From ba13a3ce22fdf875b14c1cbbe200dcfa23717bf4 Mon Sep 17 00:00:00 2001 From: Jaime Burgos <73321943+SkyZeroZx@users.noreply.github.com> Date: Wed, 12 Aug 2026 23:21:58 -0500 Subject: [PATCH] fix(vscode-extension): prevent command URI injection in TSDK approval VS Code parses notification text for links and permits `command:` URIs. Interpolating the workspace-controlled TSDK path can therefore let a malicious path add a command link to the approval prompt. Remove the path from the notification instead of attempting to sanitize or escape it. This keeps the prompt static and matches VS Code's TypeScript extension workspace-version approval flow. Fixes #70176 --- vscode-ng-language-service/client/src/client.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/vscode-ng-language-service/client/src/client.ts b/vscode-ng-language-service/client/src/client.ts index c934b0b5665..2616f170c64 100644 --- a/vscode-ng-language-service/client/src/client.ts +++ b/vscode-ng-language-service/client/src/client.ts @@ -666,7 +666,7 @@ export class AngularLanguageClient implements vscode.Disposable { if (isApproved === undefined) { // Prompt the user asynchronously, without blocking current server initialization - this.promptForTsdkApproval(workspaceTsdk, stateKey); + this.promptForTsdkApproval(stateKey); } // Fall back to globalValue (or bundled) while waiting for approval or if rejected @@ -676,12 +676,12 @@ export class AngularLanguageClient implements vscode.Disposable { return jsTsTsdkInspect?.globalValue?.trim() ?? tsTsdkInspect?.globalValue?.trim() ?? ''; } - private async promptForTsdkApproval(workspaceTsdk: string, stateKey: string): Promise { + private async promptForTsdkApproval(stateKey: string): Promise { const allowOption = 'Allow'; const disallowOption = 'Disallow'; const choice = await vscode.window.showWarningMessage( - `This workspace configures a custom TypeScript compiler path (${workspaceTsdk}) via 'js/ts.tsdk.path' or 'typescript.tsdk'. ` + + `This workspace configures a custom TypeScript compiler path via 'js/ts.tsdk.path' or 'typescript.tsdk'. ` + `Do you want to allow the Angular Language Service to load the TypeScript compiler from this path?`, allowOption, disallowOption,