Fix MOL-554 by keeping renderer output fences for different Pages as
independent predecessors of the existing protocol output work item.
Preserve command correlation when publishing cleanup and detach events
after every original renderer prefix has crossed protocol ingress.
Cover continued and outstanding Fetch requests across two Pages, and prove
that projecting one Page's cursor cannot release another Page's output.
Validation: cargo fmt --all; workspace all-target/all-feature Clippy;
Nextest 21,987 passed, 19 skipped; Playwright reproduction passes 3/3.
Check SRI admission in the child stylesheet installer before preparing an
owner CSSStyleSheet. The later resource-result guard runs after installation
and otherwise leaves an empty sheet visible for rejected responses.
Keep error completion and load-delay release on the existing terminal path.
The process-wide allocator is already present on main. Exercise the shared
registry constructor with separate Documents that reuse a local DOM handle,
and verify exported IDs remain unique and cannot resolve in the other registry.
Remove completed responses from the frame stylesheet store. Later link and
inline import owners now enter Fetch again, so the existing cache decides
whether to reuse, revalidate or download a response, and failures can retry.
Use each request's load-delay token to match its completion before taking
the remaining subscribers. A duplicate completion cannot settle a later
request for the same signature, and revoked owners stay excluded.
Cover no-store, fresh max-age responses and network failure recovery for
both links and imports, including the parser's wait for each new completion.
Reject integrity-failed parser stylesheet responses in child Documents before preparing or installing an owner CSSStyleSheet. Complete the failed load and release its blocker through the existing terminal path.
Add eight end-to-end URL iframe/srcdoc cases covering initial and cached integrity rejection, matching hashes, CSSOM and computed style, dependent import suppression, and parser/DCL/iframe-load progress.
The regression reproduced the empty-sheet bug at the previous PR head. Validation at 32 build jobs, test threads and Tokio workers: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.212s] 22163 tests run: 22163 passed (9 slow), 20 skipped
Store DevToolsPreloadScriptId in BrowserContext preload registrations and keep registry_key unset there. Preserve typed IDs through registration, routing, removal and response projection.
Derive renderer keys through a shared descriptor projection for navigation and live updates, and derive removal keys from the same protocol ID. Extend the regression to verify that a previous renderer key cannot become a second stored identity.
Validation: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast (22,197 passed, 20 skipped).
Name mutable BrowserContext registrations context_preload_scripts and name the startup-plus-protocol projection context_document_start_script_descriptors. Update registration, removal, channel lookup and pending command names to match their ownership.
Keep startup scripts separate and preserve script IDs, renderer registry keys, diagnostic fields and execution order.
Validation: cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast (22,197 passed, 20 skipped).
`moli fetch` reads configured document-start scripts straight from
BrowserConfig, but `moli serve` builds its pages from
NavigationRuntimeConfig, which never carried them, so the flag was a
silent no-op in serve mode.
- NavigationRuntimeConfig gains `document_start_scripts`, populated in
From<&BrowserConfig>; the two exhaustive destructurings mark it as not
engine state.
- BrowserContextState::bind_page_navigation_engines seeds each configured
script into the context's default document-start registry (the same
registry BiDi addPreloadScript uses), once per context.
Verified: unit test for the config hop; end to end, a script that
increments a counter reads 1 after each of two navigations (upstream
binary: script never runs).
Support type: text through the shared module map, Window, child Documents and workers. Export UTF-8 decoded strings without executing their contents, preserve typed-module identity, and carry text request metadata through network, preload and Service Worker loaders. Regressions cover static/dynamic import sharing, BOM and invalid UTF-8, CORS, integrity, worker environments and unsupported-type rejection.
Extracted from development commit a6de018613.
Base: main (62e527cd34).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.817s] 22203 tests run: 22203 passed (9 slow), 20 skipped
The frontend router dispatches every command with a session: the client's
sessionId, or the frontend's own browser session when the client sent none.
SystemInfo.getInfo / getProcessInfo rejected any command with a session, so
over a real browser-endpoint connection they always answered "only supported
on the browser target" (unit tests passed because TestContext sends no
session). Measured: a fresh, never-attached browser-endpoint connection got
the error too.
Use the same rule as Target's browser-only operations: no session, or a
session whose route is the browser (`is_browser_session_id`). Page / frame
target sessions are still rejected (the existing two tests are unchanged).
Test: system_info_accepts_the_frontend_browser_session. Reverting the check
fails it. fmt / clippy -D warnings clean.
Limit protocol discovery checks to the selected endpoint. Run endpoint
identity comparisons and restart checks from the managed target-lifecycle
group, while preserving discovery, stability and invalid-path checks for
external endpoints.
Cover external protocol workers and managed-process restart behavior.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Filter author-provided headers in Window and Worker fetch inputs for both
URL and Request override paths, using the guard selected by request mode.
Keep trusted extra HTTP headers separate from this filtering.
Add network coverage for header handling across fetch modes and input
forms, including Window/Worker behavior and trusted-header compatibility.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Load an attacker page in Moli and exercise browser CDP, page CDP and BiDi
WebSockets against the built binary. Verify that default cross-origin
connections fail while native clients continue to work.
Include same-origin, explicit allowlist and wildcard positive controls,
and verify that rebinding Host requests remain blocked. Support Chromium
as an optional attacker-page engine.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Apply a shared guard before HTTP and WebSocket routing across CDP,
WebDriver Classic and BiDi. Accept any IP literal, or localhost and its
subdomains (including a trailing root dot). Treat an empty port as
unspecified.
Allow requests without Origin, from the bound server's HTTP origin, or
from explicitly allowlisted origins. Support repeated and comma-separated
--remote-allow-origins values and the '*' wildcard. Reject ambiguous
headers and keep Host validation independent of Origin exceptions.
Cover the HTTP routers, CDP and BiDi WebSocket handshakes, and WebDriver
text/plain session creation, including same-origin compatibility.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Generate a fresh browser WebSocket UUID per server and random 128-bit page
and tab target IDs for network CDP owners. Keep discovery URLs and protocol
target IDs consistent, and make clients discover endpoints instead of
relying on fixed paths.
Cover endpoint rotation, guessed and foreign ID rejection, and target
lifecycle behavior.
Co-authored-by: neosun100 <neosun100@users.noreply.github.com>
Determine whether a fragment is template contents from its actual native host instead of scanning parser template aliases. Preserve custom-element upgrades in declarative ShadowRoots and cover innerHTML, setHTMLUnsafe, cloning, import and adoption.
Only attach the source Document post-load fence when Load was already reached when selecting the timer. Publish timer notifications from open HTML streams promptly and retain the captured source snapshot when callbacks replace their Document.
Expose the nullable readonly animation member on AnimationEvent and TransitionEvent using derived CSSAnimation/CSSTransition interface conversion and native payload snapshots. Preserve inherited/member getter order, exact native object identity, callee-realm errors and early rejection of author proxies or forged brands. Verified against the CSS Animations 2 and CSS Transitions 2 IDL definitions.
Extracted from development commit bf86d34d5ae17e2830c77648ceda25ec4a03c690.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 147.256s] 22170 tests run: 22170 passed (9 slow), 20 skipped
Verify active and queued SQLite transactions remain reachable until their SQL completion, then release their native wrapper records after GC. Retained finished transactions and detached objectStoreNames snapshots must preserve visible state while discarded transactions return native registry counts to zero.
Extracted from development commit f3fe5e2269cad98395c679d466f97209199a1151.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 148.138s] 22171 tests run: 22171 passed (9 slow), 20 skipped
Retain a pending upgrade transaction from an isolated realm, retire that realm and verify the transaction retains its native identity only while JavaScript holds it. Force GC after releasing the last external reference to detect native roots of retired upgrade request/database handles.
Extracted from development commit 7698196f39.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 148.190s] 22170 tests run: 22170 passed (9 slow), 20 skipped
Extend the opener-only popup completion regression to CSS synthetic modules alongside the existing JavaScript graphs and JSON. Exercise both initial about:blank and committed popup Documents without attaching a frontend to the auxiliary target, verify CSSStyleSheet identity and its rule, and assert both CSS requests reach the fixture. Preserve main's rejection of unsupported text module types.
Extracted from development commit 54189266c08bd7f23eb750d8b4a4f43566b0f2ae.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 146.470s] 22169 tests run: 22169 passed (9 slow), 20 skipped
Release the parser-owned blocking stylesheet only after the runtime stylesheet load handler has applied its DOM marker. Use the existing fixture event gate and a dedicated signal route to establish the renderer/parser snapshot ordering explicitly, preserving the marker and event-order assertions without relying on two relative network delays.
Extracted from development commit f51d7c2c5e141b0926e262a35c3d21ff6cb79450.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 147.438s] 22169 tests run: 22169 passed (9 slow), 20 skipped
Warm the renderer before starting the short deadline and assert the lifecycle decider actually enters its successor-navigation grace path. Preserve the original 100 ms request timeout, 10-second grace and owner-recovery bounds.
Extracted from development commit 739748a5d14a9cfd0c5aff913146a238d97030c9.
Base: main (b30f39c580).
Validation (32 build jobs and test threads): cargo fmt --all; cargo clippy --workspace --all-targets --all-features -- -D warnings; cargo nextest run --no-fail-fast.
Summary [ 147.288s] 22169 tests run: 22169 passed (9 slow), 20 skipped
Record and preserve cookie creation time across updates, browser imports and cache persistence. Apply modern Lax-by-default request inclusion, including the age-bounded unsafe top-level navigation allowance; keep explicit Lax and Strict semantics, raw cookie visibility and diagnostic exclusion reasons. Cover age boundaries, updates, imports, persistence and navigation contexts.
Erase async task body types at RuntimeHandle::spawn so SQLite owner loops
share Tokio scheduler code. Keep blocking SQL work and results concrete,
and retain the existing task admission, failure collection and shutdown.
This boxes each submitted async task once; normal SQL commands do not gain
an additional box. The original Linux x86_64 release profile, followed by
strip --strip-all, decreases from 111026760 to 110965320 bytes (60 KiB).
Validation: cargo fmt --all; full workspace Clippy with all targets/features
and -D warnings; Nextest 22154 passed, 20 skipped; CDP smoke 92/92 on both
Moli and actual Chrome 145.
ldm0
Neo 孫
Johannes Pfeiffer