skills/angular__angular
1
0
Fork 0
mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(vscode-extension): prevent JSDoc link provider injection

Browse Source 
Treat link targets as file paths so crafted documentation cannot select arbitrary VS Code resource providers.

Fixes https://github.com/angular/angular/issues/70512
This commit is contained in:
SkyZeroZx
2026-08-18 16:27:10 -05:00
committed by Matthew Beck
parent 58d536bc83
commit 69c87301aa
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vscode-ng-language-service/client/src/commands.ts
+6 -3
View File
@@ -182,17 +182,20 @@ function goToTemplateForComponent(ngClient: AngularLanguageClient): Command {
/**
* Proxy command for opening links in jsdoc comments.
*
* This is needed to avoid incorrectly rewriting uris.
* This is needed to avoid VS Code incorrectly rewriting file names.
*/
function openJsDocLinkCommand(): Command<OpenJsDocLinkCommand_Args> {
return {
id: OpenJsDocLinkCommandId,
isTextEditorCommand: false,
async execute(args) {
if (!args?.file) {
if (typeof args?.file !== 'string' || args.file.length === 0) {
return;
}
const uri = vscode.Uri.parse(args.file);
// Command URI arguments are untrusted. This value is a filesystem path, so use `Uri.file`
// to prevent URI schemes from selecting another VS Code resource provider.
// https://code.visualstudio.com/api/references/vscode-api#Uri.file
const uri = vscode.Uri.file(args.file);
const document = await vscode.workspace.openTextDocument(uri);
return await vscode.window.showTextDocument(document, {
selection: new vscode.Range(