scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-08-28 05:27:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

security: fix host injection vulnerability in URL validation

Browse source 
- Replace dangerous substring check webviewUri.includes('vscode-cdn.net')
- Add proper URL host validation using URL constructor
- Check url.host === 'vscode-cdn.net' to prevent injection via paths/queries
- Graceful fallback when URL parsing fails
- Addresses final CodeQL warning for incomplete URL substring sanitization
This commit is contained in:
daniel-lxs 2025-10-27 14:33:42 -05:00
parent a1c402e77b
commit 3d796de327
No known key found for this signature in database
GPG key ID: 21C74479048B3AA6
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/integrations/misc/imageDataUrl.ts
View file

@ -57,7 +57,7 @@ function webviewUriToFilePath(webviewUri: string): string {
// Use strict prefix matching to prevent arbitrary host injection
if (
webviewUri.startsWith("vscode-resource://vscode-webview/") &&
(webviewUri.includes("vscode-userdata") || webviewUri.includes("vscode-cdn.net"))
(webviewUri.includes("vscode-userdata") || isValidVsCodeCdnHost(webviewUri))
) {
try {
// Decode safely with length limits
@ -92,6 +92,20 @@ function webviewUriToFilePath(webviewUri: string): string {
/**
* Gets the MIME type from a file path
*/
/**
* Safely validates if a webview URI is from the trusted vscode-cdn.net host
* Prevents host injection attacks by properly parsing the URL
*/
function isValidVsCodeCdnHost(webviewUri: string): boolean {
try {
const url = new URL(webviewUri)
return url.host === "vscode-cdn.net"
} catch {
// URL parsing failed - not a valid URL
return false
}
}
function getMimeTypeFromPath(filePath: string): string {
const ext = path.extname(filePath).toLowerCase()