25 lines
984 B
Diff
25 lines
984 B
Diff
|
Remove parentOriginHash checko
|
||
|
|
|
||
|
|
This fixes webviews from not working properly due to a change upstream.
|
||
|
|
Upstream added a check to ensure parent authority is encoded into the webview
|
||
|
|
origin. Since our webview origin is the parent authority, we can bypass this
|
||
|
|
check.
|
||
|
|
|
||
|
|
Index: code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/main.js
|
||
|
|
===================================================================
|
||
|
|
--- code-server.orig/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/main.js
|
||
|
|
+++ code-server/lib/vscode/src/vs/workbench/contrib/webview/browser/pre/main.js
|
||
|
|
@@ -317,6 +317,12 @@ const hostMessaging = new class HostMess
|
||
|
|
const id = searchParams.get('id');
|
||
|
|
|
||
|
|
const hostname = location.hostname;
|
||
|
|
+
|
||
|
|
+ // It is safe to run if we are on the same host.
|
||
|
|
+ const parent = new URL(parentOrigin)
|
||
|
|
+ if (parent.hostname == location.hostname) {
|
||
|
|
+ return start(parentOrigin)
|
||
|
|
+ }
|
||
|
|
|
||
|
|
if (!crypto.subtle) {
|
||
|
|
// cannot validate, not running in a secure context
|