feat: Authenticate private resource requests #21331

dcalhoun · 2024-10-23T00:42:53Z

Description

Authenticate resource requests originating from within the WebView so that
requests to private sites succeed. Ref CMM-235.

To Test:

Important

The proposed logic does not work for streamed files (e.g., video and audio). It appears shouldInterceptRequest injects a Content-Length: 0 header, which creates duplicate values creating a malformed request that disables streaming.

See wordpress-mobile/GutenbergKit#34.

Regression Notes

Potential unintended areas of impact
Gutenberg Mobile or Aztec editors fail.
What I did to test those areas of impact (or what existing automated tests I relied on)
Manually tested both editors.
What automated tests I added (or what prevented me from doing so)
None, feels unnecessary for this currently experimental editor feature.

PR Submission Checklist:

I have completed the Regression Notes.
I have considered adding accessibility improvements for my changes.
I have considered if this change warrants user-facing release notes and have added them to RELEASE-NOTES.txt if necessary.

Testing Checklist (strike-out the not-applying and unnecessary ones):

dangermattic · 2024-10-23T00:46:49Z

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

wpmobilebot · 2024-10-23T00:50:51Z

Project dependencies changes

The following changes in project dependencies were detected (configuration wordpressVanillaReleaseRuntimeClasspath):

list

Upgraded Dependencies
org.wordpress.gutenbergkit:android:trunk-d6fbfc7bc28ae6db2cce09950f24bc3080374596, (changed from trunk-a58a46f3fbb892f311b562e3c122d7ef4ebbfe33)

tree

 +--- project :libs:editor
-|    \--- org.wordpress.gutenbergkit:android:trunk-a58a46f3fbb892f311b562e3c122d7ef4ebbfe33
+|    \--- org.wordpress.gutenbergkit:android:trunk-d6fbfc7bc28ae6db2cce09950f24bc3080374596
-\--- org.wordpress.gutenbergkit:android:trunk-a58a46f3fbb892f311b562e3c122d7ef4ebbfe33 (*)
+\--- org.wordpress.gutenbergkit:android:trunk-d6fbfc7bc28ae6db2cce09950f24bc3080374596 (*)

wpmobilebot · 2024-10-23T01:03:03Z

📲 You can test the changes from this Pull Request in WordPress by scanning the QR code below to install the corresponding build.

	App Name	WordPress
	Flavor	Jalapeno
	Build Type	Debug
	Version	pr21331-c8374f9
	Commit	`c8374f9`
	Direct Download	`wordpress-prototype-build-pr21331-c8374f9.apk`

Note: Google Login is not supported on these builds.

wpmobilebot · 2024-10-23T01:03:05Z

📲 You can test the changes from this Pull Request in Jetpack by scanning the QR code below to install the corresponding build.

	App Name	Jetpack
	Flavor	Jalapeno
	Build Type	Debug
	Version	pr21331-c8374f9
	Commit	`c8374f9`
	Direct Download	`jetpack-prototype-build-pr21331-c8374f9.apk`

Note: Google Login is not supported on these builds.

libs/editor/src/main/java/org/wordpress/android/editor/gutenberg/GutenbergEditorFragment.java

dcalhoun · 2024-10-30T15:49:42Z

libs/editor/src/main/java/org/wordpress/android/editor/gutenberg/GutenbergEditorFragment.java

+
+        String proxyUrl = url.toString();
+        if (mIsPrivateAtomic) {
+            proxyUrl = getPrivateResourceProxyUrl(url);


Private Atomic sites require a proxy for request authentication (D38925-code).

libs/editor/src/main/java/org/wordpress/android/editor/gutenberg/GutenbergEditorFragment.java

Address lint error regarding a common source of bugs. #21331 (review)

sonarqubecloud · 2024-11-01T13:56:44Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

dcalhoun · 2024-11-01T14:00:36Z

👋🏻 @jkmassel. I updated this with the merged wordpress-mobile/GutenbergKit#30 and the latest from trunk. I re-tested and it appears to be functioning as expected. Whenever you have time, we can look to review and merge this feature. Thanks!

nbradbury · 2025-02-18T12:43:13Z

@dcalhoun @jkmassel Where do we stand with this PR? Is it something we can close?

dcalhoun · 2025-02-18T12:47:52Z

Where do we stand with this PR? Is it something we can close?

Ideally, it is merged.

However, @jkmassel mentioned privately he would prefer avoiding a proxy URL. Transparently, I was unsure as to how we might accomplish that, so I have not moved this forward. @jkmassel do you have specific ideas for avoiding the proxy URL?

sonarqubecloud · 2025-02-19T16:43:23Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

codecov · 2025-02-19T17:02:56Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 39.67%. Comparing base (78396be) to head (c8374f9).
Report is 2 commits behind head on trunk.

Additional details and impacted files

@@           Coverage Diff           @@
##            trunk   #21331   +/-   ##
=======================================
  Coverage   39.67%   39.67%           
=======================================
  Files        2123     2123           
  Lines       99095    99095           
  Branches    15213    15213           
=======================================
  Hits        39316    39316           
  Misses      56318    56318           
  Partials     3461     3461

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Unauthenticated requests fail when attempting to load resources from a private site--e.g., an image.

Avoid NullPointerExceptions.

Lint configuration warned the `createGutenbergKitEditorFragment` function was over 60 lines.

We should authenticate requests for these common media types.

sonarqubecloud · 2025-05-22T11:58:42Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dcalhoun added [Type] Bug Gutenberg Editing and display of Gutenberg blocks. labels Oct 23, 2024

github-advanced-security bot found potential problems Oct 23, 2024

View reviewed changes

libs/editor/src/main/java/org/wordpress/android/editor/gutenberg/GutenbergEditorFragment.java Fixed Show fixed Hide fixed

dcalhoun mentioned this pull request Oct 24, 2024

fix: Rely upon the WebView for completing non-intercepted requests wordpress-mobile/GutenbergKit#34

Merged

dcalhoun commented Oct 30, 2024

View reviewed changes

dcalhoun marked this pull request as ready for review October 30, 2024 16:08

dcalhoun requested a review from jkmassel October 30, 2024 16:08

jkmassel reviewed Oct 30, 2024

View reviewed changes

libs/editor/src/main/java/org/wordpress/android/editor/gutenberg/GutenbergEditorFragment.java Outdated Show resolved Hide resolved

dcalhoun requested a review from jkmassel October 30, 2024 20:25

github-advanced-security bot found potential problems Oct 30, 2024

View reviewed changes

libs/editor/src/main/java/org/wordpress/android/editor/gutenberg/GutenbergEditorFragment.java Fixed Show fixed Hide fixed

dcalhoun added a commit that referenced this pull request Oct 31, 2024

fix: Avoid implicit use of default locale

9c41ed3

Address lint error regarding a common source of bugs. #21331 (review)

dcalhoun force-pushed the feat/authenticate-private-resource-requests branch from 172e55e to fc246b1 Compare February 19, 2025 16:39

dcalhoun mentioned this pull request Apr 18, 2025

Add iOS Request Interception wordpress-mobile/GutenbergKit#33

Draft

dcalhoun added 2 commits May 22, 2025 06:59

feat: Authenticate private resource requests

2899307

Unauthenticated requests fail when attempting to load resources from a private site--e.g., an image.

style: Address lint warnings

7474914

Avoid NullPointerExceptions.

dcalhoun force-pushed the feat/authenticate-private-resource-requests branch from fc246b1 to 7474914 Compare May 22, 2025 11:04

dcalhoun added 2 commits May 22, 2025 07:22

style: Address "function too long" lint warning

6c2c508

Lint configuration warned the `createGutenbergKitEditorFragment` function was over 60 lines.

feat: Expand supported media types

c8374f9

We should authenticate requests for these common media types.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Authenticate private resource requests #21331

feat: Authenticate private resource requests #21331

Uh oh!

dcalhoun commented Oct 23, 2024 •

edited

Loading

Uh oh!

dangermattic commented Oct 23, 2024 •

edited

Loading

Uh oh!

wpmobilebot commented Oct 23, 2024 •

edited

Loading

Uh oh!

wpmobilebot commented Oct 23, 2024 •

edited

Loading

Uh oh!

wpmobilebot commented Oct 23, 2024 •

edited

Loading

Uh oh!

Uh oh!

dcalhoun Oct 30, 2024

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Nov 1, 2024

Uh oh!

dcalhoun commented Nov 1, 2024

Uh oh!

nbradbury commented Feb 18, 2025

Uh oh!

dcalhoun commented Feb 18, 2025

Uh oh!

sonarqubecloud bot commented Feb 19, 2025

Uh oh!

codecov bot commented Feb 19, 2025 •

edited

Loading

Uh oh!

sonarqubecloud bot commented May 22, 2025

Uh oh!

Uh oh!

feat: Authenticate private resource requests #21331

Are you sure you want to change the base?

feat: Authenticate private resource requests #21331

Uh oh!

Conversation

dcalhoun commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related

Description

To Test:

Regression Notes

PR Submission Checklist:

Testing Checklist (strike-out the not-applying and unnecessary ones):

Uh oh!

dangermattic commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Project dependencies changes

Uh oh!

wpmobilebot commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wpmobilebot commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

dcalhoun Oct 30, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Nov 1, 2024

Quality Gate passed

Uh oh!

dcalhoun commented Nov 1, 2024

Uh oh!

nbradbury commented Feb 18, 2025

Uh oh!

dcalhoun commented Feb 18, 2025

Uh oh!

sonarqubecloud bot commented Feb 19, 2025

Quality Gate passed

Uh oh!

codecov bot commented Feb 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sonarqubecloud bot commented May 22, 2025

Quality Gate passed

Uh oh!

Uh oh!

dcalhoun commented Oct 23, 2024 •

edited

Loading

dangermattic commented Oct 23, 2024 •

edited

Loading

wpmobilebot commented Oct 23, 2024 •

edited

Loading

wpmobilebot commented Oct 23, 2024 •

edited

Loading

wpmobilebot commented Oct 23, 2024 •

edited

Loading

codecov bot commented Feb 19, 2025 •

edited

Loading