fix(gnoweb): update ts URL construction in _fetchQEval to handle existing http protocols

[alexiscolin]

Added normalizeRemoteURL() function in main.go to ensure the remote URL has a valid HTTP(S) protocol before being used by the frontend and CSP.

• tcp:// is converted to http:// (RPC uses HTTP over TCP)
• Missing protocol defaults to http:// (local)
• http:// and https:// are kept as-is
• Updated SecureHeadersMiddleware to use the normalized URL for CSP connect-src
• This prevents malformed URLs (e.g., http://https://...) and allows users to use -remote tcp://... seamlessly.

Note: The root cause may be a misconfigured remote value in production (e.g., missing the : in https://). This fix handles the symptom, but the remote URL configuration might also be verified just in case.

[Gno2D2]

🛠 PR Checks Summary

🔴 Changes related to gnoweb must be reviewed by its codeowners

Manual Checks (for Reviewers):

• IGNORE the bot requirements for this PR (force green CI check)

Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Maintainers must be able to edit this pull request (more info)
🔴 Changes related to gnoweb must be reviewed by its codeowners

☑️ Contributor Actions:

1. Fix any issues flagged by automated checks.
2. Follow the Contributor Checklist to ensure your PR is ready for review.
   • Add new tests, or document why they are unnecessary.
   • Provide clear examples/screenshots, if necessary.
   • Update documentation, if required.
   • Ensure no breaking changes, or include BREAKING CHANGE notes.
   • Link related issues/PRs, where applicable.

☑️ Reviewer Actions:

1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.

📚 Resources:

• Report a bug with the bot.
• View the bot’s configuration file.

Debug

Automated Checks

Maintainers must be able to edit this pull request (more info)

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 The pull request was created from a fork (head branch repo: alexiscolin/gno)

Then

🟢 Requirement satisfied
└── 🟢 Maintainer can modify this pull request

Changes related to gnoweb must be reviewed by its codeowners

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 A changed file matches this pattern: ^gno.land/pkg/gnoweb/ (filename: gno.land/pkg/gnoweb/frontend/js/controller-action-function.ts)

Then

🔴 Requirement not satisfied
└── 🔴 Or
    ├── 🔴 Or
    │   ├── 🔴 And
    │   │   ├── 🟢 Pull request author is user: alexiscolin
    │   │   └── 🔴 This user reviewed pull request: gfanton (with state "APPROVED")
    │   └── 🔴 And
    │       ├── 🔴 Pull request author is user: gfanton
    │       └── 🔴 This user reviewed pull request: alexiscolin (with state "APPROVED")
    └── 🔴 And
        ├── 🔴 Not (🟢 Pull request author is user: alexiscolin)
        ├── 🟢 Not (🔴 Pull request author is user: gfanton)
        └── 🔴 Or
            ├── 🔴 This user reviewed pull request: alexiscolin (with state "APPROVED")
            └── 🔴 This user reviewed pull request: gfanton (with state "APPROVED")

Manual Checks

**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

• Any user with comment edit permission

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[jefft0]

If we change tcp://127.0.0.1:26657 to http://127.0.0.1:26657, then we also need to change it here when we set the CSP for connect-src:

gno/gno.land/cmd/gnoweb/main.go

Line 336 in de7d586

remote,

[jefft0]

... probably for other changes to the remote string, but I can't test them locally.

[jefft0]

... In fact, maybe it's better to correct the cfg.remote URL much earlier before it is used, like here:

gno/gno.land/cmd/gnoweb/main.go

Line 228 in de7d586

appcfg.NodeRemote = cfg.remote

[alexiscolin]

Thanks @jefft0! You are right, this will keep the JS fetch clean too. I Updated the PR to normalize the URL at the Go level instead

[jefft0]

Tested locally with

gnoweb
gnoweb -remote 127.0.0.1:26657
gnoweb -remote http://127.0.0.1:26657
gnoweb -remote tcp://127.0.0.1:26657