Chromium reports loadingFailed for a failed document request and later
loadingFinished when its internal error Document commits and loads under
the same request identity. The sequential navigation audit incorrectly
reported duplicate terminals and a successful terminal without a response.
Recognize this pair only when a same-session chrome-error frame commit
matches the request's frame, loader, and final unreachable URL between
the failure and completion. Keep ordinary request ordering and duplicate
terminal checks, and retain the transport failure in request summaries.
Cover direct and redirected failures, identity mismatches, missing or
misordered commits, extra terminals, and preservation of failure details.
Fix MOL-554 by keeping renderer output fences for different Pages as
independent predecessors of the existing protocol output work item.
Preserve command correlation when publishing cleanup and detach events
after every original renderer prefix has crossed protocol ingress.
Cover continued and outstanding Fetch requests across two Pages, and prove
that projecting one Page's cursor cannot release another Page's output.
Validation: cargo fmt --all; workspace all-target/all-feature Clippy;
Nextest 21,987 passed, 19 skipped; Playwright reproduction passes 3/3.
Check SRI admission in the child stylesheet installer before preparing an
owner CSSStyleSheet. The later resource-result guard runs after installation
and otherwise leaves an empty sheet visible for rejected responses.
Keep error completion and load-delay release on the existing terminal path.
The process-wide allocator is already present on main. Exercise the shared
registry constructor with separate Documents that reuse a local DOM handle,
and verify exported IDs remain unique and cannot resolve in the other registry.
Remove completed responses from the frame stylesheet store. Later link and
inline import owners now enter Fetch again, so the existing cache decides
whether to reuse, revalidate or download a response, and failures can retry.
Use each request's load-delay token to match its completion before taking
the remaining subscribers. A duplicate completion cannot settle a later
request for the same signature, and revoked owners stay excluded.
Cover no-store, fresh max-age responses and network failure recovery for
both links and imports, including the parser's wait for each new completion.
Reject integrity-failed parser stylesheet responses in child Documents before preparing or installing an owner CSSStyleSheet. Complete the failed load and release its blocker through the existing terminal path.
Add eight end-to-end URL iframe/srcdoc cases covering initial and cached integrity rejection, matching hashes, CSSOM and computed style, dependent import suppression, and parser/DCL/iframe-load progress.
The regression reproduced the empty-sheet bug at the previous PR head. Validation at 32 build jobs, test threads and Tokio workers: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.212s] 22163 tests run: 22163 passed (9 slow), 20 skipped
Store DevToolsPreloadScriptId in BrowserContext preload registrations and keep registry_key unset there. Preserve typed IDs through registration, routing, removal and response projection.
Derive renderer keys through a shared descriptor projection for navigation and live updates, and derive removal keys from the same protocol ID. Extend the regression to verify that a previous renderer key cannot become a second stored identity.
Validation: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast (22,197 passed, 20 skipped).
Name mutable BrowserContext registrations context_preload_scripts and name the startup-plus-protocol projection context_document_start_script_descriptors. Update registration, removal, channel lookup and pending command names to match their ownership.
Keep startup scripts separate and preserve script IDs, renderer registry keys, diagnostic fields and execution order.
Validation: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast (22,197 passed, 20 skipped).
`moli fetch` reads configured document-start scripts straight from
BrowserConfig, but `moli serve` builds its pages from
NavigationRuntimeConfig, which never carried them, so the flag was a
silent no-op in serve mode.
- NavigationRuntimeConfig gains `document_start_scripts`, populated in
From<&BrowserConfig>; the two exhaustive destructurings mark it as not
engine state.
- BrowserContextState::bind_page_navigation_engines seeds each configured
script into the context's default document-start registry (the same
registry BiDi addPreloadScript uses), once per context.
Verified: unit test for the config hop; end to end, a script that
increments a counter reads 1 after each of two navigations (upstream
binary: script never runs).
Support type: text through the shared module map, Window, child Documents and workers. Export UTF-8 decoded strings without executing their contents, preserve typed-module identity, and carry text request metadata through network, preload and Service Worker loaders. Regressions cover static/dynamic import sharing, BOM and invalid UTF-8, CORS, integrity, worker environments and unsupported-type rejection.
Extracted from development commit a6de018613.
Base: main (62e527cd34).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.817s] 22203 tests run: 22203 passed (9 slow), 20 skipped
The frontend router dispatches every command with a session: the client's
sessionId, or the frontend's own browser session when the client sent none.
SystemInfo.getInfo / getProcessInfo rejected any command with a session, so
over a real browser-endpoint connection they always answered "only supported
on the browser target" (unit tests passed because TestContext sends no
session). Measured: a fresh, never-attached browser-endpoint connection got
the error too.
Use the same rule as Target's browser-only operations: no session, or a
session whose route is the browser (`is_browser_session_id`). Page / frame
target sessions are still rejected (the existing two tests are unchanged).
Test: system_info_accepts_the_frontend_browser_session. Reverting the check
fails it. fmt / clippy -D warnings clean.
Limit protocol discovery checks to the selected endpoint. Run endpoint
identity comparisons and restart checks from the managed target-lifecycle
group, while preserving discovery, stability and invalid-path checks for
external endpoints.
Cover external protocol workers and managed-process restart behavior.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Filter author-provided headers in Window and Worker fetch inputs for both
URL and Request override paths, using the guard selected by request mode.
Keep trusted extra HTTP headers separate from this filtering.
Add network coverage for header handling across fetch modes and input
forms, including Window/Worker behavior and trusted-header compatibility.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Load an attacker page in Moli and exercise browser CDP, page CDP and BiDi
WebSockets against the built binary. Verify that default cross-origin
connections fail while native clients continue to work.
Include same-origin, explicit allowlist and wildcard positive controls,
and verify that rebinding Host requests remain blocked. Support Chromium
as an optional attacker-page engine.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Apply a shared guard before HTTP and WebSocket routing across CDP,
WebDriver Classic and BiDi. Accept any IP literal, or localhost and its
subdomains (including a trailing root dot). Treat an empty port as
unspecified.
Allow requests without Origin, from the bound server's HTTP origin, or
from explicitly allowlisted origins. Support repeated and comma-separated
--remote-allow-origins values and the '*' wildcard. Reject ambiguous
headers and keep Host validation independent of Origin exceptions.
Cover the HTTP routers, CDP and BiDi WebSocket handshakes, and WebDriver
text/plain session creation, including same-origin compatibility.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Generate a fresh browser WebSocket UUID per server and random 128-bit page
and tab target IDs for network CDP owners. Keep discovery URLs and protocol
target IDs consistent, and make clients discover endpoints instead of
relying on fixed paths.
Cover endpoint rotation, guessed and foreign ID rejection, and target
lifecycle behavior.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Determine whether a fragment is template contents from its actual native host instead of scanning parser template aliases. Preserve custom-element upgrades in declarative ShadowRoots and cover innerHTML, setHTMLUnsafe, cloning, import and adoption.
Only attach the source Document post-load fence when Load was already reached when selecting the timer. Publish timer notifications from open HTML streams promptly and retain the captured source snapshot when callbacks replace their Document.
Expose the nullable readonly animation member on AnimationEvent and TransitionEvent using derived CSSAnimation/CSSTransition interface conversion and native payload snapshots. Preserve inherited/member getter order, exact native object identity, callee-realm errors and early rejection of author proxies or forged brands. Verified against the CSS Animations 2 and CSS Transitions 2 IDL definitions.
Extracted from development commit bf86d34d5ae17e2830c77648ceda25ec4a03c690.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 147.256s] 22170 tests run: 22170 passed (9 slow), 20 skipped
Verify active and queued SQLite transactions remain reachable until their SQL completion, then release their native wrapper records after GC. Retained finished transactions and detached objectStoreNames snapshots must preserve visible state while discarded transactions return native registry counts to zero.
Extracted from development commit f3fe5e2269cad98395c679d466f97209199a1151.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 148.138s] 22171 tests run: 22171 passed (9 slow), 20 skipped
Retain a pending upgrade transaction from an isolated realm, retire that realm and verify the transaction retains its native identity only while JavaScript holds it. Force GC after releasing the last external reference to detect native roots of retired upgrade request/database handles.
Extracted from development commit 7698196f39.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 148.190s] 22170 tests run: 22170 passed (9 slow), 20 skipped
lanyue-llk
ldm0
wslee
Neo 孫
Johannes Pfeiffer