feat(browser): in-app browser tab with webview security hardening

apps/code/src/main/services/browser-view/service.test.ts

@@ -0,0 +1,30 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("browserViewService", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it.each([
+    ["true", true],
+    ["false", false],
+  ])("defaults to %s in development mode", async (isDev, expected) => {
+    vi.stubEnv("POSTHOG_CODE_IS_DEV", isDev);
+    const { browserViewService } = await import("./service");
+
+    expect(browserViewService.isEnabled()).toBe(expected);
+  });
+
+  it("updates the attachment gate", async () => {
+    vi.stubEnv("POSTHOG_CODE_IS_DEV", "false");
+    const { browserViewService } = await import("./service");
+
+    browserViewService.setEnabled(true);
+
+    expect(browserViewService.isEnabled()).toBe(true);
+  });
+});

apps/code/src/main/services/browser-view/service.ts

@@ -0,0 +1,15 @@
+import { isDevBuild } from "../../utils/env";
+
+class BrowserViewService {
+  private enabled = isDevBuild();
+
+  isEnabled(): boolean {
+    return this.enabled;
+  }
+
+  setEnabled(enabled: boolean): void {
+    this.enabled = enabled;
+  }
+}
+
+export const browserViewService = new BrowserViewService();

apps/code/src/main/trpc/router.ts

@@ -50,6 +50,7 @@ import { uiRouter } from "@posthog/host-router/routers/ui.router";
 import { updatesRouter } from "@posthog/host-router/routers/updates.router";
 import { usageMonitorRouter } from "@posthog/host-router/routers/usage-monitor.router";
 import { workspaceRouter } from "@posthog/host-router/routers/workspace.router";
+import { browserViewRouter } from "./routers/browser-view";
 import { devRouter } from "./routers/dev";
 import { discordPresenceRouter } from "./routers/discord-presence";
 import { encryptionRouter } from "./routers/encryption";
@@ -64,6 +65,7 @@ export const trpcRouter = router({
   auth: authRouter,
   autoresearch: autoresearchRouter,
   browserTabs: browserTabsRouter,
+  browserView: browserViewRouter,
   canvasData: canvasDataRouter,
   canvasTemplates: canvasTemplatesRouter,
   channelTasks: channelTasksRouter,

apps/code/src/main/trpc/routers/browser-view.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import { browserViewService } from "../../services/browser-view/service";
+import { publicProcedure, router } from "../trpc";
+
+export const browserViewRouter = router({
+  setEnabled: publicProcedure
+    .input(z.object({ enabled: z.boolean() }))
+    .mutation(({ input }) => browserViewService.setEnabled(input.enabled)),
+});

apps/code/src/main/utils/webview-attach-policy.test.ts

@@ -0,0 +1,53 @@
+import { BROWSER_WEBVIEW_PARTITION } from "@shared/browser-view";
+import { describe, expect, it } from "vitest";
+import {
+  hardenWebviewPreferences,
+  isAllowedWebviewAttachment,
+} from "./webview-attach-policy";
+
+describe("isAllowedWebviewAttachment", () => {
+  it.each([
+    ["https://posthog.com", BROWSER_WEBVIEW_PARTITION, true],
+    ["about:blank", BROWSER_WEBVIEW_PARTITION, true],
+    ["http://localhost:3000", BROWSER_WEBVIEW_PARTITION, true],
+    ["file:///etc/passwd", BROWSER_WEBVIEW_PARTITION, false],
+    ["https://posthog.com", "persist:attacker", false],
+    ["https://posthog.com", "", false],
+  ])("src %j partition %j -> allowed %s", (src, partition, allowed) => {
+    expect(isAllowedWebviewAttachment({ src, partition })).toBe(allowed);
+  });
+});
+
+describe("hardenWebviewPreferences", () => {
+  it("overrides security-sensitive guest preferences", () => {
+    const preferences = {
+      preload: "/tmp/attacker.js",
+      nodeIntegration: true,
+      nodeIntegrationInSubFrames: true,
+      nodeIntegrationInWorker: true,
+      contextIsolation: false,
+      sandbox: false,
+      webSecurity: false,
+      allowRunningInsecureContent: true,
+      experimentalFeatures: true,
+      enableBlinkFeatures: "Serial",
+      webviewTag: true,
+    };
+
+    hardenWebviewPreferences(preferences);
+
+    expect(preferences).toEqual({
+      preload: undefined,
+      nodeIntegration: false,
+      nodeIntegrationInSubFrames: false,
+      nodeIntegrationInWorker: false,
+      contextIsolation: true,
+      sandbox: true,
+      webSecurity: true,
+      allowRunningInsecureContent: false,
+      experimentalFeatures: false,
+      enableBlinkFeatures: undefined,
+      webviewTag: false,
+    });
+  });
+});

apps/code/src/main/utils/webview-attach-policy.ts

@@ -0,0 +1,41 @@
+import { BROWSER_WEBVIEW_PARTITION } from "@shared/browser-view";
+import { isAllowedWebviewNavigation } from "./webview-navigation-guard";
+
+interface WebviewSecurityPreferences {
+  preload?: string;
+  nodeIntegration?: boolean;
+  nodeIntegrationInSubFrames?: boolean;
+  nodeIntegrationInWorker?: boolean;
+  contextIsolation?: boolean;
+  sandbox?: boolean;
+  webSecurity?: boolean;
+  allowRunningInsecureContent?: boolean;
+  experimentalFeatures?: boolean;
+  enableBlinkFeatures?: string;
+  webviewTag?: boolean;
+}
+
+export function isAllowedWebviewAttachment(
+  params: Record<string, string>,
+): boolean {
+  return (
+    params.partition === BROWSER_WEBVIEW_PARTITION &&
+    isAllowedWebviewNavigation(params.src)
+  );
+}
+
+export function hardenWebviewPreferences(
+  preferences: WebviewSecurityPreferences,
+): void {
+  preferences.preload = undefined;
+  preferences.nodeIntegration = false;
+  preferences.nodeIntegrationInSubFrames = false;
+  preferences.nodeIntegrationInWorker = false;
+  preferences.contextIsolation = true;
+  preferences.sandbox = true;
+  preferences.webSecurity = true;
+  preferences.allowRunningInsecureContent = false;
+  preferences.experimentalFeatures = false;
+  preferences.enableBlinkFeatures = undefined;
+  preferences.webviewTag = false;
+}

apps/code/src/main/utils/webview-navigation-guard.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+import {
+  isAllowedWebviewNavigation,
+  isAllowedWebviewRequest,
+  isBlockedWebviewHost,
+} from "./webview-navigation-guard";
+
+describe("isBlockedWebviewHost", () => {
+  it.each([
+    ["169.254.169.254", true],
+    ["169.254.0.1", true],
+    // WHATWG URL folds decimal/hex IPv4 to dotted form before this runs.
+    [new URL("http://2852039166/").hostname, true],
+    // IPv6-mapped IPv4: OS still connects to the v4 metadata service.
+    [new URL("http://[::ffff:169.254.169.254]/").hostname, true],
+    ["metadata.google.internal", true],
+    ["METADATA.GOOGLE.INTERNAL", true],
+    ["localhost", false],
+    ["127.0.0.1", false],
+    ["192.168.1.5", false],
+    ["posthog.com", false],
+    // Not the metadata address — a normal 169.253.x host is allowed.
+    ["169.253.1.1", false],
+  ])("host %j -> blocked %s", (hostname, blocked) => {
+    expect(isBlockedWebviewHost(hostname)).toBe(blocked);
+  });
+});
+
+describe("isAllowedWebviewRequest", () => {
+  it.each([
+    ["https://posthog.com", "mainFrame", true],
+    ["http://posthog.com", "mainFrame", false],
+    ["https://posthog.com/app.js", "script", true],
+    ["http://localhost:3000/app.js", "script", true],
+    ["http://posthog.com/app.js", "script", false],
+    ["data:image/png;base64,AA==", "image", true],
+    ["blob:https://posthog.com/id", "xhr", true],
+    ["about:blank", "subFrame", true],
+    ["about:srcdoc", "subFrame", false],
+    ["file:///etc/passwd", "xhr", false],
+    ["custom-scheme://host/path", "xhr", false],
+    ["http://169.254.169.254/latest/meta-data/", "xhr", false],
+  ])("url %j resource %j -> allowed %s", (url, resourceType, allowed) => {
+    expect(isAllowedWebviewRequest(url, resourceType)).toBe(allowed);
+  });
+});
+
+describe("isAllowedWebviewNavigation", () => {
+  it.each([
+    ["https://posthog.com", true],
+    ["http://localhost:3000", true],
+    ["http://127.0.0.2:3000", true],
+    ["http://0.0.0.0:3000", true],
+    ["http://[::1]:3000", true],
+    ["http://posthog.com", false],
+    ["http://192.168.1.5", false],
+    ["about:blank", true],
+    ["about:srcdoc", false],
+    ["about:config", false],
+    // Blocked schemes fall through to search in the renderer; the guard vetoes.
+    ["file:///etc/passwd", false],
+    ["chrome://settings", false],
+    ["javascript:alert(1)", false],
+    ["data:text/html,<h1>hi</h1>", false],
+    // Metadata endpoint over an allowed scheme is still blocked by host.
+    ["http://169.254.169.254/latest/meta-data/", false],
+    ["http://metadata.google.internal/computeMetadata/v1/", false],
+    ["not a url", false],
+  ])("url %j -> allowed %s", (url, allowed) => {
+    expect(isAllowedWebviewNavigation(url)).toBe(allowed);
+  });
+});

apps/code/src/main/utils/webview-navigation-guard.ts

@@ -0,0 +1,82 @@
+// The authoritative gate for the in-app browser guest. It runs in the main
+// process, where a guest page can't route around it; the renderer's
+// normalizeAddress is only a convenience on top of this. about:blank is allowed
+// solely as the src a new blank browser tab mounts with before
+// the user enters a url.
+const LOOPBACK_HOSTS = new Set(["localhost", "0.0.0.0", "[::1]"]);
+const LOOPBACK_IPV4 = /^127\./;
+
+// Blocks the cloud instance-metadata endpoint. On cloud VMs it returns IAM /
+// service-account credentials to any local caller, so a hostile page that
+// redirects the webview there could exfiltrate them. Loopback and LAN stay
+// allowed: browsing a local dev server is a first-class use of this browser.
+//
+// WHATWG URL canonicalizes decimal/hex/octal IPv4 (http://2852039166) back to
+// dotted form before this runs, so those are covered by the v4 range. The
+// entries below close the forms it does NOT fold together: the IPv6-mapped
+// address (the OS still connects to the v4 metadata service) and GCP's
+// metadata DNS name.
+//
+// Residual gap this cannot close: DNS rebinding — an attacker domain that
+// resolves to 169.254.169.254 passes, because the real defense is checking the
+// *resolved* IP at connect time, which will-navigate doesn't expose. Egress
+// network policy on the sandbox is the actual boundary for that.
+const BLOCKED_METADATA_HOST = /^169\.254\./;
+const BLOCKED_METADATA_HOST_V6 = /^\[::ffff:a9fe:a9fe\]$/i;
+const BLOCKED_METADATA_HOSTNAMES = new Set(["metadata.google.internal"]);
+
+export function isBlockedWebviewHost(hostname: string): boolean {
+  const host = hostname.toLowerCase();
+  return (
+    BLOCKED_METADATA_HOST.test(host) ||
+    BLOCKED_METADATA_HOST_V6.test(host) ||
+    BLOCKED_METADATA_HOSTNAMES.has(host)
+  );
+}
+
+export function safeProtocol(url: string): string {
+  try {
+    return new URL(url).protocol;
+  } catch {
+    return "";
+  }
+}
+
+function isLoopbackHost(hostname: string): boolean {
+  return LOOPBACK_HOSTS.has(hostname) || LOOPBACK_IPV4.test(hostname);
+}
+
+export function isAllowedWebviewNavigation(url: string): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.href === "about:blank") return true;
+  if (isBlockedWebviewHost(parsed.hostname)) return false;
+  if (parsed.protocol === "https:") return true;
+  return parsed.protocol === "http:" && isLoopbackHost(parsed.hostname);
+}
+
+export function isAllowedWebviewRequest(
+  url: string,
+  resourceType: string,
+): boolean {
+  if (resourceType === "mainFrame") {
+    return isAllowedWebviewNavigation(url);
+  }
+
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+
+  if (parsed.href === "about:blank") return true;
+  if (isBlockedWebviewHost(parsed.hostname)) return false;
+  if (parsed.protocol === "data:" || parsed.protocol === "blob:") return true;
+  if (parsed.protocol === "https:") return true;
+  return parsed.protocol === "http:" && isLoopbackHost(parsed.hostname);
+}

apps/code/src/main/utils/webview-permission-policy.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { isAllowedWebviewPermission } from "./webview-permission-policy";
+
+describe("isAllowedWebviewPermission", () => {
+  it.each([
+    "clipboard-read",
+    "media",
+    "geolocation",
+    "notifications",
+    "openExternal",
+    "future-electron-permission",
+  ])("denies %s", (permission) => {
+    expect(isAllowedWebviewPermission(permission)).toBe(false);
+  });
+});

apps/code/src/main/utils/webview-permission-policy.ts

@@ -0,0 +1,5 @@
+const ALLOWED_WEBVIEW_PERMISSIONS: ReadonlySet<string> = new Set();
+
+export function isAllowedWebviewPermission(permission: string): boolean {
+  return ALLOWED_WEBVIEW_PERMISSIONS.has(permission);
+}