* fix(fs): report read errors of readTextFileLines
In plugins/fs/src/commands.rs read_text_file_lines_next, a read error was
mapped to "not done, empty line", so a persistent error such as EISDIR
(File::open of a directory succeeds on Unix) made the iterator yield ""
forever and the error was swallowed.
The command now closes the resource and returns the error; the JS iterator
resets its rid so a new iteration starts over. api-iife.js regenerated. E2E
spec iterates a directory and expects a rejection.
* fix(fs): close the file when a readTextFileLines loop exits early
In plugins/fs/guest-js/index.ts readTextFileLines, the async iterator did
not implement return(), so breaking out of a for await loop left the
StdLinesResource (an open file) in the webview resource table.
return() now closes the resource and resets the iterator. api-iife.js
regenerated. E2E spec breaks out of a loop, checks the resource id is no
longer valid and that iterating again starts over.
In plugins/fs/src/lib.rs OpenOptions::android_mode, the mode was built by
concatenating r/w/t/a, so open(url, {append: true}) (read defaults to
true) produced "ra" and write+truncate+append "wta", which
ParcelFileDescriptor.parseMode / ContentResolver reject.
The options now map to r, w, wt, wa, rw or rwt. append wins over the
default read (no read+append mode exists). create/createNew still have no
Android equivalent (documented on the function). Unit tests for the
mapping, compiled on the host with cfg(test).
In plugins/fs/guest-js/index.ts, the size function only sent `path`
although the Rust command accepts `options.baseDir` and the JSDoc example
passed `{ baseDir: BaseDirectory.AppData }` (a TS error, silently dropped
at runtime, so the relative path was rejected).
Adds an optional `options?: SizeOptions` parameter (new exported type).
api-iife.js regenerated. The e2e spec now measures a file and a directory
relative to AppData instead of working around the missing option.
In plugins/fs/src/commands.rs write_file_inner, a malformed or non-ASCII
`options` header was dropped with .ok(), so baseDir/append/createNew were
silently ignored and the call became a truncating write to the raw path;
the JSON array body fallback truncated values above 255 and dropped
non-numbers.
The header is parsed with parse_write_file_options: empty, `undefined`
(what fetch sends for JSON.stringify(undefined)) and `null` mean no
options, anything else must parse. Array bodies must only contain bytes.
Unit test for the header parser; e2e spec for writes without options,
which is the case the `undefined` handling keeps working.
In plugins/fs/src/watcher.rs, notify errors were discarded (TODO), so a
watch that died left no trace. They are now logged with log::error!.
Reporting them to the JS callback would change the event payload and is
deferred to v3.
check() set both variables to Debian paths when they were unset. On distros
with a different layout, such as ALT Linux, the paths do not exist, and
rustls-native-certs then loads roots only from them, so every TLS client
created afterwards in the app got an empty root store.
reqwest with rustls already finds the system store through
rustls-platform-verifier and openssl-probe, so the override is not needed.
Closes#3598
Checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend.
Without it, a server on an allowed origin can redirect the request to any other origin - including `localhost` services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.
* feat(updater): verify the version an update was signed for
The endpoint response is fetched over TLS but is not signed, and the signature
only covers the artifact, so a crafted response could pair an inflated version
with an older release's url and signature to force a downgrade to a genuine
but outdated build.
Read the version back from the signature's trusted comment and reject an
update whose announced version differs. Signatures carrying no version are
only rejected under the new requireSignedVersion option, since older CLIs did
not record one.
* fix tests
* fix(http): stop unhandled rejections from the fetch cleanup path
The request/body cleanup commands are fired as floating promises, and the
Rust side releases a resource only once: fetch_cancel_body is
resources_table.close(rid)?, and fetch_read_body also closes the rid at
end-of-body. So every release after the first rejects with BadResourceId
into a promise nobody is listening to.
Make dropBody idempotent and let both cleanup calls handle their own
rejection.
* chore: add changefile
* chore(http): rebuild api-iife.js
* fix(android): missing `consumer-rules.pro`
* setup android test
* copy right too new
* build api first
* we're still on gradle 8 right now...
* restore the right host on mac
renovate[bot]