scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-09-07 08:26:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: improve vscode-cdn.net URL validation and add copy action check

Browse source 
- Fixed CodeQL security issue by properly validating vscode-cdn.net domain instead of substring check
- Added missing copy action check for HTTPS/vscode-cdn URLs before opening image
- Updated tests to match the more secure URL validation logic
This commit is contained in:
daniel-lxs 2025-09-23 15:06:27 -05:00
parent b10c87422a
commit ab402bf1d9
No known key found for this signature in database
GPG key ID: 21C74479048B3AA6
2 changed files with 16 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
src/integrations/misc/__tests__/image-handler.spec.ts
View file

@ -5,14 +5,17 @@ vi.mock("vscode", () => {
const showErrorMessage = vi.fn()
const file = vi.fn((p: string) => ({ fsPath: p, path: p, scheme: "file" }))
const parse = (input: string) => {
if (input.startsWith("https://") && input.includes("vscode-cdn.net")) {
if (input.startsWith("https://")) {
const url = new URL(input)
return {
scheme: "https",
authority: url.host,
path: url.pathname,
fsPath: url.pathname,
with: vi.fn(),
// More secure check: ensure vscode-cdn.net is the actual domain, not just a substring
if (url.host === "vscode-cdn.net" || url.host.endsWith(".vscode-cdn.net")) {
return {
scheme: "https",
authority: url.host,
path: url.pathname,
fsPath: url.pathname,
with: vi.fn(),
}
}
}
if (input.startsWith("file://")) {

8
src/integrations/misc/image-handler.ts
View file

@ -10,7 +10,11 @@ export async function openImage(dataUriOrPath: string, options?: { values?: { ac
// Example: https://file+.vscode-resource.vscode-cdn.net/file/<absolute_path_to_image>
try {
const u = vscode.Uri.parse(dataUriOrPath)
if (u.scheme === "https" && u.authority.includes("vscode-cdn.net")) {
if (
u.scheme === "https" &&
u.authority &&
(u.authority === "vscode-cdn.net" || u.authority.endsWith(".vscode-cdn.net"))
) {
let fsPath = decodeURIComponent(u.path || "")
// Strip the leading "/file/" prefix if present
if (fsPath.startsWith("/file/")) {
@ -18,12 +22,12 @@ export async function openImage(dataUriOrPath: string, options?: { values?: { ac
}
fsPath = path.normalize(fsPath)
if (fsPath) {
const fileUri = vscode.Uri.file(fsPath)
if (options?.values?.action === "copy") {
await vscode.env.clipboard.writeText(fsPath)
vscode.window.showInformationMessage(t("common:info.path_copied_to_clipboard"))
return
}
const fileUri = vscode.Uri.file(fsPath)
await vscode.commands.executeCommand("vscode.open", fileUri)
return
}