8671 Commits
Author SHA1 Message Date
Pierre Tachoire 5b0835f5a1 Merge pull request #3203 from lightpanda-io/enforce-ua-restriction-rework
http: improve header overwrite/enforcement
0.3.7
2026-08-15 07:55:34 +02:00
Pierre Tachoire ad072b2074 Merge pull request #3200 from lightpanda-io/enforce-ua-restriction
Enforce User-Agent and Sec-Ch-Ua HTTP headers restriction
2026-08-15 07:55:27 +02:00
Karl Seguin 737f69ee44 http: improve header overwrite/enforcement
Builds ontop of https://github.com/lightpanda-io/browser/pull/3200 to centralize
header enforcement and standardize merge vs overwrite header logic.

The API is still a `setHeader` and `appendHeader`, with a source, but set/append
both are thin wrappers around private `putHeader`. putHeader blocks overwriting
restricted headers (user-agent). The `source` acts as a priority (ordered enum)
which further restricts the header AND depending on whether set or append were
called, controls if the value is overwritten or appended to.

3200 had an always-append which can cause problems, e.g. a script setting
Accept-Language: fr would have results in the value being appended to the
default, e.g.: 'en-US,en;q=0.9, fr'.
2026-08-15 12:09:08 +08:00
Karl Seguin be7b87f3b5 Merge pull request #3195 from lightpanda-io/ce-reaction-shadowdom-pierce
webapi: Custom Element reactions need pierce the shadowdom
2026-08-15 07:36:39 +08:00
Karl Seguin 1407033b02 Merge pull request #3198 from lightpanda-io/implicit-iterator
webapi: Give iterator to types with an indexed property
2026-08-15 07:36:29 +08:00
Karl Seguin 36293edc07 Merge pull request #3196 from lightpanda-io/cache-maintenance
chore: Move cache maintenance to startup and browser.deinit
2026-08-15 07:34:50 +08:00
Karl Seguin e3d2ff795f Merge pull request #3191 from lightpanda-io/url-is-same-origin
`URL.isSameOrigin`
2026-08-15 07:23:43 +08:00
Pierre Tachoire ca4726c1cd add --user-agent unit test 2026-08-14 19:04:16 +02:00
Pierre Tachoire 859543ed3e add missing user-agent validator for CLI 2026-08-14 18:35:55 +02:00
Muki Kiboigo e22812ffea fix isSameOrigin compairson with ports 2026-08-14 08:05:08 -07:00
Muki Kiboigo bcea0afa24 add URL isSameOrigin to WorkerGlobalScope 2026-08-14 07:59:14 -07:00
Muki Kiboigo fc8f89e157 use URL.isSameOrigin in Frame.isSameOrigin 2026-08-14 07:46:33 -07:00
Pierre Tachoire 7a2e5370dd webapi: check user-agent override via webapi 2026-08-14 16:37:08 +02:00
Pierre Tachoire dd83300095 htttp: add Transfer.appendHeader
and make transfer.addHeader private.
2026-08-14 16:33:49 +02:00
Pierre Tachoire 6e72441001 make Sec-Ch-Ua not modifiable via cdp 2026-08-14 16:05:19 +02:00
Pierre Tachoire a61ad53690 Merge pull request #3173 from lightpanda-io/nikneym/cdp-ws-origin
`Origin` and (additional) `Host` header validation for CDP conns
2026-08-14 12:57:08 +02:00
Pierre Tachoire 80e45ab016 apply user-agent validation rules on request intercepted 2026-08-14 12:26:33 +02:00
Halil Durak b10f901fdc Connection: implementation for origin and host allowing
`Connection`: update tests

`Server.zig`: add a test for origin check at handshake + update tests

`help.zon`: entry for `--remote-allow-origins`

`Connection`: only look for existence of `Origin` header key alone

Also reworks `Host` header check to IP alone.

update tests

remove `--remote-allow-origins` flag
`Connection`: reject on `Origin`

`Connection`: prefer `parseLiteral` + return early from `Origin` check

update tests
2026-08-14 12:11:11 +03:00
Pierre Tachoire 1d8517cdd2 Merge pull request #3197 from lightpanda-io/release-arm-bump-ubuntu
ci: bump ubunutu to 24.04 for arm release.
2026-08-14 10:50:05 +02:00
Karl Seguin b53fa18c3d webapi: Give iterator to types with an indexed property
Apparently, any type that ah indexed property also gets an iterator, even if
the iterator isn't explicitly listed in the spec. This showed up as a bug
rendering washingtonpost.com.
2026-08-14 16:43:33 +08:00
Pierre Tachoire 34aae91fa1 ci: bump ubunutu to 24.04 for arm release.
apt.llvm.org no longer publishes an LLVM 23 repo for 22.04.
https://github.com/lightpanda-io/zig-v8-fork/pull/199
2026-08-14 10:30:25 +02:00
Karl Seguin 18afa56eb6 Merge pull request #3194 from lightpanda-io/test-log-silence
chore: silence test log
2026-08-14 16:29:57 +08:00
Pierre Tachoire 6f7afeb09e Merge pull request #3193 from lightpanda-io/linux-dev-fast-default-on
dev: On linux -dev_fast is on by default
2026-08-14 10:24:43 +02:00
Karl Seguin a3034105aa chore: Move cache maintenance to startup and browser.deinit
--http-cache-entry-limit is currently implemented as a hard-limit via a check
on every put. For a large --http-cache-entry-limit, this can result in a non-
trivial delay on every http get.

This commit calls cache.maintenance() on Browser.deinit and on startup.
maintenance:
1 - purges stale entries
2 - enforces the limit

With concurrent requests, the number of entries can easily exceed the limit by
hundreds of entries (but this is temporary).
2026-08-14 15:55:37 +08:00
Karl Seguin b56b292da0 webapi: Custom Element reactions need pierce the shadowdom
CustomElement reactions (connected/disconnected) need to pierce the shadowdom.
This represents a potentially expensive treewalk on some common operations (add
/remove). That walk requires checking Frame._customized_builtin_definitions and
Frame._element_shadow_roots on every element. EXPENSIVE.

So, a packed _flags: Flags struct is added to Elements which is used to signal
that the element is present in  Frame._customized_builtin_definitions and
Frame._element_shadow_roots (1 bool per lookup). Element has spare padding, so
this currently costs no memory. There's spare space  in the flag which we should
use for the other hot lookups, but I'll do that in a separate commit.

Because of this new optimized flag, the change touches a few more files than
just the CE reaction change. (Any place that accessed those two Frame lookups
directly now go through a helper which first checks the flag).

Also added a bunch of Element aria getter/setter.

(All of this was done while looking at various /custom-elements/ WPT failures).
2026-08-14 13:42:19 +08:00
Karl Seguin eb25f6cc1c chore: silence test log 2026-08-14 10:50:13 +08:00
Karl Seguin 8caaf7ad96 dev: On linux -dev_fast is on by default
Assuming the conditions are met for -dev_fast to work (linux, debug, x86-64
without sanitizers), the -dev_fast now defaults to true.

download-v8 make target always downloads the .a (as before) and on linux x86-64
it also downloads the .so.
2026-08-14 10:43:34 +08:00
Karl Seguin fb7123cf75 Merge pull request #3185 from lightpanda-io/console
webapi: improve console conformance
2026-08-14 06:42:36 +08:00
Karl Seguin 84769e555f Merge pull request #3188 from lightpanda-io/wpt-mem-limit
chore: bump WPT --max-mem from 100 to 200
2026-08-14 06:42:23 +08:00
Muki Kiboigo de5c34f092 add isSameOrigin to URL 2026-08-13 13:56:50 -07:00
muki 563ccaf4d1 Merge pull request #3158 from lightpanda-io/singleflight
Single Flight
2026-08-13 13:21:04 -07:00
Pierre Tachoire 92e3cfcbe9 fix errdefer path on singleflight 2026-08-13 17:55:48 +02:00
Muki Kiboigo a356840c63 remove from pending on waiting append error in SingleFlight 2026-08-13 08:25:18 -07:00
Muki Kiboigo fb5a9b6a35 get rid of allocator stored in RobotsGate 2026-08-13 08:20:15 -07:00
Muki Kiboigo 21856170e3 single lookup for SingleFlight pending 2026-08-13 08:20:14 -07:00
Karl Seguin aa0909aef1 chore: bump WPT --max-mem from 100 to 200
Some WPT tests just take more memory, e.g. shadow-dom/declarative/gethtml.html.

Also left some placeholder comments for profiling JS (which I used to make sure
this was just v8 memory usage). These placeholders used to exist but didn't
survive the session multi-page refactor (figured I'd fix it next time I needed
it, and now I needed it).
2026-08-13 21:06:31 +08:00
Pierre Tachoire 84daa37e22 Merge pull request #3186 from lightpanda-io/readme-wpt-link
chore: link to our daily wpt results
2026-08-13 15:02:42 +02:00
Karl Seguin bc805ec18a Merge pull request #3178 from lightpanda-io/prebuild-shared-v8
dev: support for pre-build shared library
2026-08-13 20:06:19 +08:00
Karl Seguin ff339f0342 chore: link to our daily wpt results 2026-08-13 20:04:35 +08:00
Karl Seguin c95135b5c2 update v8 dep 2026-08-13 19:31:37 +08:00
Karl Seguin af99e845df dev: support for pre-build shared library
Supports prebuild-v8 shared library and adds a `download-v8-shared` make target.
Depends on: https://github.com/lightpanda-io/zig-v8-fork/pull/198

The auto-discovery of the .so is done in the build.zig, which is different than
the auto-discovery of the .a which is done in the Makefile. This is intentional
and if we inverse -Ddev_fast so that it's on by default, the .a's auto discovery
will be moved to build.zig for consistency and explicitness. As-is, we have no
way to tell whether -Dprebuilt_v8_path=v8.a is being injected by Makefile or
is explicit (which isn't a problem so long as we're not doing dev_fast by
default).
2026-08-13 19:28:21 +08:00
Karl Seguin dbb4bab0a0 webapi: improve console conformance
Saw a non-fatal error on cnn.com related to console. All members are supposed
to be static. Ran it through WPT /console/ and improved a few different thigns:

- added dir and dirxml
- assert condition is optional
2026-08-13 19:25:45 +08:00
Pierre Tachoire a894331b1d Merge pull request #3170 from guyua9/fix/advertise-host-wildcard
cdp: fall back to loopback when /json/version bind host is a wildcard
2026-08-13 11:43:50 +02:00
Pierre Tachoire 9f18af9225 Merge pull request #3183 from lightpanda-io/split-cdp-conns-from-threads
cdp: split active_conns from active_threads
2026-08-13 11:43:34 +02:00
Muki Kiboigo d1d02e1114 dupe into owned arena for SingleFlight initial 2026-08-13 01:37:21 -07:00
Muki Kiboigo 4ed60ffc90 use reference to http client in SingleFlight tests 2026-08-13 01:37:19 -07:00
Pierre Tachoire b340071d03 config: only flag wildcard bind when no --advertise-host is set 2026-08-13 09:54:28 +02:00
Muki Kiboigo d3a1dd77f2 use test_browser http client in SingleFlight tests 2026-08-13 00:30:30 -07:00
Muki Kiboigo bb8b46145f get rid of SingleFlight abort 2026-08-13 00:26:14 -07:00
Muki Kiboigo f7e6464370 SingleFlight should own the key 2026-08-13 00:25:33 -07:00