fix(gateway): support custom URL schemes in origin allowlist matching

wendy-chsy · wendy-chsy · commit c2733897ed03 · 2026-07-02T12:48:03.000+08:00
The parseOrigin function used the standard URL constructor which assigns an opaque origin ("null") to custom schemes like tauri:// and electron://. This prevented those origins from being matched against the configured allowedOrigins allowlist, forcing Tauri/Electron Control UI clients to use the wildcard "*" workaround. Add a parseCustomSchemeOrigin fallback that manually extracts scheme, host, and hostname from custom scheme origins. The fallback is triggered both when URL ctor throws and when it returns an opaque "null" origin. Closes #46520
diff --git a/src/gateway/origin-check.test.ts b/src/gateway/origin-check.test.ts
@@ -141,6 +141,51 @@ describe("checkBrowserOrigin", () => {
       },
       expected: { ok: false as const, reason: "origin not allowed" },
     },
+    {
+      name: "accepts custom-scheme origin in allowlist (tauri://)",
+      input: {
+        requestHost: "gateway.example.com:18789",
+        origin: "tauri://localhost",
+        allowedOrigins: ["tauri://localhost"],
+      },
+      expected: { ok: true as const, matchedBy: "allowlist" as const },
+    },
+    {
+      name: "accepts custom-scheme origin with port in allowlist (electron://)",
+      input: {
+        requestHost: "gateway.example.com:18789",
+        origin: "electron://localhost:5173",
+        allowedOrigins: ["electron://localhost:5173"],
+      },
+      expected: { ok: true as const, matchedBy: "allowlist" as const },
+    },
+    {
+      name: "rejects custom-scheme origin not in allowlist",
+      input: {
+        requestHost: "gateway.example.com:18789",
+        origin: "tauri://localhost",
+        allowedOrigins: ["https://control.example.com"],
+      },
+      expected: { ok: false as const, reason: "origin not allowed" },
+    },
+    {
+      name: "accepts custom-scheme origin via wildcard",
+      input: {
+        requestHost: "gateway.example.com:18789",
+        origin: "tauri://localhost",
+        allowedOrigins: ["*"],
+      },
+      expected: { ok: true as const, matchedBy: "allowlist" as const },
+    },
+    {
+      name: "handles custom-scheme origin with local-loopback dev fallback",
+      input: {
+        requestHost: "gateway.example.com:18789",
+        origin: "tauri://localhost",
+        isLocalClient: true,
+      },
+      expected: { ok: true as const, matchedBy: "local-loopback" as const },
+    },
   ])("$name", ({ input, expected }) => {
     expect(checkBrowserOrigin(input)).toEqual(expected);
   });
diff --git a/src/gateway/origin-check.ts b/src/gateway/origin-check.ts
@@ -23,14 +23,76 @@ function parseOrigin(
   }
   try {
     const url = new URL(trimmed);
+    // Opaque origins ("null") signal a non-standard scheme (e.g. tauri://,
+    // electron://) that the URL parser cannot represent. Fall back to manual
+    // parsing so custom-scheme origins can be matched against the allowlist.
+    if (url.origin === "null") {
+      return parseCustomSchemeOrigin(trimmed);
+    }
     return {
       origin: normalizeLowercaseStringOrEmpty(url.origin),
       host: normalizeLowercaseStringOrEmpty(url.host),
       hostname: normalizeLowercaseStringOrEmpty(url.hostname),
     };
   } catch {
+    return parseCustomSchemeOrigin(trimmed);
+  }
+}
+
+/**
+ * Parse a custom-scheme origin (<scheme>://<host>[:<port>]) that the standard
+ * URL constructor cannot handle. Does not validate the scheme beyond basic
+ * character checks. Returns null when the string cannot be parsed as an origin.
+ */
+function parseCustomSchemeOrigin(
+  raw: string,
+): { origin: string; host: string; hostname: string } | null {
+  // Match <scheme>://<host-part> where host-part is everything before /, ?, or #
+  const match = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]+)/i.exec(raw);
+  if (!match) {
     return null;
   }
+  const scheme = normalizeLowercaseStringOrEmpty(match[1]);
+  const hostPort = match[2];
+  if (!scheme || !hostPort) {
+    return null;
+  }
+
+  let hostname: string;
+  let port = "";
+  if (hostPort.startsWith("[")) {
+    const bracketEnd = hostPort.indexOf("]");
+    if (bracketEnd === -1) return null;
+    hostname = hostPort.slice(1, bracketEnd);
+    if (hostPort.length > bracketEnd + 1) {
+      if (hostPort[bracketEnd + 1] === ":") {
+        port = hostPort.slice(bracketEnd + 2);
+      } else {
+        return null;
+      }
+    }
+  } else {
+    const colonIdx = hostPort.lastIndexOf(":");
+    if (colonIdx > 0) {
+      hostname = hostPort.slice(0, colonIdx);
+      port = hostPort.slice(colonIdx + 1);
+    } else {
+      hostname = hostPort;
+    }
+  }
+
+  const normalizedHostname = normalizeLowercaseStringOrEmpty(hostname);
+  if (!normalizedHostname) {
+    return null;
+  }
+  const host = normalizeLowercaseStringOrEmpty(
+    port ? `${normalizedHostname}:${port}` : normalizedHostname,
+  );
+  const origin = normalizeLowercaseStringOrEmpty(
+    port ? `${scheme}://${normalizedHostname}:${port}` : `${scheme}://${normalizedHostname}`,
+  );
+
+  return { origin, host, hostname: normalizedHostname };
 }
 
 /** Validate a browser Origin against explicit allowlist, same-host, and local dev rules. */
