Commit Graph
9542 Commits
Author SHA1 Message Date
Muki Kiboigo 6002dfe587 use no_cors for importScript 2026-09-04 07:00:01 -07:00
Muki Kiboigo e195886d43 use same cors guard for fetch body as headers 2026-09-04 07:00:01 -07:00
Muki Kiboigo c3a71efca4 include modes on EchoDriver 2026-09-04 07:00:01 -07:00
Muki Kiboigo addba12426 add CORS metrics 2026-09-04 07:00:01 -07:00
Muki Kiboigo 15d27902ba use experimental features flag instead of obey cors 2026-09-04 07:00:01 -07:00
Muki Kiboigo 1fe8456cbd add modes to the tests 2026-09-04 07:00:01 -07:00
Muki Kiboigo 12ed38dfdd better no cors opaque behavior 2026-09-04 07:00:00 -07:00
Muki Kiboigo d1f4605459 non-default credentials and request mode 2026-09-04 07:00:00 -07:00
Muki Kiboigo b0fffe693a more comprehensive cors singleflight key 2026-09-04 06:59:40 -07:00
Muki Kiboigo 2b06583662 authorization header doesnt accept wildcard 2026-09-04 06:59:40 -07:00
Muki Kiboigo 8ee714418d proper safelist checking for CORS headers 2026-09-04 06:59:40 -07:00
Muki Kiboigo feebb889ad cors check before cache check 2026-09-04 06:59:40 -07:00
Muki Kiboigo 89df63e956 safelisted methods always pass in CORS 2026-09-04 06:59:39 -07:00
Muki Kiboigo 570a450163 ensure origin is added to requests 2026-09-04 06:59:39 -07:00
Muki Kiboigo f2f93d0bc5 fix ordering in Request.InitOpts 2026-09-04 06:59:39 -07:00
Muki Kiboigo c16a3b3585 fix warn log on preflight blocked 2026-09-04 06:59:39 -07:00
Muki Kiboigo e9449b2276 follow create a potential cors request rules in ScriptManager 2026-09-04 06:59:39 -07:00
Muki Kiboigo da00a90c02 set cors cross origin on transfer after no-cors check 2026-09-04 06:59:39 -07:00
Muki Kiboigo d3c0291bd1 add request mode for Fetch 2026-09-04 06:59:39 -07:00
Muki Kiboigo ddfa034310 add credentials_mode for proper CORS credentials handling 2026-09-04 06:59:39 -07:00
Muki Kiboigo f31b32ac4e don't store network in CorsGate 2026-09-04 06:59:38 -07:00
Muki Kiboigo cf37a94f16 get rid of blocked on CorsGate check result 2026-09-04 06:59:38 -07:00
Muki Kiboigo b976894315 properly hook up single flight for CorsGate 2026-09-04 06:59:38 -07:00
Muki Kiboigo 977874ce5f initial preflighting 2026-09-04 06:59:38 -07:00
Muki Kiboigo f428dc8e52 add origin header in CorsGate on cross origin 2026-09-04 06:59:38 -07:00
Muki Kiboigo 4e79f24814 basic validation without preflighting 2026-09-04 06:59:38 -07:00
Muki Kiboigo ec45dccacf add obey_cors option 2026-09-04 06:59:38 -07:00
Muki Kiboigo 212c806be5 add basic CorsGate scaffold 2026-09-04 06:59:37 -07:00
Muki Kiboigo b114382c44 add origin field to HttpClient Request 2026-09-04 06:59:37 -07:00
Pierre Tachoire 266eec2705 idb: fix use-after-free reading txn._db after releaseRef frees it 2026-09-04 15:03:46 +02:00
Karl Seguin f7fbd217ca chore: leverage bridge for error rejection
https://github.com/lightpanda-io/browser/pull/3095 made the bridge more promise-
aware. A WebAPI with a `!js.Promise` return type that returns an error will not
reject the promise.

That PR was limited to Crypto. This expands it where possible. Generally
speaking, the result is just more idiomatic Zig code. From:

```zig
validateName(name) catch |err| switch (err) {
 error.SyntaxError => return local.rejectPromise(.{ .dom_exception = .{ .err = error.SyntaxError } }),
}
```

to:

```zig
try validateName(name);
```

However, because TypeErrors must often reject with a specific message, we use
a pseudo-global in Env. So, you'd do:

```zig
.invalid => return local.typeError("invalid algorithm"),
```

which return error.TypeError AND stores "invalid algorithm" on the `Env`. When
`Caller` gets `error.TypeError` it checks the Env for a message. Who says Zig
errors can't carry payloads?!

;# Please enter the commit message for your changes. Lines starting
2026-09-04 18:25:20 +08:00
Karl Seguin 396cffa1c1 Merge pull request #3391 from lightpanda-io/resource-timing
webapi: resource-timing
2026-09-04 18:03:17 +08:00
Karl Seguin 96ec588846 webapi: minor fix to select
A non-multi select with a display size of 1, must always have 1 item selected
(unless it's set via JS (selectedIndex = -1). Also, some small fixes to options
(e.g. there is no .name getter). option.html and select.html now pass in Firefox

Also, XMLHTTPRequest `httpHeaderCallback` was dead code.
2026-09-04 17:56:10 +08:00
Karl Seguin 1034ed8732 Performance capture schedule and notify when full 2026-09-04 17:01:48 +08:00
Karl Seguin 17983fb8f8 indexeddb: Add setName to IDBObjectStore and IDBIndex 2026-09-04 11:51:15 +08:00
Karl Seguin 8937a7b4e0 cdp: Give isolated worlds a context per frame
Previously, we had a single root-bound context which we'd re-announce for every
frame. Now, Page.createIsolatedWorld and addScriptToEvaluateOnNewDocument seed
the context per frame(s).
2026-09-04 11:01:20 +08:00
Karl Seguin 1d66b2fbc8 Merge pull request #3398 from lightpanda-io/link-ownership
chore: Move ownership of the Inbox from HttpClient to WebSocker Driver
2026-09-04 03:04:57 +08:00
Karl Seguin 8898d08045 null driver 2026-09-04 02:54:14 +08:00
Karl Seguin b0c8b034c0 Merge pull request #3394 from lightpanda-io/idb-request-conformance
indexeddb: WPT conformance
2026-09-04 02:32:03 +08:00
Karl Seguin cbff8e8ce3 Merge pull request #3389 from lightpanda-io/better-redirect
http: handle redirects better
2026-09-03 19:37:44 +08:00
Karl Seguin 87320a506d chore: Move ownership of the Inbox from HttpClient to WebSocker Driver
Currently, the HttpClient owns the inbox and its borrowed by the Link. This is
a bit backwards, but it also means that we can't eagerly create a Link: the
Link needs the inbox, so it needs the HttpClient, which is created by the
Browser (which creates an Isolate).

Remember, the Inbox is one of the few things shared between the main thread
and the worker, so either end can own it and the other can borrow it.

This switches the ownership so that the HttpClient now borrows the Inbox from
the Server's side of the Link (the WebSocket).

The main goal of this change is to prepare for more advanced HTTP WebDriver
flows. The more we can create _without_ a Browser, the fewer edge cases we have
to deal with (Browser because it's expensive and has to be created on the
Worker thread due to how V8::Isolate works).
2026-09-03 16:51:12 +08:00
Karl Seguin 314d44d4fa Merge pull request #3396 from lightpanda-io/curl-8.22
build: update curl to 8.22.0
2026-09-03 16:44:04 +08:00
Karl Seguin 7263acebcd CDP: create an context per isolated world per frame
Previously, we created a single context per isolated world for the main frame.
We now create an isolate world per frame.

Fixes: https://github.com/lightpanda-io/browser/issues/3347
2026-09-03 16:37:55 +08:00
Adrià Arrufat 94a47f3a4b build: update curl to 8.22.0
curl 8.22 moved the resolver sources into lib/vdns/, renamed the QUIC
backends to cf-ngtcp2*/cf-quiche, folded noproxy.c into proxy.c and
added a handful of new files. Regenerate the source list from the
tarball and drop the four config defines the 8.22 template no longer
declares (Zig errors on unused config header values).
2026-09-03 10:27:02 +02:00
Karl Seguin cb26e05533 Merge pull request #3383 from lightpanda-io/intersection-runaway-guard
stability: disconnect runaway intersection observers
2026-09-03 08:50:09 +08:00
Karl Seguin eb2eceb3d6 indexeddb: WPT conformance
Some low-hanging fruit from the IndexedDB tests. Added  IDBDatabase.close()
and IDBFactory.databases(). Map count to an f64 which can handle NaNs and such.
Plus some reordering so validation happens in the correct order.
2026-09-03 08:48:03 +08:00
Karl Seguin d2ea2396f5 Merge pull request #3392 from staylor/fix/heap-exhaustion-teardown-3319
Avoid rearming heap termination during teardown
2026-09-03 08:27:19 +08:00
Karl Seguin bb9f9b36e9 split IO reset and disconnect
Allows reset to be called without disconnect, which allows the runnaway check
to more efficiently do both.
2026-09-03 07:47:16 +08:00
Karl Seguin 2a977351d7 centralize teardown protection (covers every case this way) 2026-09-03 07:28:55 +08:00
Karl Seguin 658d350404 Merge pull request #3329 from lightpanda-io/better-server
Better server
2026-09-03 07:27:33 +08:00