Preserve static preview isolation across loopback aliases

Author: Jonathan Kingston

docs/browser-network-policy.md

@@ -22,6 +22,7 @@ Copse-owned static prototypes send a CSP from their preview server. It allows
 resources from the page's own origin, inline scripts/styles and embedded data/blob
 images, but denies external origins, frames, workers, plugins and base URL changes.
 A network approval does not relax this prototype CSP: bundle assets locally.
+The prototype's loopback IP aliases retain its same-origin navigation restriction.
 
 Ordinary HTTP(S) pages, including local development servers opened through the
 address bar or `browser_navigate`, retain only the CSP supplied by their server.

src/main/services/browser/static-preview-server.test.ts

@@ -3,7 +3,10 @@ import { mkdtemp, mkdir, rm, symlink, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, describe, it } from 'node:test'
-import { isBrowserRequestAllowed } from './browser-network-policy.ts'
+import {
+  isBrowserPageNavigationAllowed,
+  isBrowserRequestAllowed,
+} from './browser-network-policy.ts'
 import {
   flushPreviewStaleForTest,
   getStaticPreviewServer,
@@ -41,7 +44,6 @@ describe('static browser preview server', () => {
     assert.equal(second.url, first.url)
     assert.match(first.url, /^http:\/\/localhost:\d+\/$/)
     assert.equal(isStaticPreviewUrl(first.url), true)
-    assert.equal(isStaticPreviewUrl(first.url.replace('localhost', '127.0.0.1')), false)
     assert.equal(isStaticPreviewUrl('http://localhost:9/'), false)
     assert.equal(
       isBrowserRequestAllowed({
@@ -71,6 +73,33 @@ describe('static browser preview server', () => {
     assert.equal(await stylesheet.text(), 'body { color: plum; }')
   })
 
+  it('keeps prototype isolation when its listener is opened through an IP alias', async () => {
+    const root = await temporaryRoot('copse-static-preview-alias-')
+    await writeFile(join(root, 'index.html'), '<h1>Prototype</h1>')
+    const preview = await getStaticPreviewServer(root)
+    const alias = preview.url.replace('localhost', '127.0.0.1')
+    assert.equal(await (await fetch(alias)).text(), '<h1>Prototype</h1>')
+    for (const host of ['127.0.0.1', '[::ffff:127.0.0.1]', 'localhost.', 'preview.localhost']) {
+      const url = preview.url.replace('localhost', host)
+      assert.equal(isStaticPreviewUrl(url), true)
+      assert.equal(isBrowserPageNavigationAllowed(url, 'https://example.com/leak'), false)
+      assert.equal(isBrowserPageNavigationAllowed(url, new URL('next.html', url).href), true)
+      assert.equal(
+        isBrowserRequestAllowed({
+          documentUrl: url,
+          url: 'https://example.com/theme.css',
+          resourceType: 'stylesheet',
+          allowedOrigins: ['https://example.com'],
+        }),
+        false,
+      )
+    }
+    assert.equal(isStaticPreviewUrl(preview.url.replace('http:', 'https:')), false)
+    assert.equal(isStaticPreviewUrl(preview.url.replace('localhost', 'example.com')), false)
+    await shutdownStaticPreviewServers()
+    assert.equal(isStaticPreviewUrl(alias), false)
+  })
+
   it('reports a preview stale for any file it served, not just the entry page', async () => {
     const root = await temporaryRoot('copse-static-preview-served-')
     await mkdir(join(root, 'assets'))

src/main/services/browser/static-preview-server.ts

@@ -2,6 +2,7 @@ import { createReadStream, watch, type FSWatcher } from 'node:fs'
 import { realpath, stat } from 'node:fs/promises'
 import { createServer, type Server } from 'node:http'
 import { extname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { embeddedIpv4, normalizeHostname } from '@copse/llm/credential-url.ts'
 
 const LOOPBACK_HOST = '127.0.0.1'
 
@@ -80,7 +81,19 @@ const servers = new Map<string, PreviewServerEntry>()
 /** Whether this URL belongs to a Copse-owned static prototype server. */
 export function isStaticPreviewUrl(url: string): boolean {
   if (!URL.canParse(url)) return false
-  const origin = new URL(url).origin
+  const parsed = new URL(url)
+  const host = normalizeHostname(parsed.hostname)
+  // The listener binds 127.0.0.1 but advertises localhost. Opening its IP alias
+  // must not turn an untrusted prototype into an unrestricted ordinary page.
+  if (
+    host === 'localhost' ||
+    host.endsWith('.localhost') ||
+    host === LOOPBACK_HOST ||
+    embeddedIpv4(host) === LOOPBACK_HOST
+  ) {
+    parsed.hostname = 'localhost'
+  }
+  const origin = parsed.origin
   return [...servers.values()].some((entry) => new URL(entry.url).origin === origin)
 }