pass webview URIs as is

[AlexTugarev]

Description

in the plugin system we're patching the html content forwarded to webviews by replacing vscode-resource:/ with /webview/ in the assumption that the context path of theia is /. this will break if you put e.g. an nginx proxy in front of theia and use a location prefix. the expectation is then that the path is /some/prefix/webview with will be passed to the /webview endpoint of theia's express server.

#5619 tried to solve this issue by turning them into relative urls; I reverted in #6279 because it broke the webviews from python extension.

an alternative approach to solve this issue is described briefly in #6279 (comment); the idea is to make it configurable.

cc. @amiramw

[akosyakov]

I wonder should not we rather redesign the endpoint to send URIs as is without trying to make them part of a URL, as proposed here: #5619 (comment)

The issue is that browsers can modify URLs i.e. remove .. and . leading to another URI. If we send resource URl as a string as a part of POST body we make sure that no browser or proxy will intervene with handling it, and backend services receive it in the way how it is defined.

cc @svenefftinge @olexii4 @eclipse-theia/plugin-system

[AlexTugarev]

@akosyakov can you explain this, please?

vscode extensions might want to push html content like this <script src="vscode-resource://tmp/path/to/bundle.js"> as webview content. what would you suggest to change, in order to let the browser fetch these resources?

[akosyakov]

VS Code hooks into fetch event listener: https://github.com/TypeFox/vscode/blob/70b8db24a37fafc77247de7f7cb5bb0195120ed0/src/vs/workbench/contrib/webview/browser/pre/service-worker.js#L154-L167

and then pass the serialized path as query in order to avoid modifying it: https://github.com/TypeFox/vscode/blob/70b8db24a37fafc77247de7f7cb5bb0195120ed0/src/vs/workbench/contrib/webview/common/resourceLoader.ts#L60-L67

[amiramw]

an alternative approach to solve this issue is described briefly in #6279 (comment); the idea is to make it configurable.

@AlexTugarev Will this approach solve also the python webview scenario?