TestCase
$this->assertEquals(false, $validator->isValid('appwrite-windows://com.company.appname'));
$this->assertEquals('Invalid Origin. Register your new client (com.company.appname) as a new Windows platform on your project console dashboard', $validator->getDescription());
// Browser extensions are validated by scheme only, not hostname
$this->assertEquals(false, $validator->isValid('chrome-extension://com.company.appname'));
$this->assertEquals('Invalid Origin. Register your new client (com.company.appname) as a new Web (Chrome Extension) platform on your project console dashboard', $validator->getDescription());
$this->assertEquals(false, $validator->isValid('moz-extension://com.company.appname'));
$this->assertEquals('Invalid Origin. Register your new client (com.company.appname) as a new Web (Firefox Extension) platform on your project console dashboard', $validator->getDescription());
$this->assertEquals(false, $validator->isValid('safari-web-extension://com.company.appname'));
$this->assertEquals('Invalid Origin. Register your new client (com.company.appname) as a new Web (Safari Extension) platform on your project console dashboard', $validator->getDescription());
$this->assertEquals(false, $validator->isValid('ms-browser-extension://com.company.appname'));
$this->assertEquals('Invalid Origin. Register your new client (com.company.appname) as a new Web (Edge Extension) platform on your project console dashboard', $validator->getDescription());
// When extension schemes are in allowedSchemes, any extension ID is accepted
$validatorWithExtensions = new Origin(
allowedHostnames: ['appwrite.io'],
allowedSchemes: ['chrome-extension', 'moz-extension', 'safari-web-extension', 'ms-browser-extension']
);
$this->assertEquals(true, $validatorWithExtensions->isValid('chrome-extension://abcdefghijklmnop'));
$this->assertEquals(true, $validatorWithExtensions->isValid('chrome-extension://different-extension-id'));
$this->assertEquals(true, $validatorWithExtensions->isValid('moz-extension://some-uuid'));
$this->assertEquals(true, $validatorWithExtensions->isValid('safari-web-extension://some-id'));
$this->assertEquals(true, $validatorWithExtensions->isValid('ms-browser-extension://some-id'));
$this->assertEquals(true, $validator->isValid('tauri://localhost'));
$this->assertEquals(false, $validator->isValid('tauri://example.com'));