Also updates matchCookies/onCookieChanged from the hard-coded "same-site + navigation" to areSameSite(exec.siteForCookies(), host) and is_navigation=false.
The site for cookies were computed from the immediate parent `Frame`, which would allow sending a cookie that's `SameSite=Strict` from 2 levels deep under. Directly from RFC6265bis, this PR essentially implements (except for step 4, we skip host-less ancestors):
Given a Document (document), the following algorithm returns its
"site for cookies":
1. Let top-document be the active document in document's navigable's
top-level traversable.
2. Let top-origin be the origin of top-document's URI if top-
document's sandboxed origin browsing context flag is set, and
top-document's origin otherwise.
3. Let documents be a list consisting of the active documents of
document's inclusive ancestor navigables.
4. For each item in documents:
1. Let origin be the origin of item's URI if item's sandboxed
origin browsing context flag is set, and item's origin
otherwise.
2. If origin is not same-site with top-origin, return an origin
set to an opaque origin.
5. Return top-origin.
Checked the three test files in Firefox and Chrome:
- stepUp/stepDown use the HTML step base (min, else the value attribute)
and snap off-ladder values to the next rung, counting the snap as the
first step as browsers do; clamping lands on the last rung inside
min/max.
- time strings keep a three-digit fraction.
- an empty pattern attribute is a pattern (matches only "").
- tooLong/tooShort only for values last changed by a user edit, so the
text-entry path marks the value and script/attribute values never trip
them; same for textarea.
- showPicker dropped: browsers throw NotAllowedError without a gesture,
a no-op would be a lie.
- month/week assertions skipped where the browser has no such input.
https://github.com/lightpanda-io/browser/pull/3333 improved markdown rendering
for flexbox items. But screenshot generation didn't benefit from that change.
This commit introduces a RenderTree that extracts and shares functionality
between markdown and screenshots.
react-hook-form and date pickers read valueAsNumber/valueAsDate and got
undefined. The date types convert through the existing validators; the
same conversion now also drives min/max range validation for
date/time/month/week/datetime-local, which only number/range had.
click(), willValidate and the WebDriver click read only the control's own
attribute. They now use Element.isDisabled, which already walks fieldset
ancestors with the first-legend exception for :disabled. The disabled IDL
attribute keeps reflecting the attribute alone, per spec.
Three one-accessor gaps: getSetCookie returns Set-Cookie values
unjoined, getName maps a constructor back to its tag, part is a
DOMTokenList over the part attribute like relList.
Composes transform attributes up to the nearest <svg> (getCTM) or through
every enclosing <svg>, offset by the outermost one's client rect
(getScreenCTM). Null when detached. d3-zoom, d3-brush and svg-pan-zoom
call these at init and threw.
We currently have 1 note: it prints the server's listening address:port. Note
is a special un-ignorable level. This keeps the "note" level, but logs it under
a new scope: "note", so that it _can_ be silenced with a `--log-filter note`.
Add a new note, on startup, that displays tips. Currently, only displays when
--obey-robots is not enabled:
NOTE note : config tips . . . . . . . . . . . . . . . . . . . [+0ms]
robots = use '--obey-robots' to use a sites robots.txt
meta = use '--log-filter note' to silence this message
A client that disconnects might get treated as a harsher terminate failure (e.g.
watchdog). This doesn't have a huge impact, but it makes the CI flaky and it
produces more logs than is necessary.
In a terminate state, the driver will now check its inbox to see if this is a
client disconnection.
Three small compliance (WPT) changes with respect to error handling.
1. When a unique index creation fails due to a constraint violation, the
delivery of that failure is asynchronous.
2. When txn.abort() is called, any undelivered request should be aborted
asynchronously (see the common theme here?)
3. An failure in an onupgradeneeded handler correctly fires an AbortError AND
rollsback the version
The Fetch.enable call takes `patterns` which can limit the path and type of
request that should be intercepted. This adds the wildcard support.
As before, RI is currently only enabled for Requests, not response. A warning
is printed if RI for responses is requested.
Fixes: https://github.com/lightpanda-io/browser/issues/3349
In order to support Selenium the way people are used to, it looks like we need
to support both WebDriver classic (WebDriver) and WebDriver BiDi (BiDi). Typical
scripts look like a mix of the two, e.g. using WebDriver to control the browser
and using BiDi to receive notifications. This commit:
1 - adds a --protocol (cdp|webdriver) CLI argument to the `serve` command to
enable one or the other protocol (defaulting to CDP)
2 - adds basic WebDriver endpoint to let a Selenium client connect. This
implementation is hackish and sits on top of our simple Handshake handler.
The handshake handler is well past its original design. Serving /json/version
and /metrics from it was one thing. But Driving the entire browser session? This
will get a follow up PR.
1. Abstract "Driver". Non-CDP things that referenced *CDP now reference a Driver
2. Move the NodeRegistry out of CDP. This created an artificial link between
agent / mcp and CDP
3. Add BiDi driver with enough to navigate to a page
This enforces a limit on the captures responses based on the Network.enable's
maxTotalBufferSize and maxResourceBufferSize fields. It also limits the size of
the post body we echo (e.g. in requestWillBeSent) based on the `maxPostDataSize`
field.
When writing a value, we used to store js.Value.Global in the transaction's
queue and then serialize it at write-time. We're supposed to capture the value
at call-time. The result is that, if JS code alters the value, we can end up
storing the wrong value. We now serialize the value at call time, so that any
subsequent changes to the value are not captured by the operation.
Also improve how we map large integers. Because JavaScript can't represent the
full u64/i64, we need to treat large numbers as floats and truncate. This is
done both from JS -> Zig and from Zig -> JS.
https://github.com/lightpanda-io/browser/issues/3348
When set to 1.1, libcurl is configured to only offer HTTP 1.1. By default, or
when set to "auto", it's up to libcurl to decide how to connect. This maps to
libcurl's CURL_HTTP_VERSION_1_1 and CURL_HTTP_VERSION_NONE.
LP.configureCDP now takes an `httpVersion` field which can be "1.1" or "auto"
to control that specific browser session. Ideally this is called prior to any
navigation.
Karl Seguin