5 Commits

Author SHA1 Message Date
Bruno Pantaleão Gonçalves
d77040fa07 Normalize ipv6 URL for host comparison in WKSecurityOrigin (#4602)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->
The issue is the new WebView bridge origin check. It compares configured
URL hosts with WKSecurityOrigin.host and IPv6 can appear as fd00::abcd
in one API and [fd00::abcd] in another, so the bridge rejects valid
frontend messages. That blocks external auth and leaves the frontend
loading, while widgets still work.

This PR normalizes the url
## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-05-04 11:17:51 +02:00
Bruno Pantaleão Gonçalves
92214b873d Use explicit URL.port and remove fallback in SafeScriptMessageHandler (#4483)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->

Remove the portWithFallback helper and update port comparisons to use
URL.port directly. baseIsEqual now compares ports via url.port (no
80/443 fallback), and SafeScriptMessageHandler passes url.port ?? 0 when
building origin keys (security origin uses port 0 when unspecified).
This simplifies port handling and avoids implicit defaulting to standard
ports.

## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-04-07 16:47:39 +02:00
Bruno Pantaleão Gonçalves
034b8b3afa Validate script message origin (host:port) (#4470) 2026-04-02 22:21:04 +02:00
Bruno Pantaleão Gonçalves
c8f35e4cff Prevent execution of WKUserScript from beyond main frame and allowed hosts (#4469)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->

## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-04-02 13:52:29 +02:00
Bruno Pantaleão Gonçalves
e17f81f64b Organize webview folder (#4324)
<!-- Thank you for submitting a Pull Request and helping to improve Home
Assistant. Please complete the following sections to help the processing
and review of your changes. Please do not delete anything from this
template. -->

## Summary
<!-- Provide a brief summary of the changes you have made and most
importantly what they aim to achieve -->

## Screenshots
<!-- If this is a user-facing change not in the frontend, please include
screenshots in light and dark mode. -->

## Link to pull request in Documentation repository
<!-- Pull requests that add, change or remove functionality must have a
corresponding pull request in the Companion App Documentation repository
(https://github.com/home-assistant/companion.home-assistant). Please add
the number of this pull request after the "#" -->
Documentation: home-assistant/companion.home-assistant#

## Any other notes
<!-- If there is any other information of note, like if this Pull
Request is part of a bigger change, please include it here. -->
2026-02-08 15:18:43 +01:00