From 3d796de327664e26a67604e2188afe6fcf8ec459 Mon Sep 17 00:00:00 2001
From: daniel-lxs <ricciodaniel98@gmail.com>
Date: Mon, 27 Oct 2025 14:33:42 -0500
Subject: [PATCH] security: fix host injection vulnerability in URL validation

- Replace dangerous substring check webviewUri.includes('vscode-cdn.net')
- Add proper URL host validation using URL constructor
- Check url.host === 'vscode-cdn.net' to prevent injection via paths/queries
- Graceful fallback when URL parsing fails
- Addresses final CodeQL warning for incomplete URL substring sanitization
---
 src/integrations/misc/imageDataUrl.ts | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/integrations/misc/imageDataUrl.ts b/src/integrations/misc/imageDataUrl.ts
index 39eaa3e09f..9aaccc461a 100644
--- a/src/integrations/misc/imageDataUrl.ts
+++ b/src/integrations/misc/imageDataUrl.ts
@@ -57,7 +57,7 @@ function webviewUriToFilePath(webviewUri: string): string {
 	// Use strict prefix matching to prevent arbitrary host injection
 	if (
 		webviewUri.startsWith("vscode-resource://vscode-webview/") &&
-		(webviewUri.includes("vscode-userdata") || webviewUri.includes("vscode-cdn.net"))
+		(webviewUri.includes("vscode-userdata") || isValidVsCodeCdnHost(webviewUri))
 	) {
 		try {
 			// Decode safely with length limits
@@ -92,6 +92,20 @@ function webviewUriToFilePath(webviewUri: string): string {
 /**
  * Gets the MIME type from a file path
  */
+/**
+ * Safely validates if a webview URI is from the trusted vscode-cdn.net host
+ * Prevents host injection attacks by properly parsing the URL
+ */
+function isValidVsCodeCdnHost(webviewUri: string): boolean {
+	try {
+		const url = new URL(webviewUri)
+		return url.host === "vscode-cdn.net"
+	} catch {
+		// URL parsing failed - not a valid URL
+		return false
+	}
+}
+
 function getMimeTypeFromPath(filePath: string): string {
 	const ext = path.extname(filePath).toLowerCase()