skills/angular__angular
1
0
Fork 0
mirror of https://github.com/angular/angular.git synced 2026-09-14 13:54:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(vscode-extension): prevent command URI injection in TSDK approval

Browse Source 
VS Code parses notification text for links and permits `command:` URIs. Interpolating the workspace-controlled TSDK path can therefore let a malicious path add a command link to the approval prompt.

Remove the path from the notification instead of attempting to sanitize or escape it. This keeps the prompt static and matches VS Code's TypeScript extension workspace-version approval flow.

Fixes #70176
This commit is contained in:
Jaime Burgos
2026-08-12 23:21:58 -05:00
committed by Jessica Janiuk
parent 144b90c907
commit ba13a3ce22
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vscode-ng-language-service/client/src/client.ts
+3 -3
View File
@@ -666,7 +666,7 @@ export class AngularLanguageClient implements vscode.Disposable {
if (isApproved === undefined) {
// Prompt the user asynchronously, without blocking current server initialization
this.promptForTsdkApproval(workspaceTsdk, stateKey);
this.promptForTsdkApproval(stateKey);
}
// Fall back to globalValue (or bundled) while waiting for approval or if rejected
@@ -676,12 +676,12 @@ export class AngularLanguageClient implements vscode.Disposable {
return jsTsTsdkInspect?.globalValue?.trim() ?? tsTsdkInspect?.globalValue?.trim() ?? '';
}
private async promptForTsdkApproval(workspaceTsdk: string, stateKey: string): Promise<void> {
private async promptForTsdkApproval(stateKey: string): Promise<void> {
const allowOption = 'Allow';
const disallowOption = 'Disallow';
const choice = await vscode.window.showWarningMessage(
`This workspace configures a custom TypeScript compiler path (${workspaceTsdk}) via 'js/ts.tsdk.path' or 'typescript.tsdk'. ` +
`This workspace configures a custom TypeScript compiler path via 'js/ts.tsdk.path' or 'typescript.tsdk'. ` +
`Do you want to allow the Angular Language Service to load the TypeScript compiler from this path?`,
allowOption,
disallowOption,