fix(browser): isolate proxied tab requests

Author: brainplusplus

internal/browser/manager.go

@@ -101,7 +101,7 @@ func (m *Manager) CreateTab(rawURL string) (Tab, error) {
 		ID:        id,
 		URL:       target.String(),
 		Title:     target.Host,
-		ProxyPath: "/api/browser/proxy/" + id + "/",
+		ProxyPath: "/browser/" + id + "/",
 		CreatedAt: now,
 		UpdatedAt: now,
 	}
@@ -174,7 +174,11 @@ func (m *Manager) ProxyTarget(id string, requestPath string, rawQuery string) (*
 		return nil, err
 	}
 	target := *base
-	target.Path = joinURLPath(base.Path, requestPath)
+	if requestPath == "" || requestPath == "/" {
+		target.Path = joinURLPath(base.Path, requestPath)
+	} else {
+		target.Path = requestPath
+	}
 	target.RawPath = ""
 	if rawQuery != "" {
 		target.RawQuery = rawQuery

internal/browser/manager_test.go

@@ -59,3 +59,27 @@ func TestManagerTabsAndProxyTarget(t *testing.T) {
 		t.Fatalf("DeleteTab() error = %v", err)
 	}
 }
+
+func TestProxyTargetMapsInitialDocumentAndAbsoluteResources(t *testing.T) {
+	manager := NewManager()
+	tab, err := manager.CreateTab("https://example.com/docs/page")
+	if err != nil {
+		t.Fatalf("CreateTab() error = %v", err)
+	}
+
+	document, err := manager.ProxyTarget(tab.ID, "/", "")
+	if err != nil {
+		t.Fatalf("ProxyTarget(document) error = %v", err)
+	}
+	if document.String() != "https://example.com/docs/page" {
+		t.Fatalf("expected initial proxy request to load tab URL, got %q", document.String())
+	}
+
+	asset, err := manager.ProxyTarget(tab.ID, "/assets/app.js", "v=1")
+	if err != nil {
+		t.Fatalf("ProxyTarget(asset) error = %v", err)
+	}
+	if asset.String() != "https://example.com/assets/app.js?v=1" {
+		t.Fatalf("expected absolute asset path to stay root-relative, got %q", asset.String())
+	}
+}

internal/httpapi/browserapi.go

@@ -102,7 +102,7 @@ func (a *API) handleBrowserProxy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	rest := strings.TrimPrefix(r.URL.Path, "/api/browser/proxy/")
+	rest := browserProxyRest(r.URL.Path)
 	tabID, requestPath := splitBrowserProxyPath(rest)
 	if tabID == "" {
 		http.NotFound(w, r)
@@ -134,6 +134,8 @@ func (a *API) handleBrowserProxy(w http.ResponseWriter, r *http.Request) {
 		req.Header.Del("Accept-Encoding")
 	}
 	proxy.ModifyResponse = func(resp *http.Response) error {
+		resp.Header.Set("Cache-Control", "no-store")
+		resp.Header.Set("Pragma", "no-cache")
 		resp.Header.Del("X-Frame-Options")
 		resp.Header.Del("Content-Security-Policy")
 		resp.Header.Del("Content-Security-Policy-Report-Only")
@@ -315,6 +317,13 @@ func splitBrowserTabPath(rest string) (string, string) {
 	return id, strings.Trim(action, "/")
 }
 
+func browserProxyRest(requestPath string) string {
+	if strings.HasPrefix(requestPath, "/browser/") {
+		return strings.TrimPrefix(requestPath, "/browser/")
+	}
+	return strings.TrimPrefix(requestPath, "/api/browser/proxy/")
+}
+
 func splitBrowserProxyPath(rest string) (string, string) {
 	rest = strings.TrimLeft(rest, "/")
 	if rest == "" {

internal/httpapi/browserproxy.go

@@ -12,7 +12,7 @@ import (
 	"golang.org/x/net/html"
 )
 
-const proxyRuntimePatch = `(function(){if(window.__nineEDProxyPatched)return;window.__nineEDProxyPatched=true;var proxyBase=%q;var remotePath=%q;var tabId=%q;function normalize(input){try{var value=String(input);if(/^(data|blob|javascript|mailto|tel):/i.test(value))return value;if(value.startsWith("//"))return window.location.protocol+value;if(value.startsWith("/"))return proxyBase+value.slice(1);return value}catch{return input}}function notifyParent(type,payload){try{if(window.parent&&window.parent!==window){window.parent.postMessage(Object.assign({__nineBrowser:true,type:type,tabId:tabId},payload||{}),window.location.origin)}}catch{}}try{if(remotePath&&window.location.pathname!==remotePath.split(/[?#]/,1)[0]){window.history.replaceState(window.history.state,"",remotePath)}}catch{}var originalFetch=window.fetch;if(typeof originalFetch==="function"){window.fetch=function(input,init){if(typeof input==="string"){input=normalize(input)}else if(input instanceof Request){input=new Request(normalize(input.url),input)}return originalFetch.call(this,input,init)}}var originalOpen=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(method,url){if(arguments.length>1){arguments[1]=normalize(url)}return originalOpen.apply(this,arguments)};if(window.EventSource){var OriginalEventSource=window.EventSource;window.EventSource=function(url,config){return new OriginalEventSource(normalize(url),config)};window.EventSource.prototype=OriginalEventSource.prototype}if(navigator.serviceWorker&&typeof navigator.serviceWorker.register==="function"){var originalRegister=navigator.serviceWorker.register.bind(navigator.serviceWorker);navigator.serviceWorker.register=function(scriptURL,options){var nextOptions=options?Object.assign({},options):{};if(nextOptions.scope){nextOptions.scope=normalize(nextOptions.scope)}else{nextOptions.scope=proxyBase}return originalRegister(normalize(scriptURL),nextOptions)}}var nativeWindowOpen=window.open;window.open=function(url,target,features){var normalized=normalize(url||"about:blank");var targetName=String(target||"_blank").toLowerCase();if(targetName===""||targetName==="_blank"||targetName==="_new"||features){notifyParent("open-tab",{url:normalized,target:target||"_blank",features:features||""});return {closed:false,close:function(){notifyParent("close-tab",{})},focus:function(){notifyParent("focus-tab",{})},postMessage:function(message,origin){notifyParent("post-message",{message:message,origin:origin||"*"})},location:{href:normalized}}}return nativeWindowOpen.call(window,normalized,target,features)};var nativeClose=window.close;window.close=function(){notifyParent("close-tab",{});try{return nativeClose.call(window)}catch{return undefined}};document.addEventListener("click",function(event){var node=event.target;while(node&&node.nodeType===1){if(node.tagName==="A"&&node.href){var targetName=String(node.getAttribute("target")||"").toLowerCase();if(targetName==="_blank"||node.hasAttribute("download")){event.preventDefault();notifyParent("open-tab",{url:normalize(node.href),target:targetName||"_blank"});return}break}node=node.parentElement}},true);document.addEventListener("submit",function(event){var form=event.target;if(form&&form.tagName==="FORM"){var targetName=String(form.getAttribute("target")||"").toLowerCase();if(targetName==="_blank"){event.preventDefault();var action=form.getAttribute("action")||remotePath||"/";notifyParent("open-tab",{url:normalize(action),target:"_blank",method:String(form.getAttribute("method")||"get").toUpperCase()})}}},true)})();`
+const proxyRuntimePatch = `(function(){if(window.__nineEDProxyPatched)return;window.__nineEDProxyPatched=true;var proxyBase=%q;var remotePath=%q;var tabId=%q;function normalize(input){try{var value=String(input);if(/^(data|blob|javascript|mailto|tel):/i.test(value))return value;if(value.startsWith("//"))return value;if(value.startsWith(window.location.origin+"/")&&!value.startsWith(window.location.origin+proxyBase)){var parsed=new URL(value);return proxyBase+parsed.pathname.replace(/^\/+/,"")+(parsed.search||"")+(parsed.hash||"")}if(value.startsWith("/"))return proxyBase+value.slice(1);return value}catch{return input}}function notifyParent(type,payload){try{if(window.parent&&window.parent!==window){window.parent.postMessage(Object.assign({__nineBrowser:true,type:type,tabId:tabId},payload||{}),window.location.origin)}}catch{}}var originalFetch=window.fetch;if(typeof originalFetch==="function"){window.fetch=function(input,init){if(typeof input==="string"||input instanceof URL){input=normalize(input)}else if(input instanceof Request){input=new Request(normalize(input.url),input)}return originalFetch.call(this,input,init)}}var originalOpen=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(method,url){if(arguments.length>1){arguments[1]=normalize(url)}return originalOpen.apply(this,arguments)};if(window.EventSource){var OriginalEventSource=window.EventSource;window.EventSource=function(url,config){return new OriginalEventSource(normalize(url),config)};window.EventSource.prototype=OriginalEventSource.prototype}if(navigator.serviceWorker&&typeof navigator.serviceWorker.register==="function"){navigator.serviceWorker.register=function(){return Promise.resolve({active:null,installing:null,waiting:null,scope:proxyBase,update:function(){return Promise.resolve()},unregister:function(){return Promise.resolve(true)},addEventListener:function(){},removeEventListener:function(){}})}}var nativeWindowOpen=window.open;window.open=function(url,target,features){var normalized=normalize(url||"about:blank");var targetName=String(target||"_blank").toLowerCase();if(targetName===""||targetName==="_blank"||targetName==="_new"||features){notifyParent("open-tab",{url:normalized,target:target||"_blank",features:features||""});return {closed:false,close:function(){notifyParent("close-tab",{})},focus:function(){notifyParent("focus-tab",{})},postMessage:function(message,origin){notifyParent("post-message",{message:message,origin:origin||"*"})},location:{href:normalized}}}return nativeWindowOpen.call(window,normalized,target,features)};var nativeClose=window.close;window.close=function(){notifyParent("close-tab",{});try{return nativeClose.call(window)}catch{return undefined}};document.addEventListener("click",function(event){var node=event.target;while(node&&node.nodeType===1){if(node.tagName==="A"&&node.href){var targetName=String(node.getAttribute("target")||"").toLowerCase();if(targetName==="_blank"||node.hasAttribute("download")){event.preventDefault();notifyParent("open-tab",{url:normalize(node.href),target:targetName||"_blank"});return}break}node=node.parentElement}},true);document.addEventListener("submit",function(event){var form=event.target;if(form&&form.tagName==="FORM"){var targetName=String(form.getAttribute("target")||"").toLowerCase();if(targetName==="_blank"){event.preventDefault();var action=form.getAttribute("action")||remotePath||"/";notifyParent("open-tab",{url:normalize(action),target:"_blank",method:String(form.getAttribute("method")||"get").toUpperCase()})}}},true)})();`
 
 func rewriteProxyResponseBody(resp *http.Response, prefix string, remotePath string, tabID string) error {
 	if resp.Body == nil {
@@ -90,7 +90,7 @@ func rewriteProxyHTML(input []byte, prefix string, remotePath string, tabID stri
 	head := findElement(doc, "head")
 	body := findElement(doc, "body")
 	if head != nil {
-		ensureProxyBase(head, prefix)
+		ensureProxyBase(head, proxyDocumentBase(prefix, remotePath))
 		injectProxyRuntime(head, prefix, remotePath, tabID)
 	}
 
@@ -204,7 +204,7 @@ func rewriteProxyAttribute(value string, prefix string) string {
 		return value
 	}
 	if strings.HasPrefix(value, "//") {
-		return prefix + strings.TrimPrefix(value, "//")
+		return value
 	}
 	if strings.HasPrefix(value, "/") {
 		return prefix + strings.TrimPrefix(value, "/")
@@ -242,6 +242,18 @@ func ensureProxyBase(head *html.Node, prefix string) {
 	head.InsertBefore(base, head.FirstChild)
 }
 
+func proxyDocumentBase(prefix string, remotePath string) string {
+	remoteURL, err := url.Parse(remotePath)
+	if err != nil {
+		return prefix
+	}
+	remoteDir := path.Dir(remoteURL.Path)
+	if remoteDir == "." || remoteDir == "/" {
+		return prefix
+	}
+	return prefix + strings.Trim(remoteDir, "/") + "/"
+}
+
 func injectProxyRuntime(head *html.Node, prefix string, remotePath string, tabID string) {
 	for child := head.FirstChild; child != nil; child = child.NextSibling {
 		if child.Type == html.ElementNode && child.Data == "script" && attrValue(child, "data-nine-proxy-runtime") == "true" {
@@ -309,7 +321,7 @@ func attrValue(node *html.Node, key string) string {
 }
 
 func browserProxyPrefix(tabID string) string {
-	return path.Join("/api/browser/proxy", tabID) + "/"
+	return path.Join("/browser", tabID) + "/"
 }
 
 func isJavaScriptContentType(contentType string) bool {

internal/httpapi/browserproxy_test.go

@@ -12,19 +12,19 @@ import (
 func TestRewriteProxyHTMLRewritesRootRelativeAssetsAndInjectsRuntime(t *testing.T) {
 	input := []byte(`<!doctype html><html><head><script src="/assets/app.js"></script></head><body><img src="/hero.png"><a href="/docs">Docs</a></body></html>`)
 
-	output, err := rewriteProxyHTML(input, "/api/browser/proxy/browser-1/", "/", "browser-1")
+	output, err := rewriteProxyHTML(input, "/browser/browser-1/", "/", "browser-1")
 	if err != nil {
 		t.Fatalf("rewriteProxyHTML() error = %v", err)
 	}
 	html := string(output)
 
-	if !strings.Contains(html, `<base href="/api/browser/proxy/browser-1/"/>`) {
+	if !strings.Contains(html, `<base href="/browser/browser-1/"/>`) {
 		t.Fatalf("expected base href to be injected, got %q", html)
 	}
-	if !strings.Contains(html, `src="/api/browser/proxy/browser-1/assets/app.js"`) {
+	if !strings.Contains(html, `src="/browser/browser-1/assets/app.js"`) {
 		t.Fatalf("expected script src to be rewritten, got %q", html)
 	}
-	if !strings.Contains(html, `href="/api/browser/proxy/browser-1/docs"`) {
+	if !strings.Contains(html, `href="/browser/browser-1/docs"`) {
 		t.Fatalf("expected anchor href to be rewritten, got %q", html)
 	}
 	if !strings.Contains(html, `data-nine-proxy-runtime="true"`) {
@@ -36,15 +36,45 @@ func TestRewriteProxyHTMLRewritesRootRelativeAssetsAndInjectsRuntime(t *testing.
 	if !strings.Contains(html, `var tabId="browser-1"`) {
 		t.Fatalf("expected runtime patch to receive tab id, got %q", html)
 	}
+	if strings.Contains(html, `history.replaceState`) {
+		t.Fatalf("proxy runtime must not move the iframe out of the proxy URL, got %q", html)
+	}
+	if !strings.Contains(html, `window.location.origin+"/"`) {
+		t.Fatalf("expected runtime patch to normalize same-origin absolute URLs, got %q", html)
+	}
+}
+
+func TestRewriteProxyHTMLUsesRemoteDocumentDirectoryForRelativeAssets(t *testing.T) {
+	input := []byte(`<!doctype html><html><head><script src="chunk.js"></script></head><body></body></html>`)
+
+	output, err := rewriteProxyHTML(input, "/browser/browser-1/", "/docs/page?x=1", "browser-1")
+	if err != nil {
+		t.Fatalf("rewriteProxyHTML() error = %v", err)
+	}
+	html := string(output)
+
+	if !strings.Contains(html, `<base href="/browser/browser-1/docs/"/>`) {
+		t.Fatalf("expected base href to use remote directory, got %q", html)
+	}
+	if !strings.Contains(html, `src="chunk.js"`) {
+		t.Fatalf("expected relative asset to remain relative to base, got %q", html)
+	}
+}
+
+func TestRewriteProxyAttributeLeavesSchemeRelativeURLsAlone(t *testing.T) {
+	got := rewriteProxyAttribute("//www.gstatic.com/assets/app.js", "/browser/browser-1/")
+	if got != "//www.gstatic.com/assets/app.js" {
+		t.Fatalf("expected scheme-relative URL to be preserved, got %q", got)
+	}
 }
 
 func TestRewriteProxyLocationRewritesAbsoluteAndRootRelativeLocations(t *testing.T) {
-	prefix := "/api/browser/proxy/browser-1/"
+	prefix := "/browser/browser-1/"
 
-	if got := rewriteProxyLocation("/login", prefix); got != "/api/browser/proxy/browser-1/login" {
+	if got := rewriteProxyLocation("/login", prefix); got != "/browser/browser-1/login" {
 		t.Fatalf("rewriteProxyLocation(root-relative) = %q", got)
 	}
-	if got := rewriteProxyLocation("https://example.com/dashboard?x=1", prefix); got != "/api/browser/proxy/browser-1/dashboard?x=1" {
+	if got := rewriteProxyLocation("https://example.com/dashboard?x=1", prefix); got != "/browser/browser-1/dashboard?x=1" {
 		t.Fatalf("rewriteProxyLocation(absolute) = %q", got)
 	}
 	if got := rewriteProxyLocation("settings", prefix); got != "settings" {
@@ -66,7 +96,7 @@ func TestHandleBrowserProxyRewritesHTMLResponses(t *testing.T) {
 	}
 
 	api := New(Dependencies{Mode: "full", UseBrowser: true, Browser: manager})
-	req := httptest.NewRequest(http.MethodGet, "/api/browser/proxy/"+tab.ID+"/", nil)
+	req := httptest.NewRequest(http.MethodGet, "/browser/"+tab.ID+"/", nil)
 	rec := httptest.NewRecorder()
 
 	api.Handler().ServeHTTP(rec, req)
@@ -75,42 +105,45 @@ func TestHandleBrowserProxyRewritesHTMLResponses(t *testing.T) {
 		t.Fatalf("expected 200, got %d: %s", rec.Code, rec.Body.String())
 	}
 	body := rec.Body.String()
-	if !strings.Contains(body, `src="/api/browser/proxy/`+tab.ID+`/assets/app.js"`) {
+	if !strings.Contains(body, `src="/browser/`+tab.ID+`/assets/app.js"`) {
 		t.Fatalf("expected proxied asset path, got %q", body)
 	}
 	if got := rec.Header().Get("X-Frame-Options"); got != "" {
 		t.Fatalf("expected X-Frame-Options to be removed, got %q", got)
 	}
+	if got := rec.Header().Get("Cache-Control"); got != "no-store" {
+		t.Fatalf("expected proxied browser responses to disable cache, got %q", got)
+	}
 }
 
 func TestRewriteProxyCSSRewritesRootRelativeURLs(t *testing.T) {
 	input := []byte(`@font-face{src:url('/cf-fonts/v/inter/normal.woff2')} .hero{background-image:url(/images/hero.png)}`)
 
-	output := string(rewriteProxyCSS(input, "/api/browser/proxy/browser-1/"))
+	output := string(rewriteProxyCSS(input, "/browser/browser-1/"))
 
-	if !strings.Contains(output, `url('/api/browser/proxy/browser-1/cf-fonts/v/inter/normal.woff2')`) {
+	if !strings.Contains(output, `url('/browser/browser-1/cf-fonts/v/inter/normal.woff2')`) {
 		t.Fatalf("expected font URL to be rewritten, got %q", output)
 	}
-	if !strings.Contains(output, `url(/api/browser/proxy/browser-1/images/hero.png)`) {
+	if !strings.Contains(output, `url(/browser/browser-1/images/hero.png)`) {
 		t.Fatalf("expected background URL to be rewritten, got %q", output)
 	}
 }
 
 func TestRewriteProxyJavaScriptRewritesRootRelativeAssetAndServiceWorkerPaths(t *testing.T) {
 	input := []byte("const asset=\"/assets/chunk.js\"; import(\"/assets/entry.js\"); const sw=`/sw.js`; navigator.serviceWorker.register(\"/sw.js\",{scope:\"/\"});")
 
-	output := string(rewriteProxyJavaScript(input, "/api/browser/proxy/browser-1/"))
+	output := string(rewriteProxyJavaScript(input, "/browser/browser-1/"))
 
-	if !strings.Contains(output, `"/api/browser/proxy/browser-1/assets/chunk.js"`) {
+	if !strings.Contains(output, `"/browser/browser-1/assets/chunk.js"`) {
 		t.Fatalf("expected asset string rewrite, got %q", output)
 	}
-	if !strings.Contains(output, `"/api/browser/proxy/browser-1/sw.js"`) {
+	if !strings.Contains(output, `"/browser/browser-1/sw.js"`) {
 		t.Fatalf("expected service worker script rewrite, got %q", output)
 	}
-	if !strings.Contains(output, "`/api/browser/proxy/browser-1/sw.js`") {
+	if !strings.Contains(output, "`/browser/browser-1/sw.js`") {
 		t.Fatalf("expected template literal service worker rewrite, got %q", output)
 	}
-	if !strings.Contains(output, `scope:"/api/browser/proxy/browser-1/"`) {
+	if !strings.Contains(output, `scope:"/browser/browser-1/"`) {
 		t.Fatalf("expected service worker scope rewrite, got %q", output)
 	}
 }

internal/httpapi/router.go

@@ -115,6 +115,7 @@ func (a *API) Handler() http.Handler {
 		mux.HandleFunc("/api/browser/tabs", a.handleBrowserTabs)
 		mux.HandleFunc("/api/browser/tabs/", a.handleBrowserTabByID)
 		mux.HandleFunc("/api/browser/proxy/", a.handleBrowserProxy)
+		mux.HandleFunc("/browser/", a.handleBrowserProxy)
 		mux.HandleFunc("/api/browser/automation/status", a.handleBrowserAutomationStatus)
 		mux.HandleFunc("/api/browser/automation/start", a.handleBrowserAutomationStart)
 		mux.HandleFunc("/api/browser/automation/navigate", a.handleBrowserAutomationNavigate)

internal/server/server.go

@@ -81,6 +81,7 @@ func New(cfg config.Config) *Server {
 func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
 	mux.Handle("/api/", s.api.Handler())
+	mux.Handle("/browser/", s.api.Handler())
 	mux.Handle("/ws/", s.api.Handler())
 	mux.Handle("/", spaHandler(distDir(), s.Config.Mode))