core: fix origin checks problems

[paul-marechal]

Both mini-browser and plugin-ext contributes WebSocket checks refuse
WebSocket connections originating from within their served content, but
it prevented all connections when serving from the {{hostname}}
pattern.

This commit handles the case when such a pattern is used and disables
the origin check in such a case.

This is not totally fool-proof as some host/pattern combinations can
still lead to problems.

e.g. host is sweet-potato.com and the pattern is
{{uuid}}-{{hostname}}. The generated regex will be ^.+-.+$ which
still matches sweet-potato.com.

You should always include a unique string inside the pattern to avoid
such situations, like {{uuid}}-webview-{{hostname}}.

This commit also moves the mini-browser file serving to
/mini-browser to avoid conflicts when hosting on the same root origin.

Signed-off-by: Paul [email protected]

Closes #8852

How to test

• Set THEIA_MINI_BROWSER_HOST_PATTERN={{hostname}}.
• Start the browser application.
• It should work, master doesn't.

Review checklist

• as an author, I have thoroughly tested my changes and carefully followed the review guidelines

Reminder for reviewers

• as a reviewer, I agree to behave in accordance with the review guidelines

[paul-marechal]

The goal of those checks was to make apps more secure by default by refusing expected origins (webview/mini-browser). An alternative would be to remove those checks and only rely on the THEIA_HOSTS mechanism. Waiting for input on this.

[paul-marechal]

We'll most likely merge this patch for tomorrow's release.

[vince-fugnitto]

@marechal-p the changes work well for me 👍

I verified that when the following is set export THEIA_MINI_BROWSER_HOST_PATTERN={{hostname}} on master, the application fails to successfully start due to websocket errors.

I confirmed that the changeset correctly works with the environment variable set on both macos and linux.