diff --git a/SECURITY.md b/SECURITY.md index dacb14c41..d97910122 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -66,6 +66,18 @@ CORS is not a complete security boundary. It controls which browser origins can Paseo validates the `Host` header on every HTTP request and every WebSocket upgrade against an allowlist (Vite-style semantics). By default, only `localhost`, `*.localhost`, and any literal IP address (IPv4 or IPv6) are accepted. Additional hostnames can be configured via `hostnames` in `config.json` or the `PASEO_HOSTNAMES` env var (comma-separated; entries beginning with `.` match a domain and its subdomains; the value `true` disables the allowlist entirely). Requests with unrecognized hosts are rejected with `403 Host not allowed`. +## HTML file preview + +Previewing an `.html` file in the file pane renders it as a page, so markup an agent wrote — or markup that arrived with a repo you cloned — executes when you open it. The preview is built to contain that, not to trust it. + +The document loads with an opaque origin and a policy that permits inline script and style and refuses everything else: no remote script, font, image, or media; no `fetch`, XHR, WebSocket, or beacon; no form posts; no plugins; no nested frames. It has no access to Paseo's DOM, and storage and cookie APIs throw inside it rather than returning anything. It cannot navigate the top window, and it cannot open popups. It cannot read any file but itself. + +One gap remains on web and desktop: a sandboxed document may navigate _itself_, and no CSP directive in current browsers prevents that. `navigate-to` was dropped from CSP Level 3 and is not enforced, and `` needs no script at all. A hostile page can therefore reach a server by navigating away, carrying data available inside the preview, such as its own contents, browser and device properties, user input inside the page, and your IP address. It cannot read Paseo, another file, storage, or cookies. + +Native builds narrow this gap rather than closing it outright. The WebView refuses every navigation after the initial document, but that decision is made in the app's JavaScript, and on Android the WebView falls back to allowing a navigation when the decision doesn't come back in time. Treat it as a strong mitigation, not a guarantee: if the JS thread is stalled at the moment a page navigates, the same leak is possible there too. + +If you don't trust a page, read it in `Source`, which executes nothing. Source is available as an editable view on supported web hosts and a read-only view everywhere else. + ## Agent authentication Paseo wraps agent CLIs (Claude Code, Codex, OpenCode) but does not manage their authentication. Each agent provider handles its own credentials. Paseo never stores or transmits provider API keys. Agents run in your user context with your existing credentials. diff --git a/packages/app/e2e/file-editing.spec.ts b/packages/app/e2e/file-editing.spec.ts index 8045b15e9..0e5db9d16 100644 --- a/packages/app/e2e/file-editing.spec.ts +++ b/packages/app/e2e/file-editing.spec.ts @@ -13,6 +13,13 @@ const BLUE_PIXEL = Buffer.from( "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=", "base64", ); +const BLOCKED_PREVIEW_URL = "https://html-preview.invalid/leak"; + +interface LinkedFile { + target: string; + fileName: string; + content: string; +} function editor(page: Page) { return page.getByTestId("file-source-editor").filter({ visible: true }).locator(".cm-content"); @@ -40,7 +47,31 @@ async function openWorkspaceFile(page: Page, filename: string): Promise { await expectFileTabOpen(page, filename); } -async function seedAgentWithFileLink(target: string) { +function htmlPreview(page: Page) { + return { + host: page.getByTestId("file-html-preview"), + document: page.frameLocator('[data-testid="file-html-preview"]'), + }; +} + +async function selectFileView(page: Page, view: "Preview" | "Source"): Promise { + const option = page.getByTestId("file-panel-bar").getByRole("button", { + name: view, + exact: true, + }); + await option.click(); + await expect(option).toHaveAttribute("aria-selected", "true"); +} + +function watchRequestsTo(page: Page, origin: string): string[] { + const requests: string[] = []; + page.on("request", (request) => { + if (request.url().startsWith(origin)) requests.push(request.url()); + }); + return requests; +} + +async function seedAgentWithFileLink(input: LinkedFile) { const session = await seedMockAgentWorkspace({ repoPrefix: "file-editing-chat-link-", title: "Chat file link e2e", @@ -49,24 +80,25 @@ async function seedAgentWithFileLink(target: string) { "Return JSON only with fields 'title' and 'branch'.", "", "", - `Open \`${target}\` now`, + `Open \`${input.target}\` now`, "", ].join("\n"), }); - await writeFile( - path.join(session.cwd, "target.ts"), - Array.from({ length: 80 }, (_, index) => `export const line${index + 1} = ${index + 1};`).join( - "\n", - ), - "utf8", - ); + await writeFile(path.join(session.cwd, input.fileName), input.content, "utf8"); return session; } test.describe("CodeMirror workspace file editing", () => { test("opens an assistant file link at its referenced line", async ({ page }) => { const target = "target.ts:42"; - const session = await seedAgentWithFileLink(target); + const session = await seedAgentWithFileLink({ + target, + fileName: "target.ts", + content: Array.from( + { length: 80 }, + (_, index) => `export const line${index + 1} = ${index + 1};`, + ).join("\n"), + }); try { await openAgentRoute(page, session); @@ -105,7 +137,14 @@ test.describe("CodeMirror workspace file editing", () => { test("clicking the editor focuses its pane beside an agent", async ({ page }) => { const target = "target.ts:42"; - const session = await seedAgentWithFileLink(target); + const session = await seedAgentWithFileLink({ + target, + fileName: "target.ts", + content: Array.from( + { length: 80 }, + (_, index) => `export const line${index + 1} = ${index + 1};`, + ).join("\n"), + }); try { await page.setViewportSize({ width: 1280, height: 900 }); @@ -131,6 +170,31 @@ test.describe("CodeMirror workspace file editing", () => { } }); + test("opens an HTML line target as source", async ({ page }) => { + const target = "plan.html:2"; + const session = await seedAgentWithFileLink({ + target, + fileName: "plan.html", + content: [ + "", + "

Review this source line

", + '', + ].join("\n"), + }); + + try { + await openAgentRoute(page, session); + await page.getByText(target, { exact: true }).click(); + + await expectFileTabOpen(page, "plan.html"); + await expect(page.getByTestId("file-source-editor")).toBeVisible(); + await expect(page.getByLabel("Line 2, column 1")).toBeVisible(); + await expect(page.getByTestId("file-html-preview")).toHaveCount(0); + } finally { + await session.cleanup(); + } + }); + test("shows the full file path and keeps editor controls stable", async ({ page, withWorkspace, @@ -160,9 +224,9 @@ test.describe("CodeMirror workspace file editing", () => { relativePath, ); await expect(page.getByTestId("file-panel-bar")).not.toContainText("visuals.md"); - const modeControl = page.getByTestId("file-markdown-mode"); + const modeControl = page.getByTestId("file-preview-mode"); await expect(modeControl).toBeVisible(); - await page.getByTestId("file-mode-source").click(); + await selectFileView(page, "Source"); const editorHost = page.getByTestId("file-source-editor"); const content = editor(page); @@ -224,7 +288,7 @@ test.describe("CodeMirror workspace file editing", () => { ); await workspace.navigateTo(); await openWorkspaceFile(page, "notes.md"); - await page.getByTestId("file-mode-source").click(); + await selectFileView(page, "Source"); const markdownScroller = page .getByTestId("file-source-editor") @@ -374,15 +438,15 @@ test.describe("CodeMirror workspace file editing", () => { await openWorkspaceFile(page, "notes.md"); await expect(page.getByText("First heading", { exact: true })).toBeVisible(); - await expect(page.getByTestId("file-markdown-mode")).toBeVisible(); + await expect(page.getByRole("button", { name: "Preview", exact: true })).toBeVisible(); await writeFile(markdownPath, "# Updated heading\n", "utf8"); await expect(page.getByText("Updated heading", { exact: true })).toBeVisible(); - await page.getByTestId("file-mode-source").click(); + await selectFileView(page, "Source"); await expect(page.getByTestId("file-source-editor")).toBeVisible(); await replaceEditorText(page, "# Saved from source\n"); await expect.poll(() => readFile(markdownPath, "utf8")).toBe("# Saved from source\n"); - await page.getByTestId("file-mode-preview").click(); + await selectFileView(page, "Preview"); await expect(page.getByText("Saved from source", { exact: true })).toBeVisible(); await openWorkspaceFile(page, "pixel.png"); @@ -393,6 +457,110 @@ test.describe("CodeMirror workspace file editing", () => { await expect.poll(() => image.getAttribute("src")).not.toBe(initialSource); }); + test("previews and refreshes an HTML plan while preserving source access", async ({ + page, + withWorkspace, + }) => { + test.setTimeout(90_000); + const workspace = await withWorkspace({ prefix: "file-editing-html-preview-" }); + const htmlPath = path.join(workspace.repoPath, "plan.html"); + await writeFile( + htmlPath, + "

Visual plan

", + "utf8", + ); + await workspace.navigateTo(); + await openWorkspaceFile(page, "plan.html"); + + const preview = htmlPreview(page); + await expect(preview.host).toBeVisible(); + await expect(preview.host).toHaveAttribute("sandbox", /allow-scripts/); + await expect(preview.host).not.toHaveAttribute("sandbox", /allow-same-origin/); + await expect(preview.document.getByRole("heading", { name: "Visual plan" })).toBeVisible(); + + await writeFile( + htmlPath, + "

Updated plan

", + "utf8", + ); + await expect(preview.document.getByRole("heading", { name: "Updated plan" })).toBeVisible(); + + await selectFileView(page, "Source"); + await expect(page.getByTestId("file-source-editor")).toBeVisible(); + await expect(preview.host).toHaveCount(0); + await selectFileView(page, "Preview"); + await expect(preview.host).toBeVisible(); + }); + + test("runs inline scripts without allowing fetch egress", async ({ page, withWorkspace }) => { + test.setTimeout(90_000); + const workspace = await withWorkspace({ prefix: "file-editing-html-csp-" }); + await writeFile( + path.join(workspace.repoPath, "probe.html"), + `probe +

Inline script did not run

+

Network request not attempted

+

Standards mode not detected

+ +`, + "utf8", + ); + await workspace.navigateTo(); + + const blockedRequests = watchRequestsTo(page, BLOCKED_PREVIEW_URL); + + await openWorkspaceFile(page, "probe.html"); + + const preview = htmlPreview(page); + await expect( + preview.document.getByRole("heading", { name: "Inline script ran" }), + ).toBeVisible(); + await expect( + preview.document.getByText("Standards mode enabled", { exact: true }), + ).toBeVisible(); + await expect( + preview.document.getByText("Network request blocked", { exact: true }), + ).toBeVisible(); + expect(blockedRequests).toEqual([]); + }); + + test("isolates HTML plans from the app origin and storage", async ({ page, withWorkspace }) => { + test.setTimeout(90_000); + const workspace = await withWorkspace({ prefix: "file-editing-html-origin-" }); + await writeFile( + path.join(workspace.repoPath, "origin.html"), + ` +

?

?

+ +`, + "utf8", + ); + await workspace.navigateTo(); + await openWorkspaceFile(page, "origin.html"); + + const preview = htmlPreview(page); + await expect(preview.document.getByText("Parent DOM blocked", { exact: true })).toBeVisible(); + await expect(preview.document.getByText("Storage blocked", { exact: true })).toBeVisible(); + await expect(preview.document.getByText("Cookies blocked", { exact: true })).toBeVisible(); + }); + test("persists Vim keybindings and reports Vim mode with cursor position", async ({ page, withWorkspace, diff --git a/packages/app/src/components/file-pane-render-mode.test.ts b/packages/app/src/components/file-pane-render-mode.test.ts index b57b81711..7a0bcf21e 100644 --- a/packages/app/src/components/file-pane-render-mode.test.ts +++ b/packages/app/src/components/file-pane-render-mode.test.ts @@ -1,5 +1,5 @@ import { describe, expect, it } from "vitest"; -import { isRenderedMarkdownFile } from "@/components/file-pane-render-mode"; +import { filePreviewRenderKind, isRenderedMarkdownFile } from "@/components/file-pane-render-mode"; describe("isRenderedMarkdownFile", () => { it("detects .md files", () => { @@ -19,5 +19,22 @@ describe("isRenderedMarkdownFile", () => { it("does not treat other text files as rendered markdown", () => { expect(isRenderedMarkdownFile("src/index.ts")).toBe(false); expect(isRenderedMarkdownFile("README.md.txt")).toBe(false); + expect(isRenderedMarkdownFile("plan.html")).toBe(false); + }); +}); + +describe("filePreviewRenderKind", () => { + it("maps each renderable extension to its kind", () => { + expect(filePreviewRenderKind("README.md")).toBe("markdown"); + expect(filePreviewRenderKind("notes.markdown")).toBe("markdown"); + expect(filePreviewRenderKind("plan.html")).toBe("html"); + expect(filePreviewRenderKind("docs/PLAN.HTML")).toBe("html"); + expect(filePreviewRenderKind("plan.htm")).toBe("html"); + }); + + it("returns null for files without a rendered preview", () => { + expect(filePreviewRenderKind("src/index.ts")).toBe(null); + expect(filePreviewRenderKind("page.mdx")).toBe(null); + expect(filePreviewRenderKind("index.html.erb")).toBe(null); }); }); diff --git a/packages/app/src/components/file-pane-render-mode.ts b/packages/app/src/components/file-pane-render-mode.ts index d6f507f9e..b1c36ede4 100644 --- a/packages/app/src/components/file-pane-render-mode.ts +++ b/packages/app/src/components/file-pane-render-mode.ts @@ -1,4 +1,17 @@ +export type FilePreviewRenderKind = "markdown" | "html"; + export function isRenderedMarkdownFile(filePath: string): boolean { const normalizedPath = filePath.trim().toLowerCase(); return normalizedPath.endsWith(".md") || normalizedPath.endsWith(".markdown"); } + +function isRenderedHtmlFile(filePath: string): boolean { + const normalizedPath = filePath.trim().toLowerCase(); + return normalizedPath.endsWith(".html") || normalizedPath.endsWith(".htm"); +} + +export function filePreviewRenderKind(filePath: string): FilePreviewRenderKind | null { + if (isRenderedMarkdownFile(filePath)) return "markdown"; + if (isRenderedHtmlFile(filePath)) return "html"; + return null; +} diff --git a/packages/app/src/file-pane/bar.tsx b/packages/app/src/file-pane/bar.tsx index 5784c072f..b674cc200 100644 --- a/packages/app/src/file-pane/bar.tsx +++ b/packages/app/src/file-pane/bar.tsx @@ -30,7 +30,7 @@ export function FilePanelBar({ conflict?: FileConflictAlertState; }) { const { t } = useTranslation(); - const markdownModes = [ + const previewModes = [ { value: "preview" as const, label: t("panels.file.editor.preview"), @@ -102,8 +102,8 @@ export function FilePanelBar({ size="xs" value={mode} onValueChange={onModeChange} - testID="file-markdown-mode" - options={markdownModes} + testID="file-preview-mode" + options={previewModes} /> ) : null} diff --git a/packages/app/src/file-pane/html-preview-csp.test.ts b/packages/app/src/file-pane/html-preview-csp.test.ts new file mode 100644 index 000000000..bbf3bbb74 --- /dev/null +++ b/packages/app/src/file-pane/html-preview-csp.test.ts @@ -0,0 +1,49 @@ +import { describe, expect, it } from "vitest"; +import { withPreviewCsp } from "@/file-pane/html-preview-csp"; + +describe("withPreviewCsp", () => { + it("places the policy before the complete source document", () => { + const source = + " "; + const output = withPreviewCsp(source); + + expect(output).toMatch(/^")); + }); + + it("keeps the original document intact", () => { + const source = "

Visual plan

"; + + expect(withPreviewCsp(source)).toContain(source); + }); + + it("drops a leading BOM before appending the source", () => { + const output = withPreviewCsp("

Plan

"); + + expect(output.includes("")).toBe(false); + expect(output).toContain("

Plan

"); + }); + + it("refuses remote resources while allowing inline scripts and styles", () => { + const document = withPreviewCsp("

Plan

"); + + expect(document).toContain("default-src 'none'"); + expect(document).toContain("connect-src 'none'"); + expect(document).toContain("form-action 'none'"); + expect(document).toContain("base-uri 'none'"); + expect(document).toContain("frame-src 'none'"); + expect(document).toContain("object-src 'none'"); + expect(document).toContain("script-src 'unsafe-inline'"); + expect(document).toContain("style-src 'unsafe-inline'"); + expect(document).not.toMatch(/script-src[^;]*https:/); + expect(document).not.toMatch(/img-src[^;]*https:/); + expect(document).not.toMatch(/connect-src[^;]*https:/); + }); + + it("handles pathological source without parsing it", () => { + const source = `${"`, `` +// and ``, bogus-comment tokens like `` and ``, and the +// rule that a doctype closes at the first `>` in every state. Each of those rules +// cost a bug before it was right. +// +// So the prologue isn't found, it's supplied: our doctype, then the policy, then +// the file verbatim. The file's own doctype becomes a stray DOCTYPE token, which +// the parser ignores wherever it appears. Standards mode is guaranteed, the policy +// is always the first element and therefore always in the head, and no part of the +// document has to be parsed to place it. +const PROLOGUE = `${META}`; + +// Left where it is, a BOM would sit mid-document and render as a zero-width space. +const BOM = "\uFEFF"; + +export function withPreviewCsp(html: string): string { + return PROLOGUE + (html.startsWith(BOM) ? html.slice(BOM.length) : html); +} diff --git a/packages/app/src/file-pane/html-preview-navigation.test.ts b/packages/app/src/file-pane/html-preview-navigation.test.ts new file mode 100644 index 000000000..e2029085a --- /dev/null +++ b/packages/app/src/file-pane/html-preview-navigation.test.ts @@ -0,0 +1,23 @@ +import { describe, expect, it } from "vitest"; +import { htmlPreviewNavigationKind } from "@/file-pane/html-preview-navigation"; + +describe("htmlPreviewNavigationKind", () => { + it("allows the WebView's initial document URLs", () => { + expect(htmlPreviewNavigationKind("about:blank")).toBe("initialDocument"); + expect(htmlPreviewNavigationKind("about:srcdoc")).toBe("initialDocument"); + expect(htmlPreviewNavigationKind("")).toBe("initialDocument"); + }); + + it("allows same-document fragment navigation", () => { + expect(htmlPreviewNavigationKind("about:blank#decision-table")).toBe("fragment"); + expect(htmlPreviewNavigationKind("about:srcdoc#decision-table")).toBe("fragment"); + }); + + it("blocks documents that could escape the injected policy", () => { + expect(htmlPreviewNavigationKind("https://example.com/leak")).toBe("blocked"); + expect( + htmlPreviewNavigationKind("data:text/html,"), + ).toBe("blocked"); + expect(htmlPreviewNavigationKind("blob:https://example.com/document-id")).toBe("blocked"); + }); +}); diff --git a/packages/app/src/file-pane/html-preview-navigation.ts b/packages/app/src/file-pane/html-preview-navigation.ts new file mode 100644 index 000000000..fafd4e579 --- /dev/null +++ b/packages/app/src/file-pane/html-preview-navigation.ts @@ -0,0 +1,9 @@ +export type HtmlPreviewNavigationKind = "initialDocument" | "fragment" | "blocked"; + +const INITIAL_DOCUMENT_URLS = new Set(["about:blank", "about:srcdoc", ""]); + +export function htmlPreviewNavigationKind(url: string): HtmlPreviewNavigationKind { + if (INITIAL_DOCUMENT_URLS.has(url)) return "initialDocument"; + if (url.startsWith("about:blank#") || url.startsWith("about:srcdoc#")) return "fragment"; + return "blocked"; +} diff --git a/packages/app/src/file-pane/html-preview.tsx b/packages/app/src/file-pane/html-preview.tsx new file mode 100644 index 000000000..08ded111e --- /dev/null +++ b/packages/app/src/file-pane/html-preview.tsx @@ -0,0 +1,76 @@ +import { useCallback, useMemo, useRef } from "react"; +import { StyleSheet } from "react-native-unistyles"; +import { WebView } from "react-native-webview"; +import { withPreviewCsp } from "./html-preview-csp"; +import { htmlPreviewNavigationKind } from "./html-preview-navigation"; + +// A preview is a viewer, not a browser. Only the document Paseo hands the WebView +// loads; navigations the page attempts afterwards are refused, so a link, a +// `location.href` assignment, or a meta refresh cannot pull a remote page into the +// pane or leak the file through a URL. Storage and cache stay off so a page leaves +// nothing behind between opens. +// +// This guard is not absolute, and SECURITY.md says so rather than implying +// otherwise: the decision runs in app JS, and Android's WebView allows a +// navigation whose decision doesn't return in time. A stalled JS thread is +// therefore a window, which is why the CSP does the load-bearing work and this +// guard narrows what's left. +// +// `originWhitelist: ["*"]` is what makes that guarantee hold. react-native-webview +// checks the whitelist *before* calling onShouldStartLoadWithRequest and hands +// anything that fails it to `Linking.openURL` — so a narrow whitelist would route +// custom schemes straight to the system browser without this guard ever seeing +// them. Matching everything forces every scheme through the callback below. +const ORIGIN_WHITELIST = ["*"]; + +// Pinning the base URL is what makes the guard below sound. Android loads +// `source={{ html }}` through `loadDataWithBaseURL`, and a programmatic load is not +// reliably reported to onShouldStartLoadWithRequest — so the latch may still be +// unset when the page makes its first move. Naming an inert base means the only +// URLs that can pass as "initial" are inert ones. `data:text/html` must NOT be +// allowed here: a page could navigate itself to a data document of its own, which +// would arrive with no injected policy and a clean slate to egress from. +const BASE_URL = "about:blank"; + +export function FileHtmlPreview({ html, testID }: { html: string; testID?: string }) { + const document = useMemo(() => withPreviewCsp(html), [html]); + const source = useMemo(() => ({ html: document, baseUrl: BASE_URL }), [document]); + // Latched per document rather than once for the lifetime of the WebView: the + // file pane re-renders with new content on every live-file refresh, and each of + // those is a fresh initial load that has to be allowed through. + const loadedDocumentRef = useRef(null); + const allowOnlyInitialDocument = useCallback( + ({ url }: { url: string }) => { + const navigationKind = htmlPreviewNavigationKind(url); + if (navigationKind === "fragment") return true; + if (navigationKind === "blocked") return false; + if (loadedDocumentRef.current === document) return false; + loadedDocumentRef.current = document; + return true; + }, + [document], + ); + + return ( + + ); +} + +const styles = StyleSheet.create(() => ({ + webview: { + flex: 1, + backgroundColor: "white", + }, +})); diff --git a/packages/app/src/file-pane/html-preview.web.tsx b/packages/app/src/file-pane/html-preview.web.tsx new file mode 100644 index 000000000..64d85807a --- /dev/null +++ b/packages/app/src/file-pane/html-preview.web.tsx @@ -0,0 +1,39 @@ +import { useMemo } from "react"; +import { useTranslation } from "react-i18next"; +import { withPreviewCsp } from "./html-preview-csp"; + +// `allow-scripts` alone: the file gets an opaque origin, so a plan page can run +// its own scripts (Excalidraw, charts) but cannot reach the Paseo app's DOM, +// cookies, or storage, and cannot navigate the top window. Agent-written HTML is +// not trusted markup. No popup tokens — a preview is a viewer, not a browser, and +// escaping the sandbox to open one buys nothing for reading a local plan. The same +// isolation means storage APIs throw inside the frame; pages that want to persist +// state have to export. +// +// A sandboxed frame may still navigate *itself*, and nothing in CSP stops that +// (see html-preview-csp.ts). That is the one hole left on web, it is bounded to +// the page's own contents, and it is documented in SECURITY.md rather than papered +// over with a directive browsers ignore. +const SANDBOX = "allow-scripts"; + +const iframeStyle = { + flex: 1, + minHeight: 0, + border: "none", + backgroundColor: "white", +} as const; + +export function FileHtmlPreview({ html, testID }: { html: string; testID?: string }) { + const { t } = useTranslation(); + const document = useMemo(() => withPreviewCsp(html), [html]); + return ( +