fix: CSP and webview errors

[jsjoeio]

Description

When we released 4.8.0, we were using the wrong hash in two HTML files causing various issues related to webviews. This fixes it.

Changes

• fix: update hashes in webview patch
• refactor: move parent-origin into webview

TODOs

• add e2e test which uses Markdown preview
• modify test-extension to use extension webview and add test

fixes #5711
fixes #5710
fixes #5708

[codecov]

Codecov Report

Merging #5712 (a515ac4) into main (005fa87) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5712   +/-   ##
=======================================
  Coverage   72.61%   72.61%           
=======================================
  Files          30       30           
  Lines        1680     1680           
  Branches      368      368           
=======================================
  Hits         1220     1220           
  Misses        397      397           
  Partials       63       63           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 005fa87...a515ac4. Read the comment docs.

[github-actions]

✨ code-server dev build published to npm for PR #5712!

• Last publish status: success
• Commit: a515ac4

To install in a local project, run:

npm install @coder/code-server-pr@5712

To install globally, run:

npm install -g @coder/code-server-pr@5712

[jsjoeio]

Decided we need to get this out ASAP so I will add tests later!

[jsjoeio]

We will publish a release candidate with a fix shortly (probably within the next 3-4 hours)

[achalagarwal]

@jsjoeio how do I use the install script to install a pre-release version?

[jsjoeio]

Apologies, that should be documented somewhere. I believe passing --edge should work. https://github.com/coder/code-server/blob/main/install.sh#L35-L36

[qjaden]

Apologies, that should be documented somewhere. I believe passing --edge should work. https://github.com/coder/code-server/blob/main/install.sh#L35-L36

code-server 4.16.1 94ef377 has the same error

[code-asher]

Hmm I am not seeing an issue on 4.16.1 using Chromium. Are you able to consistently reproduce it?

[qjaden]

Hmm I am not seeing an issue on 4.16.1 using Chromium. Are you able to consistently reproduce it?

I can 100% reproduce this issue.

I used the same configuration as this issue (#6421).

[qjaden]

Hmm I am not seeing an issue on 4.16.1 using Chromium. Are you able to consistently reproduce it?

[code-asher]

Thank you for the screenshot! Do you trigger this by opening a markdown preview or another way? I have tried a few things (markdown preview, web extension, extension readmes, Jupyter extension) but nothing triggers it for me so far.

Do you have any browser extensions installed? I wonder if there is one trying to inject a script.