mirror of
https://github.com/Kong/insomnia.git
synced 2026-09-20 05:09:09 -04:00
* refactor(templating): retire templateTagSandboxEnabled, unify on pluginSandboxEnabled The experimental `templateTagSandboxEnabled` toggle only ever gated template-tag execution and had been superseded by `pluginSandboxEnabled`, which sandboxes every untrusted plugin surface. Retire the legacy flag: - drop it from the Settings type + defaults - simplify `isSandboxEnabled` to read only `pluginSandboxEnabled` - bundle plugins are trusted, so their tags always run in-process (the legacy all-modules/all-caps bundle sandbox branch is removed) - remove the "Run template tags in sandbox" Preferences toggle - carry a user's prior opt-in forward via a settings migration (templateTagSandboxEnabled === true -> pluginSandboxEnabled = true), then delete the stale field Smoke helpers repointed to the surviving `toggle-plugin-sandbox`; the now -duplicate `enablePluginSandbox` helper is folded into `enableSandbox`. * refactor(plugins): rename 'trusted' execution mode to 'internal' 'trusted' is an internal-only PluginExecutionMode label for built-in bundled plugins the user can't install or change; it's never surfaced in the UI (the Plugins badge shows 'In-process'). Rename it to the more neutral, descriptive 'internal' to match the docs. Distinct from the plugin *registry* trust concept (resolveTrustedPlugin, the 'trusted-plugin' guard), which is unchanged. * sandbox: reject bundle-plugin name impersonation, remove stale doc (#10376) * docs(settings): simplify 'Sandbox all plugin code' toggle description Address review nit: drop implementation jargon (QuickJS-WASM, default-deny) from the Preferences copy in favour of plain language, keeping the coverage list and the full-host-access escape-hatch pointer. --------- Co-authored-by: kwburns-kong <kyle.burns@konghq.com>
101 lines
4.2 KiB
TypeScript
101 lines
4.2 KiB
TypeScript
import type { Settings } from 'insomnia-data';
|
|
import type { KeyboardShortcut } from 'insomnia-data/common';
|
|
import { areSameKeyCombinations, newDefaultRegistry } from 'insomnia-data/common';
|
|
|
|
export function migrate(doc: Settings) {
|
|
try {
|
|
doc = migrateEnsureHotKeys(doc);
|
|
doc = migrateCreateHTTPHotKey(doc);
|
|
doc = migratePluginSandboxFlag(doc);
|
|
return doc;
|
|
} catch (e) {
|
|
console.log('[db] Error during settings migration', e);
|
|
throw e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* The experimental `templateTagSandboxEnabled` flag was retired and folded into `pluginSandboxEnabled`
|
|
* (which sandboxes every untrusted plugin surface, not just template tags). Carry a user's prior opt-in
|
|
* forward: if they had the old flag on, turn on the unified flag, then drop the stale field.
|
|
*/
|
|
function migratePluginSandboxFlag(settings: Settings): Settings {
|
|
const legacy = settings as Settings & { templateTagSandboxEnabled?: boolean };
|
|
if (legacy.templateTagSandboxEnabled === true && !legacy.pluginSandboxEnabled) {
|
|
legacy.pluginSandboxEnabled = true;
|
|
}
|
|
delete legacy.templateTagSandboxEnabled;
|
|
return legacy;
|
|
}
|
|
|
|
/**
|
|
* Ensure map is updated when new hotkeys are added
|
|
*/
|
|
function migrateEnsureHotKeys(settings: Settings): Settings {
|
|
const defaultHotKeyRegistry = newDefaultRegistry();
|
|
|
|
// Remove any hotkeys that are no longer in the default registry
|
|
const hotKeyRegistry = (Object.keys(settings.hotKeyRegistry) as KeyboardShortcut[]).reduce(
|
|
(newHotKeyRegistry, key) => {
|
|
if (key in defaultHotKeyRegistry) {
|
|
newHotKeyRegistry[key] = settings.hotKeyRegistry[key];
|
|
}
|
|
|
|
return newHotKeyRegistry;
|
|
},
|
|
{} as Settings['hotKeyRegistry'],
|
|
);
|
|
|
|
settings.hotKeyRegistry = { ...defaultHotKeyRegistry, ...hotKeyRegistry };
|
|
return settings;
|
|
}
|
|
|
|
/**
|
|
* `request_createHTTP` used to be bound to Cmd/Ctrl+N by default, but that combination is now used for open create dropdown on sidebar.
|
|
* If the user's binding still contains Cmd/Ctrl+N reset it to the current default.
|
|
* If the user has customized it to something that does not use Cmd/Ctrl+N, leave their customization untouched.
|
|
*/
|
|
function migrateCreateHTTPHotKey(settings: Settings): Settings {
|
|
const createRequestHotKey = settings.hotKeyRegistry?.request_createHTTP;
|
|
const sidebarCreateDropdownHotKey = settings.hotKeyRegistry?.sidebar_showCreateDropdown;
|
|
const defaultHotKeyRegistry = newDefaultRegistry();
|
|
|
|
if (!createRequestHotKey) {
|
|
return settings;
|
|
}
|
|
|
|
const defaultSidebarCreateDropdownMacKey = defaultHotKeyRegistry.sidebar_showCreateDropdown.macKeys[0];
|
|
const defaultSidebarCreateDropdownWindowsKey = defaultHotKeyRegistry.sidebar_showCreateDropdown.winLinuxKeys[0];
|
|
|
|
// Check if the user's binding for `request_createHTTP` conflicts with the default binding for `sidebar_showCreateDropdown`
|
|
const hasConflictOnMac =
|
|
createRequestHotKey.macKeys.some(comb => areSameKeyCombinations(comb, defaultSidebarCreateDropdownMacKey)) &&
|
|
sidebarCreateDropdownHotKey.macKeys.some(comb => areSameKeyCombinations(comb, defaultSidebarCreateDropdownMacKey));
|
|
const hasConflictOnWindows =
|
|
createRequestHotKey.winLinuxKeys.some(comb =>
|
|
areSameKeyCombinations(comb, defaultSidebarCreateDropdownWindowsKey),
|
|
) &&
|
|
sidebarCreateDropdownHotKey.winLinuxKeys.some(comb =>
|
|
areSameKeyCombinations(comb, defaultSidebarCreateDropdownWindowsKey),
|
|
);
|
|
|
|
if (hasConflictOnMac) {
|
|
// Filter out the conflicting hotkey and reset to default if no other hotkeys remain
|
|
const filtered = createRequestHotKey.macKeys.filter(
|
|
comb => !areSameKeyCombinations(comb, defaultSidebarCreateDropdownMacKey),
|
|
);
|
|
settings.hotKeyRegistry.request_createHTTP.macKeys =
|
|
filtered.length > 0 ? filtered : newDefaultRegistry().request_createHTTP.macKeys;
|
|
}
|
|
if (hasConflictOnWindows) {
|
|
// Filter out the conflicting hotkey and reset to default if no other hotkeys remain
|
|
const filtered = createRequestHotKey.winLinuxKeys.filter(
|
|
comb => !areSameKeyCombinations(comb, defaultSidebarCreateDropdownWindowsKey),
|
|
);
|
|
settings.hotKeyRegistry.request_createHTTP.winLinuxKeys =
|
|
filtered.length > 0 ? filtered : newDefaultRegistry().request_createHTTP.winLinuxKeys;
|
|
}
|
|
|
|
return settings;
|
|
}
|